CybrGate · browser control plane
The browser became the workplace. Nobody is watching what runs inside it.
Employees now run AI agents and extensions that can read every site they visit, while they are logged in. CybrGate shows what is installed, what it can reach, and what changed. The first scan is free, needs no account, and sends nothing anywhere.
The local scan reads chrome.management on your own machine. It needs no account and no server, and it transmits nothing.
01 / The gap
A security lead now governs a surface that nobody sells to them.
Extensions run inside the browser with the user's sessions already open. AI browser agents act as the user. A review at install time cannot see what an extension does after an update, and an agent that reads a hostile page can be steered by it.
The two companies that sold into this problem now sit inside large security vendors: Palo Alto acquired Koi, and Akamai is acquiring LayerX. Their public entry points are sized for large estates. The gap in this market is not a missing feature. It is a missing buyer.
- 900,000+combined installs of two fake AI assistants that passed Chrome Web Store review in January 2026, then exfiltrated ChatGPT and DeepSeek conversation histories.public reporting, Jan 2026
- 99%of enterprise users run at least one extension.vendor-reported · LayerX
- 20%+run a GenAI extension, and 58% of those hold high-risk permissions.vendor-reported · LayerX
- Chrome 148shipped the Prompt API as stable, so a language model can run on the user's own device.Chrome release
- Chrome 149runs an origin trial of WebMCP, the surface pages use to expose tools to browser agents.Chrome origin trial
- ~$400MPalo Alto's acquisition of Koi, and ~$205M for Akamai's acquisition of LayerX.reported figures
- $20,000/yrKoi's cheapest public AWS Marketplace SKU, covering 200 endpoints.AWS Marketplace listing
- $5,000/yrSpin.AI's entry floor.AR Dynamics market research
02 / Why lists get ignored
A permission is not a risk. A combination is.
Most tools score permissions one at a time and add them up. That is why their output gets ignored. cookies on its own is an ad blocker reading a consent cookie. cookies held together with access to every site is session theft across the whole company. CybrGate scores the pair, and explains every point in a sentence the person whose extension is about to be removed can argue with.
1 medium-impact permission
- cookies
- consent.example.com
- 1 medium-impact permission+6
- Access to 1 specific host+2
Can read the login session for every site
- cookies
- <all_urls>
- Can read the login session for every site+26
- Access to every site+26
- 1 medium-impact permission+6
A pair scores higher than the sum of its parts. Both cards are output from CybrGate's engine for hypothetical extensions.
score = 100 × (1 − e−raw/55)Raw points are unbounded; the score compresses instead of saturating, so a content blocker and a credential stealer never both read 100.
The second thing it does that a one-time list cannot: it watches the delta. In January 2026 a campaign passed store review because the payload did not fire during evaluation. A score taken once, at install, cannot see that. Version-over-version permission escalation is an input to the engine, not a report you run afterwards.
03 / How it works
Free scan first. Continuous monitoring when one machine is not enough.
Free · no account
The one-shot scan
$0
- Real inventory from
chrome.management: every installed extension, its permissions, host permissions, install type and update URL. - The same engine the server runs, scoring it in the popup.
- Every point explained in plain language.
- Escalation noticed when an update takes more access.
- A page-side sentry that warns when page text looks aimed at an AI agent.
No account. No server. Nothing transmitted.LOCAL_ONLY_POLICY sets telemetry: 'none'.
Paid · $8–12 per seat per month
Continuous monitoring
What one machine cannot do
- Fleet rollup. Every enrolled browser profile, in one tenant-isolated view.
- Signed policy push. Ed25519-signed bundles that the extension verifies offline. An unsigned, badly signed or expired bundle is rejected, never quietly ignored.
- Append-only audit log. Policy publishes, logins and enrollments, in tables the database refuses to edit.
- Package analysis. The fields
chrome.managementcannot report: content security policy, remotely loaded code,externally_connectable. Where it has not run, the report says exactly what went unassessed. - Declared versus observed destinations. Hostnames an extension actually contacts, set against the hosts it declared.
Your own managed policy caps what a browser may report: none, inventory, or events. Page content is never sent at any setting.
CybrGate is an admin force-installable Manifest V3 extension, deployed through Chrome Browser Cloud Management. Enrollment uses a single-use token, and the extension talks to the server over HTTPS only.
04 / AI disclosure
A small model on your device. Never the last line of defense.
CybrGate does use AI, in one place. A local Gemini Nano classifier, reached through the Chrome Prompt API (stable in Chrome 148, per Chrome), runs on the user's own device as a second-stage false-positive filter. Page content is never uploaded to run it. CybrGate does not trigger the model download; that decision belongs to the user or the administrator.
The deterministic signatures run first and are the primary engine. A model asked whether text is an injection is itself a target of that text, so it is never the only thing standing between an agent and a credential field. It can only ever pull a verdict down.
- Page text is scanned in the page by deterministic signatures, which are primary and work offline.
- Score 20 to 69 (ambiguous): the local classifier (Gemini Nano, Chrome Prompt API, on this device) is asked. It may lower the verdict and never raise it.
- Any other score: no second opinion is asked for.
- Verdict: clean, noise, suspicious or injection.
- Signatures first. A confident match is never submitted for a second opinion.
- Ambiguous only. The model is asked only about results in the uncertain middle.
- Lower only. It can pull a verdict down, and only when it answers benign with at least 0.8 confidence.
- Validated output. An answer that is not the expected label and confidence is treated as no answer.
- No tools, no actions. It returns a label and a score. It cannot click, send or change anything.
- Correct without it. Many profiles will not have the model. The product is right with it entirely absent.
Outputs may be inaccurate. A local model can be wrong, and it is not professional or legal advice. CybrGate has no chat assistant and generates no text, image or audio for you. Where the classifier influenced an event, the event records that.
05 / What leaves the browser
Page content is scanned in the page and never transmitted.
CybrGate sees what employees browse, which makes its own data handling the product's credibility. A finding carries a signature id and where in the text it matched, never the matched text. The event journal has an explicit field allow-list per event type, and anything undeclared is dropped before it is stored.
| Data | Free scan | Paid: inventory | Paid: events |
|---|---|---|---|
| Installed extensions: id, name, version, permissions, host permissions, install type, update URL | Stays on the device | Sent | Sent |
| Hostnames other extensions contacted (never paths or query strings) | Stays on the device | Sent | Sent |
| Event journal: allow-listed fields only, including the origin (scheme, host, port) of a page where an injection was detected or an action was gated | Stays on the device | Not sent | Sent |
| Page text, full URLs, form values, selected text, clipboard, cookie values, keystrokes | Never | Never | Never |
The exact field list for every event type is in the privacy policy. Retention is set per customer, from 1 to 730 days with a default of 90, and the profile identifier is a locally generated random value, not a device serial, username or MAC address.
06 / Honest limits
What it will not do, stated before you buy it.
- A real person's click is warned and recorded, not cancelled. A cancelled trusted click cannot be faithfully replayed, and breaking a real checkout would get CybrGate uninstalled. The gate is strongest against agents, which is where the threat is.
- A lower score is not a clean bill of health. Where a check did not run, the report names it as unassessed. Missing means unverified, never fine.
- A browser-side journal can be deleted by someone holding the profile. Entries are hash-chained, and the server keeps the chain head, so a gap or a fork is visible from outside that machine.
- An extension holding
managementcan try to disable CybrGate. The engine scores that combination explicitly, and the server records when each seat last reported, so a silent seat is visible. - It is a Manifest V3 extension. Minimum Chrome 120. The local classifier needs a Chrome that offers it; without one, signatures run alone.
- It is not antivirus, endpoint protection or a compliance certificate. It is evidence and control over one surface: the browser.
07 / Pricing
Self-serve. Stripe checkout. No sales call.
$8–12
per seat per month for continuous monitoring. One seat is one enrolled browser profile.
$1,440–$2,160
a year for a 15-seat team at the two ends of that range. At 200 seats the same arithmetic gives $19,200 to $28,800 a year, and we would rather you see that now.
$0
for the local scan, with no account, whether or not you ever subscribe.
See what your browsers are running.
The free scan reads your own machine and sends nothing. If one machine is not enough, continuous monitoring starts at $8 per seat per month.