CrowdStrike is buying Seraphic Security to lock down the browser, where work actually happens

Learn more.

CrowdStrike announced Tuesday an agreement to acquire Seraphic Security, a browser runtime security provider, in a move that signals growing recognition among cybersecurity firms that traditional protective measures have failed to keep pace with how employees actually work.

The acquisition, expected to close during CrowdStrike’s first fiscal quarter of 2027, will integrate Seraphic’s browser-level protection into CrowdStrike’s Falcon platform. Financial terms were not disclosed, but a source tells CyberScoop that the deal is worth $420 million, to be paid predominantly in cash with a portion in stock subject to vesting conditions.

The deal reflects an emerging challenge in enterprise security: while browsers have become the primary workspace for most employees, they remain largely unmonitored by existing security infrastructure. CrowdStrike cited data indicating 85% of the workday is now spent in web browsers, yet traditional security models have treated browsers as peripheral rather than central to threat detection.

Current approaches to browser security typically force users into specific enterprise browsers or route traffic through network monitoring systems that can slow performance. Seraphic’s technology operates within the browser runtime itself, working across Chrome, Edge, Safari, and Firefox on both company-managed and personal devices without requiring users to switch platforms.

The acquisition arrives as enterprises grapple with security implications of generative AI tools and autonomous AI agents that increasingly operate through browser interfaces. CrowdStrike specifically highlighted concerns about unauthorized AI applications potentially extracting corporate data, an issue the company refers to as “shadow AI.”

The deal continues CrowdStrike’s expansion beyond its core endpoint detection business into adjacent security domains. Last week, the company announced its intention to buy identity management startup SGNL for $740 million. CrowdStrike plans to combine Seraphic’s browser monitoring with technology from SGNL in order to enable dynamic access controls that adjust permissions based on real-time risk signals rather than static credentials.

This approach represents a departure from perimeter-based security models that dominated enterprise cybersecurity for decades. By monitoring activity at the session level within browsers, the combined technology aims to detect threats that occur after initial authentication, including session hijacking and sophisticated phishing attempts.

The strategy also addresses a persistent challenge in enterprise security: protecting data accessed by contractors, temporary workers, and employees using personal devices. Seraphic’s browser-level approach provides monitoring capabilities without requiring full endpoint security software installation.

CrowdStrike CEO George Kurtz characterized the acquisition as part of a broader strategy around “Zero Standing Privilege,” a security model that grants minimum necessary access for specific tasks rather than maintaining permanent permission levels.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure