Remote Browser Isolation (RBI)
What is it?
Remote Browser Isolation runs web browsing activity in a secure, sandboxed environment on Cloudflare's network instead of on the user's local device. The user sees and interacts with the web page normally, but the actual code (JavaScript, HTML) never executes on their machine. If a web page contains malware, it's contained in the cloud sandbox and never reaches the endpoint.
What problem does it solve?
The web browser is the #1 attack vector for most organizations:
- Drive-by downloads: Simply visiting a malicious or compromised website can install malware on a user's device.
- Phishing: Users click links that lead to credential-stealing sites.
- Zero-day browser exploits: New vulnerabilities in Chrome, Firefox, or Edge can be exploited before patches are available.
- Data leaks: Users can copy, paste, print, or download sensitive data from web apps.
Traditional security approaches (antivirus, URL filtering) try to determine if a website is safe before loading it. But this is a cat-and-mouse game — attackers constantly find ways around these defenses. Browser Isolation flips the model: assume every site could be dangerous and isolate it.
How does it work?
- A user clicks a link or navigates to a website.
- Instead of loading the page on the user's device, Cloudflare loads it in a remote browser running on a Cloudflare data center nearby.
- The user sees and interacts with a pixel stream (or DOM rendering) of the page — it looks and feels like normal browsing.
- No web code ever runs on the user's machine. Malware, keyloggers, and exploits are contained in the cloud sandbox.
- When the session ends, the sandbox is destroyed.
Cloudflare's RBI uses Network Vector Rendering (NVR), which sends drawing commands (rather than pixel streams) to the user's browser, resulting in a near-native browsing experience with much lower bandwidth usage than traditional pixel-pushing approaches.
Key use cases:
- Isolate risky links from email (integrate with Email Security)
- Protect access to sensitive apps (isolate in read-only mode to prevent copy/paste/download)
- Allow access to uncategorized/risky websites without risk to the endpoint
Why it matters strategically
RBI is a differentiator in Cloudflare's SASE platform — not all competitors offer it, and those that do often have poor user experiences (laggy pixel streaming). Cloudflare's NVR approach gives it a real technology edge. RBI is typically sold as a premium add-on alongside Gateway and Access, increasing deal sizes.