There’s growing talk of digital sovereignty as enterprises rethink past consolidation decisions made in the name of simplicity.

Mozilla, developer of Firefox, argues that a “very specific, very important layer” has been mostly missing from that conversation: The browser.

To that end, the company has unveiled Firefox Enterprise in a bid to diversify the browser engine to support privacy, control, and security.

The new offering combines the Firefox browser with a management console that enterprises can run on their own infrastructure using their own tooling. Companies get a full view of their data and can govern how it moves, and IT teams can manage policy, access, and set controls around AI use.

Firefox is already deployed across thousands of organizations and used by roughly 200 million people each month, Mozilla said. It is built on Mozilla’s independent Gecko engine, the only major browser engine developed outside Google and Apple.

“If all your options are built with the same technology underneath, ‘choice’ is a lie. So is control,” Mozilla CEO Anthony Enzor-DeMeo observed in the blog post announcing the product.

The promise of Firefox Enterprise

“Firefox is hardly the first browser vendor to offer an enterprise-optimized choice,” said independent technology analyst Carmi Levy. “But it carves out a unique value proposition for IT organizations intent on maintaining independent control over how browsers are deployed, configured, secured, and managed.”

Firefox Enterprise keeps core management within an organization’s own environment; its data, keys, telemetry, and policy remain in controlled boundaries that the organization can run on-premises and audit itself. IT teams can gate access and control policies based on user and device. They can also export browser events and audit activity in their SIEM, and native DLP helps prevent data loss.

Mozilla is particularly gearing Firefox Enterprise to organizations with strict security, governance, and compliance concerns. The offering can help enterprises meet regulatory requirements like the General Data Protection Regulation (GDPR), the Digital Operational Resilience Act (DORA), the NIS2 directive, ISO27001, and SOC2.

IT teams can set external connection controls, allow or block organization-wide add-ons, and restrict browsing with a lockdown mode “so one zero-day doesn’t take down every browser in the estate,” the announcement said. AI use can be allowed, restricted, or disabled. 

From a security standpoint, enterprises can set data loss prevention (DLP) rules by domain or action, and integrate with existing security information and event management (SIEM) tools like Trellix or Broadcom to extend analysis into the browser.

IT teams can protect against phishing, malware, and malicious sites with native isolation, extension control, and managed security updates. Access can be gated based on user and device, without the need for virtual private networks (VPNs), remote browser isolation (RBI), and virtual desktops.

The company said that it will use a subscription model “that doesn’t depend on monetizing customer data or forcing a roadmap.” Firefox Enterprise includes Firefox Professional support; for businesses running the free Firefox browser without Firefox Enterprise, Firefox Professional support is available as a paid subscription.

Firefox Enterprise is now being introduced in Europe, initially across France, Germany, Austria, and Switzerland, with more markets to follow. Mozilla is also developing Thunderbird Enterprise, which will manage Thunderbird email, calendar, and contacts.

The case for enterprise browsers

Largely thanks to the shift to cloud-based computing, the browser has evolved from a simple internet gateway to the place where most workers spend virtually all of their time. This makes them “the very epicenters of modern enterprise digital security,” said Levy.

Thus it makes sense for IT to consider the merits of a dedicated enterprise browser. But, Levy said, “there are no ideal solutions in IT, and enterprise-class browsers are no exception.”

Employees may bristle at additional layers of controls and raise privacy concerns around centralized monitoring. Administrative complexity is also a concern, as existing identity management, endpoint management, monitoring, and data protection tools may not always “cleanly integrate” with a more robust browser, he noted.

Enterprise-class browsers also can’t stop “less-than-ideally-trained employees” from clicking on phishing links, and they also can’t protect against “every last malicious extension.” As always, bad actors can find ways to compromise sensitive corporate data or otherwise use AI toolsets in unsanctioned ways.

But these types of browser can help minimize AI-related risks as employees lean more heavily into chatbots and agents. Admins can craft more flexible rules of engagement; for example, workers could access a web app for deep-dive analysis, but humans and AI alike could be prevented from copying data externally. Enterprise browsers also allow more granular control of AI features, and even disengagement if they conflict with policy.

Key differentiators

Firefox Enterprise isn’t the only option when choosing an enterprise browser, however. Microsoft Edge for Business would likely still be the preferred choice for environments already heavily invested in Microsoft’s enterprise Azure and Microsoft 365 ecosystem, Levy pointed out. Similar logic would apply to Google Chrome Enterprise’s appeal for those already committed to Google’s cloud and productivity infrastructure. And the Prisma Browser from Palo Alto Networks integrates aggressive cybersecurity tools with monitoring of AI use, remote devices, and unmanaged devices.

Firefox Enterprise’s key differentiation is its use of the Gecko browser engine, and its management console that can be deployed on a company’s own infrastructure, Levy said. This might make it a good fit for shops that want to minimize implementation disruptions to existing data management, access control, and compliance protocols.

“Firefox Enterprise lets customers craft their own deployment roadmap, assuming they have the skills and resources to self-manage the process,” Levy said.

This article originally appeared on Computerworld.