Surf

SURF is a Zero Trust enterprise browser for organizations. Policy enforcement runs on the endpoint inside a Chromium-based browser or a lightweight extension, so traffic is not backhauled through a proxy and no separate infrastructure has to be stood up. The on-device policy engine discovers and classifies activity, applies mask/block/allow decisions and logs each decision, and integrates with identity providers such as Okta and Entra, MDM for distribution, and SIEM tools such as Splunk.

The platform is organized around three uses. The first is securing generative and shadow AI: discovering sanctioned and unsanctioned AI tools across managed and unmanaged devices, masking PII and secrets in prompts, blocking risky uploads in real time, and governing AI browser extensions and their permission scope. The second is an agentic AI runtime that runs autonomous agents in a sandboxed, human-verified capture–analyze–plan–execute–review loop with an air gap between planning and live access, runtime sandboxing intended to block prompt injection and rogue actions, and video, log and transcript records for auditability. The third is secure remote access, giving contractors, BYOD staff and teams acquired through M&A scoped access to specific corporate applications without shipping laptops or running virtual desktops.

A compliance layer logs AI interactions in high fidelity while leaving personal browsing private, and maps controls to GDPR, ISO 27001, SOC 2 and DORA, generating audit evidence from enforcement data. The company's materials also reference alignment with frameworks and regulations including NIST, CIS controls, HIPAA, PCI DSS, SOX, CCPA, PIPEDA, LGPD and FFIEC guidance, and identity-first controls integrated with single sign-on and multi-factor authentication.

Founding story

SURF was co-founded by Moty Jacob, CEO, a cyber security professional with more than 20 years of experience as a global CISO and practitioner across military and enterprise settings, including information security leadership at Telefonica, Dunnhumby (Tesco), Traiana and CME Group, and founder of CyberKingdom, a UK CISO network of more than 200 members; and Ziv Yankovitz, CTO, who began in the Israel Defense Forces as head of R&D for a MAMRAM unit and served as CTO at Tradair, NEX/ICAP, CME Group, EBS and Traiana. Yankovitz is described as a Chromium expert and contributor to Google's vulnerability rewards program who led a Chromium-based replatforming project.

Business model

SURF sells a Zero Trust enterprise browser (and a lightweight browser extension) to organizations as a single control point that consolidates security, visibility, governance and compliance functions previously spread across VPN, ZTNA, CASB, SWG, VDI and RBI tools. It is positioned to buying centers including CIOs, CISOs, IT and security teams, compliance officers and data protection officers, with the stated benefit of reducing tool sprawl and freeing security budget.

The company sells its enterprise browser platform to corporate security, IT and compliance organizations; pricing terms are not published on the site.

Traction

The website lists security teams at Tanium, Ericsson, Vodafone, PIB Group, Check Point, Jobandtalent, Alivi and Numan as customers, and includes a testimonial from Jason Ozin, Group CISO of PIB Group. The company states it is backed by leading cybersecurity investors, with quoted endorsements from Manoj Apte (former Chief Strategy Officer of Zscaler), Austin Arensberg (Senior Director, Okta Ventures) and Robin Vasan (founder and partner at Mango Capital).

Latest developments

The company's site lists an agentic AI runtime as a new offering: a sandboxed environment for autonomous browser agents with a human-verification step, an air gap between planning and execution, and full session recording. Recent published resources include a blog post on enterprise browsers and a whitepaper on SaaS DLP, dated 2026 on the site.