Executive Order 14028 told federal agencies to stop trusting the network perimeter and start verifying every session. OMB Memorandum M-22-09 turned that into a federal Zero Trust strategy, and agencies spent the years since re-architecting identity, network segmentation, and device posture around it. CISA's Zero Trust Maturity Model and TIC 3.0 pushed the same principle further: assume breach, inspect continuously, minimize the blast radius when something goes wrong.
The browser didn't get the same treatment. For most agencies, web access policy still comes down to a binary choice: allow a site or deny it. Allow something malicious and the agency absorbs the risk. Deny something legitimate, a vendor portal, a research site, a partner's SaaS tool, and the agency absorbs the productivity loss. Neither outcome satisfies a Zero Trust mandate built on the assumption that any session could be hostile.
That binary breaks down hardest in the grey categories: newly registered domains, uncategorized sites, miscellaneous or unknown destinations. They're neither clearly good nor clearly bad, and that's exactly why spear-phishing infrastructure and zero-day payloads live there. A category-based block list can't act on a domain registered yesterday. Signature-based detection can't act on a payload it has never seen. No detect-and-block model, however well-tuned, can close a gap defined by the absence of a known signal.
Agencies handling Controlled Unclassified Information need a way to let users reach the open web, grey middle included, without treating either the risk or the productivity loss as a foregone conclusion.
Remote Browser Isolation gives agencies a third option alongside allow and deny. Instead of rendering a web page on the endpoint, RBI opens the session in a Palo Alto Networks-hosted, ephemeral browser and streams only the pixels back to the user. No page code, script, or file from that session ever executes on the government device.
A zero-day exploit or drive-by download delivered through an uncategorized or newly registered domain never reaches the endpoint. It runs, and is discarded, inside the isolated session. Each session starts from a clean instance, and nothing persists between sessions, so there's no foothold for an attacker to build on across visits.
For CUI-handling workflows, RBI also gives agencies granular control over what leaves the session. Clipboard, upload, download, and print can each be governed independently, so users can read and interact with grey-category content without a path to exfiltrate data through it. Verify continuously, minimize blast radius, and stop assuming "allow" has to mean "trust": that's the same logic the Zero Trust mandate already runs on.
RBI reached General Availability for FedRAMP Moderate on April 21, 2026 and is now listed on the FedRAMP Marketplace. It's also confirmed as a supported service on Palo Alto Networks' Prisma SASE FedRAMP Moderate and High support page.
Agencies handling CUI can now bring RBI in as an authorized control inside their compliance boundary, instead of treating browser isolation as a commercial-only capability that has to be evaluated and risk-accepted separately from everything else in the stack. For agency security teams already mapping Zero Trust controls to FedRAMP Moderate requirements, RBI fits directly into that mapping.
To see RBI applied to real federal use cases, join our 90-minute virtual hands-on workshop on Wednesday, September 9, 2026, from 9:30 to 11:00 a.m. PDT. You'll get direct access to a pre-provisioned demo tenant (nothing to install) and work through guided labs built around agency scenarios, alongside the team building RBI's federal capabilities.
Register: https://register.paloaltonetworks.com/remote-browser-isolation
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
| Subject | Likes |
|---|---|
| 4 Likes | |
| 3 Likes | |
| 2 Likes | |
| 2 Likes | |
| 2 Likes |
| User | Likes Count |
|---|---|
| 6 | |
| 4 | |
| 3 | |
| 2 | |
| 2 |
