Cloudflare Buys Browser Isolation Startup S2 Systems For $39.2 Million

Cloudflare says it believes that S2’s technology is capable of protecting endpoints from zero-day vulnerabilities without sacrificing speed, website compatibility or user experience.

Cloudflare has purchased early stage browser isolation vendor S2 Systems to keep security threats away from devices and make everyday web browsing safer and faster.

The San Francisco-based security and performance services vendor said Kirkland, Wash.-based S2’s browser isolation technology executes browser code on cloud servers rather than on a user’s device. As a result, Cloudflare said security threats will be kept away from the user’s device and only rendering instructions will be sent to the viewer’s browser.

“The experienced team at S2 Systems has built an advanced technology that we believe surpasses other browser isolation technologies,” Cloudflare co-founder and CEO Matthew Prince said in a statement. “We can’t wait to integrate their stellar team within Cloudflare and utilize their remarkable technology in our platform as we continue to help build a better internet.”

[Related: Cloudflare Stock Up 22% In First Hours Of Public Trading]

The $39.2 million acquisition closed Jan. 1 and includes a $21.9 million cash payment as well as 948,501 shares of Cloudflare stock that will vest after the deal closes, according to a filing with the U.S. Securities and Exchange Commission. Cloudflare did not immediately respond to a request for additional comment.

Cloudflare said it believes that S2’s technology is capable of protecting endpoints from zero-day vulnerabilities without sacrificing speed, website compatibility or user experience. The company’s stock is up $0.04 (0.23 percent) in trading midday Tuesday to $17.71 per share.

S2 was founded in 2018 by former senior Microsoft employees and employs 10 people, according to LinkedIn. As a result of the acquisition, the S2 team has joined Cloudflare at the company’s new office in the Seattle metropolitan area.

“Cloudflare’s team is nimble and mission-led, and we felt there were great synergies across our teams and alignment across our ambitions and goals,” S2 Systems co-founder and CEO David Harnett said in a statement. “Their ability to run code at the edge—the way it should be run—is unlike anything we’ve seen before, and we’re excited to join our technology with their existing platform.”

Existing browser isolation tools typically force users to make a trade-off between security and performance since they either rely on streaming video of web content (which is known as pixel streaming) or attempting to sanitize known malicious content (which is known as DOM reconstruction). Cloudflare said that S2’s approach is designed to avoid that trade-off.

The S2 remote browser isolation is based on the open-source Chromium engine, which powers Google Chrome as well as 21 other web browsers, including the new Microsoft Edge browser, according to a blog post Tuesday from Darren Remington, Cloudflare’s director of product strategy innovation.

S2’s architecture is technically superior to its competitor from both a security and website computability standpoint since the underlying data transport isn’t an existing attack vector and there aren’t any emerging vulnerabilities, Remington said.

From a performance and user experience standpoint, Remington said S2 is typically faster than local browsing and offers an experience that feels so much like native browsing that users generally aren’t aware they’re browsing remotely. S2 requires less bandwidth than local browsing for most websites, Remington said, and leverages compatible browsers already installed on desktop and mobile devices.

S2 also has lower operating costs than existing remote browser isolation technologies, which Remington said makes deployment to an entire enterprise rather than just targeted users feasible and attractive for customers. The company’s platform also enables the implementation of adjacent services like data loss prevention, content disarm and reconstruction, and phishing detection and prevention.

“S2 Systems Remote Browser Isolation Service … eliminates the disconnect between the conceptual potential and promise of browser isolation and the unsatisfying reality of current RBI [remote browser isolation] technologies,” Remington said in the blog post.

This is Cloudflare’s first acquisition since November 2017, when the company purchased mobile app performance vendor Neumob. All told, Cloudflare has made five acquisitions since being founded 11 years ago, according to Crunchbase.