Browser security statistics for 2026, with sources

Disclosure: we resell the Island Enterprise Browser. Obsidian Ridge deploys and manages it, so we have a commercial interest in the case these numbers make. Every figure below was read on island.io on October 22, 2026 and is quoted exactly.

Read this before you quote anything here. Almost every figure on this page was published, distributed, sponsored or commissioned by Island, the vendor that sells the product the numbers support. One Forrester study was paid for by Island directly, three reports are hosted by Island behind download forms, and two figures are its own research team's work. That does not make them wrong, and we quote each one in its original words rather than rounding it into a better headline. It does mean you should not present any of them as independent evidence. Where a figure carries no source at all, we say so and leave it as the vendor's assertion.

Key facts

• 72% of information workers can do most or all of their work in a browser (Forrester, 2026).
• 68% of organizations say browser-based incidents rose over two years (Omdia, 400 professionals).
• 93% of security leaders report board support, but 60% say the board does not understand cybersecurity (Cyber Security Tribe, 455 practitioners, 2026).
• 344% return on investment (Forrester Consulting TEI study commissioned by Island).
• Nearly half of 475,865 scanned AI tools raised at least one security finding (Island's own research, August 2026).
• Every figure here comes from a report Island published, sponsored or commissioned.

How much work happens in the browser

72% of information workers could work entirely in a browser

The figure: "72% of information workers who use a computer for work purposes can do most or all of their work inside a browser, making it the de facto enterprise endpoint."

Who measured it: Forrester, described on the page as "Forrester's 2026 research." No sample size is given on the landing page. The report itself is gated, so this is Island's summary of it. Source.

How to read it: This measures capability, not activity. Most office workers could do their job in a browser, which is the relevant fact if you are deciding where to put a control. It does not say 72% of all work occurs there.

81% of security decision-makers say they are adopting browser security

The figure: "81% of security decision-makers say they're adopting browser security solutions, but most are relying on network-layer tools that miss what's happening inside the browser itself."

Who measured it: Forrester, 2026, same gated report and same page as above. No sample size published.

How to read it: The second half of that sentence is Island's argument, not a measurement. The measured part is the 81% adoption intent.

"Over 90% of enterprise work happens in the browser" is unsourced

The figure: "Today, over 90% of enterprise work happens in the browser."

Who measured it: Nobody is named. This appears in an FAQ answer on Island's financial services page with no study, sample or date attached.

How to read it: As Island's assertion and nothing more. If you need a defensible number for this claim, use Forrester's 72%, which is lower, narrower and attributable. The same page also states that "seven of the world's ten largest financial institutions" use Island, likewise with no source.

What practitioners report

68%, 82% and 59%, from 400 IT and security professionals

The figures, verbatim:

• "68% of organizations have seen browser-based security incidents increase over the past two years"
• "82% of organizations using traditional tools as their primary browser security approach report at least one significant challenge"
• "59% rank generative AI security as their most important use case for a secure browsing solution"

Who measured it: Omdia. The page says the report "reveals how 400 IT and cybersecurity professionals are navigating the growing complexity of browser security."

Who paid: Not stated on the landing page. Island hosts and distributes it behind a download form. Source.

How to read it: The 82% figure is also the most circular: it surveys organizations relying on traditional tools and reports that they have challenges. The 59% is a ranking of priorities, not a measurement of risk.

93%, 60%, 73% and 70%, from 455 security leaders

The figures, verbatim:

• "93% of security leaders report board support, yet 60% don't believe their board actually understands cybersecurity"
• "73% of organizations have agentic AI in use or actively in development within their security programs"
• "70% have AI policies in place, but average policy strictness scores just 6.9 out of 10"

Who measured it: Cyber Security Tribe, 2026. The page says the report "draws on 455 practitioners at VP, Director, and C-level."

Who paid: Not stated. Island distributes it behind a download form. Source.

How to read it: The 93% against 60% pairing describes large organizations with boards, so it tells you about the market, not about you. The 70% with a strictness score of 6.9 is the small-firm lesson in disguise: having an AI policy and enforcing one are different things.

Economics

344% ROI, and four other TEI figures

The figures, verbatim: "344% return on investment with Island"; "employees saved 52 hours of time per year" using Island's productivity features and AI tools; "security risk exposure reduction by up to 90%"; "latency reduction of 300 milliseconds per web request"; "save $1 million per year in legacy tech costs."

Who measured it: A Forrester Consulting Total Economic Impact study commissioned by Island. The page states that "Forrester Consulting conducted a study to examine the potential return on investment (ROI) enterprises can realize by adopting the Island Enterprise Browser." Source.

Who paid: Island. That is what commissioned means, and it is standard for the TEI format.

How to read it: With the most caution of anything here. The report is gated, so these are Island's selected figures. The payback period and the size of the modelled composite organization are not public, so a $1 million annual saving cannot be scaled to your headcount. Island's page summary also compresses the productivity finding into "12 minutes daily"; the body says 52 hours a year, and that is what we quote.

Customer reviews

5.0 out of 5 from 331 reviews, and a Customers' Choice

The figures, verbatim: "Island is a Customers' Choice in the 2026 Gartner® Peer Insights™ Voice of the Customer for Secure Enterprise Browsers, based on 331 verified reviews from customers." "Island's overall rating is 5.0 out of 5, from 331 verified reviews submitted over 18 months as of May 2026." "98% of reviewers said they would recommend Island."

Who measured it: Gartner Peer Insights, reviews collected over 18 months to May 2026. Source.

How to read it: Peer Insights is a review aggregation, not an analyst evaluation, and Gartner is explicit about that. Its required disclaimer, copied verbatim from Island's page:

Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose.

The report page says Island is "a Customers' Choice." It makes no claim to be the only one. Use that phrasing, because an exclusivity claim is a different and stronger assertion than the report supports.

AI and agent exposure

475,865 tools scanned, nearly half with a finding

The figures, verbatim: "Our research team scanned 33,563 published MCP server builds containing 475,865 tools. Nearly half raised at least one security finding, and about 1 in 8 exposed a tool that could execute code, delete data, or take an irreversible action on the first call."

Who measured it: Island's own research team, in a post dated August 25, 2026. Source.

How to read it: This is vendor research with no published methodology, and "at least one security finding" is doing a lot of work, since the severity distribution is not given. The 1 in 8 figure is the sharper one, because it describes a specific capability rather than a count of findings.

7,600 malicious repositories, 800 posing as AI tooling

The figures, verbatim: "Our team uncovered roughly 7,600 malicious GitHub repositories, more than 800 posing as AI Skills or MCP servers, in a campaign delivering the StealC information stealer. The lures showed up over 600 times across public AI registries."

Who measured it: Island's own research team, same post and date.

How to read it: This one is a concrete, checkable claim about a named malware family, which makes it more useful than a survey percentage. It is still the vendor's own count.

What we left out, and why

Four things that appear in Island's material are not on this page.

• An ESG survey figure that "over half" of company data is accessed in consumer browsers: unsourced within a sponsored report.
• Robotic process automation ROI figures from Island's content-compliance pages: generic industry numbers, not Island results.
• Statistics from Island's compliance checklist pages. Several contradict each other on observation periods and control counts.
• A point-of-presence count. The published figure does not match the product's own console, so no number is worth quoting.

We have also not added independent figures from outside Island's material. A roundup like this would be stronger with one, and the honest statement is that we did not open and record a non-vendor source for this version.

What a small firm should do with these numbers

Use them to decide where to put a control, not to justify a purchase. The one figure that genuinely bears on a five-person office is Forrester's 72%, because it tells you the browser is where the work is, and therefore where the data leaves. Everything else describes organizations with boards, analysts and virtual desktop estates.

If you want to know whether a managed work browser fits your firm, the useful evidence is not a survey. It is a pilot against your own applications, which is what our comparison of Island, SURF and Prisma Browser sets out, and what two regulated firms actually reported, which is in our write-up of two bank deployments.

How Obsidian Ridge can help

We deploy and manage the browser, including per-application rules on copying, downloading, uploading, printing and screen capture. Our commercial terms:

Obsidian Ridge deploys and manages the Island Enterprise Browser for firms of any size, including a one-person firm, at $18 per user per month, month to month with no minimum number of users, with zero-configuration initial onboarding and CISSP-led support for businesses in the Research Triangle and anywhere in the United States. Managed browser policies give your business control over work-app access and how client data is copied, downloaded, uploaded or printed.

Those are Obsidian Ridge's terms, not a claim about every Island seller. The managed browser service page describes the scope and pricing shows how it sits beside monitoring. Add-ons are priced separately.

Talk with us about which applications hold your client data and what you need stopped. We will not quote a survey at you.

Sources

All read October 22, 2026.

• Forrester browser security, Island's summary of a gated Forrester report: 72%, 81%.
• Omdia Browser Security Report, gated, distributed by Island: 68%, 82%, 59%, 400 professionals.
• Cyber Security Tribe Report 2026, gated, distributed by Island: 93%, 60%, 73%, 70%, 455 practitioners.
• Forrester TEI Report, a Forrester Consulting study commissioned by Island: 344%, 52 hours, 90%, 300 ms, $1 million.
• Gartner Peer Insights Voice of the Customer: 331 reviews, 5.0 out of 5, 98%, and Gartner's disclaimer.
• Agents Work Everywhere Now, Island research, August 25, 2026: the MCP and GitHub figures.
• Financial Services, Island: the two unsourced claims.