What two banks report after switching to an enterprise browser

Disclosure: we resell the Island Enterprise Browser. Obsidian Ridge deploys and manages it for small firms, so we have a commercial interest in this product. Everything attributed to a bank below comes from Island's own published customer stories, read on October 22, 2026 and quoted rather than summarized. Those banks are Island's customers, not ours.

Two of the banks Island publishes stories about are small enough to be useful to a reader running a practice or a firm: a 150-year-old community bank in southwest Virginia, and a 1,000-person small-business lender in North Carolina. Both have a named security person rather than a security department, which is why their numbers are worth reading closely.

Key facts

• The Bank of Marion is a regional bank founded in 1874 with, in Island's words, "over a dozen branches across Virginia and Tennessee."
• Island's story says the bank made the browser its "default web browser," with policies "configured in under two days, no heavy IT lift."
• A real spear-phish was stopped at the password box. Island says the browser "warned the user that they were visiting a suspicious website and blocked them from inputting their credentials."
• Live Oak Bank is in Wilmington, North Carolina, founded 2008, with "some 1,000 employees."
• Island's story says a post-rollout poll found "100% of users agreed the Island browser was easy to use" and "97%" would choose it over their previous browser.
• Deployment effort came in below plan: resources to "deploy, manage, and sustain the Island platform were 75% to 80% lower than anticipated."
• A browser is one control. Island names PCI DSS and SOX support. It does not claim to be a bank's security program, and neither do we.

What The Bank of Marion says changed

Island's success story describes a bank that had bought the usual layered stack and still could not answer questions quickly. The security team already ran remote browser isolation, a web proxy, attachment sandboxing and data loss prevention.

The problem Island describes is not that those tools failed. It is that each one kept its own records. In Island's second write-up, "because each tool captured its own slice of event logging, it could take hours of hands-on expertise to put these pieces together into a contextual understanding of a security incident," and "reassembling the full event from these disparate systems could take days." That is a familiar complaint in a small shop: the controls are bought and the alerts arrive, but nobody can assemble the story without a specialist and a free afternoon.

Two operational details matter more to a small firm than the security headline. The first is legacy software. Island says that "employees can use The Enterprise Browser for all web apps, even legacy apps that require Internet Explorer legacy mode," where "previously, users had to switch between Chrome and IE," and that the browser "automatically opens a new tab in IE11 compatibility mode whenever it's required." Any practice still running one old web application that only behaves in an ancient browser will recognize that trade.

The second is administration. Island says bookmarks are "centrally managed through the Island management console and updated in every browser," and that extensions which previously "meant a help desk ticket and a manual install in Chrome" are "automatically loaded, silently, with no user intervention required." The browser also "integrates with Cisco Duo secure access system for user authentication," so the bank kept the multifactor tool it had.

On timing, the bank's information security officer, Tim Ringley, is quoted saying: "In about two days, we had everything fully ready for our test users." Island's summary card puts full rollout at "just weeks" from the first demo.

The phishing attempt, in Island's words

This is the part a small firm should read twice, because it describes a control working after a person had already made the mistake.

Island says a local business that banked with The Bank of Marion had its email server compromised. The attacker then used real previous correspondence to write a convincing message to a bank employee who regularly emailed that customer, sent from the customer's genuine server. Island is explicit that the first stage worked: "the bank employee opened the email and clicked the malicious link."

What Island says happened next is worth quoting exactly: "At that moment, The Enterprise Browser warned the user that they were visiting a suspicious website and blocked them from inputting their credentials. The employee immediately stopped, closed the page, and reported the incident." The response team then "pulled up the timeline logs from the Island management console and verified that no credentials were compromised." Island contrasts that single source of records with the earlier position on the same page, where reassembling one event from four tools "could take days."

Read that as a control placed at the last possible moment. Sender checks had nothing to work with, because the sender was real and so was the thread. What stopped the loss sat between the employee's fingers and the password field. That is the argument for browser-layer controls in one sentence, and it is Island's argument, made with its own customer's incident.

What Live Oak Bank says changed

Island's Live Oak Bank story carries more figures, and it needs the most careful reading, because the page's own summary is looser than its body.

Island's body text says: "A poll taken after the rollout found that fully 100% of users agreed the Island browser was easy to use. And nearly as many, an impressive 97%, said, if given the option, they'd choose Island over their previous browser." The page's social summary compresses that into "100% adoption." Those are different claims, and we quote the body.

The rest of the reported figures:

• Credential and bookmark migration: "Fully migrating an individual user's passwords, logins, and bookmarks took less than a minute."
• Deployment and running cost: "In a recent evaluation, Live Oak found that the resources needed to deploy, manage, and sustain the Island platform were 75% to 80% lower than anticipated." That is measured against the bank's own forecast, not a competing product.
• Why the browser at all: Island says the bank found "most of the bank's data flow was happening via the browser."

The bank's head of security operations and engineering, George Werbacher, is quoted on the investigation benefit: "When we do security investigations, whether that is a suspected piece of malware or a potential phishing link, we're actually able to see that activity at the browser level. Previously, with other tools, we could only see it from the actual laptop traffic."

One more Live Oak detail travels well. Island says the bank used the built-in password manager to inject credentials into each session, which let it "bring modern identity and access controls to legacy banking systems, without re-architecting them." A practice with one shared portal login has the same problem on a smaller scale.

What Island claims for financial services, and where the claim stops

Island's financial services page makes the compliance argument directly. Its FAQ says the product "has integrated capabilities that let financial services enterprises satisfy PCI DSS, SOX, and other regulatory requirements and maintain detailed audit trails without requiring custom code or complex integrations."

On privileged access the same page says a firm can "share passwords to others without revealing the plain text" and "allow users to easily access shared accounts while tying activity to user identities and enabling role-based access controls, even if it isn't natively supported by the application."

Two claims on that page carry no source, so we pass them on as Island's words and nothing more. Island says "seven of the world's ten largest financial institutions" use the product, and that "today, over 90% of enterprise work happens in the browser." Neither is attributed to any study. For a sourced version of the second, Forrester's 2026 research puts it lower and narrower: Island's own report page states "72% of information workers who use a computer for work purposes can do most or all of their work inside a browser."

Now the limit, stated plainly, because Island's page does not state it. A browser is one control inside a bank's information security program. It is not the program. It does not perform your risk assessment, write your policies, oversee your vendors, run your incident response, train your staff or produce your examination file. Audit trails from a browser are evidence for a control, not a compliance finding.

Worth naming too: on the pages we read there is nothing about the SEC, FINRA, FFIEC, the OCC, the FDIC, GLBA as it applies to banks, community banks or credit unions. If your examination framework is the reason you are shopping, that silence is a question for the vendor, not a gap the product has filled. Our guide to GLBA and SEC cybersecurity rules covers the obligations themselves.

What a small firm should take from two bank stories

Both stories were published by the vendor, about customers far larger than a five-person practice. Used carefully, they tell you three things.

1. The failure mode they describe is the one you have. A real thread from a compromised sender defeats sender checks. A control at the credential field does not care who sent it.
2. The administrative numbers are the transferable ones. Under-a-minute profile migration and a two-day policy configuration are small-team numbers. A 75% to 80% saving against a large bank's own forecast is not a number you can put in your budget.
3. Legacy application support is a real buying criterion. If one old web application forces a second browser today, test that application before anything else.

Then test rather than trust. Island published these outcomes and nobody independent measured them. Pilot against your own portals with test data, try every way a file can leave, read the records produced, and agree who changes a policy when legitimate work gets blocked. Our comparison of Island, SURF and Prisma Browser sets out that test and names the alternatives.

How Obsidian Ridge can help

We deploy and manage the browser so a firm without an administrator can still run per-application rules on copying, downloading, uploading, printing and screen capture. Our commercial terms:

Obsidian Ridge deploys and manages the Island Enterprise Browser for firms of any size, including a one-person firm, at $18 per user per month, month to month with no minimum number of users, with zero-configuration initial onboarding and CISSP-led support for businesses in the Research Triangle and anywhere in the United States. Managed browser policies give your business control over work-app access and how client data is copied, downloaded, uploaded or printed.

Those are Obsidian Ridge's terms, not a claim about every Island seller. The managed browser service page describes the scope and pricing shows how it sits beside monitoring. Add-ons are priced separately.

Talk with us about which applications hold customer records, who works from a personal device, and which actions you need stopped. We will separate what the browser controls from what it does not.

This is operational guidance, not legal or regulatory advice. Your examiners, compliance adviser or counsel decide which requirements apply and whether your program meets them.

Sources

All read October 22, 2026.

• The Bank of Marion Success Story: default browser, Internet Explorer legacy mode, bookmarks, extensions, Cisco Duo.
• Security Visibility Success at the Bank of Marion: founding date, branches, prior tools, the spear-phishing account.
• Island Customer Story: The Bank of Marion: the two-day quote and rollout in weeks.
• Island Customer Story: Live Oak Bank: poll figures, migration time, the 75% to 80% evaluation, named quotes.
• Financial Services: PCI DSS and SOX wording, privileged access, the two unsourced claims.
• Forrester browser security, Island's summary of a gated Forrester report: the 72% figure.