Guardz integrates Prisma Browser, adding AI tool controls for MSPs

Guardz's integration of Palo Alto Networks' Prisma Browser for Business, announced November 14, 2026, adds browser controls for ChatGPT, Claude and Gemini to a platform that already tracks email, identity and endpoint activity for small business customers.

The browser matters more than it used to. Employees reach business applications, company data and generative AI tools through it, and attackers follow the same trail. Guardz says a phishing email can push a user to a fraudulent login page and expose credentials that then get used elsewhere, which is why the vendor wants browser sessions inside the same investigation window as everything else.

The integration's pitch is one identity, one view. Guardz's managed detection and response team gets browser events joined with email activity, Microsoft 365 events and endpoint telemetry, so a blocked phishing click can be correlated with the rest of a user's trail instead of sitting in a separate log nobody reads.

What does the integration actually join together?

Guardz describes three feeds merging under a single user identity:

• Browser events from Prisma Browser for Business
• Email activity and Microsoft 365 events
• Endpoint telemetry

Alongside those sit user risk scores and security awareness data, according to Guardz. The vendor says the platform helps security teams assess incidents around one identity, and that adding Prisma Browser for Business extends that approach into browser sessions where staff increasingly meet SaaS applications and AI services.

Operationally, the piece Guardz highlights is prevention plus context, delivered as a pair of actions that happen close together in time. If a user clicks a phishing link, the browser product can block the destination page while the wider platform ties that event to related signals for investigation, rather than simply recording the click and moving on.

The stated goal is a single view of activity tied to one user identity across workplace systems, shared by the managed service provider and Guardz's own managed detection and response team. Guardz also says its platform enables MSPs to autonomously investigate, correlate and respond across the workspace while letting small businesses use AI tools with fewer restrictions, which is the tension every small-business security sale runs into.

What is a "Man-in-the-Prompt" attack?

Guardz used the announcement to spotlight research from Elli Shlomo, Head of Security Research at Guardz, on what the company called a "Man-in-the-Prompt" attack.

In that scenario, a malicious or compromised browser extension alters an employee's prompt to an AI tool just before submission, inserting hidden instructions and extracting business data through the user's own authenticated session. According to Guardz, network monitoring and data loss tools may not detect unusual behavior, because the request appears to come from a legitimate signed-in user.

That is the part with teeth for MSPs. A request that looks like the customer's own employee, running inside a normal session, on a managed endpoint, is exactly the traffic most filters wave through, and the prompt itself becomes the delivery mechanism.

The countermeasure is extension vetting. Prisma Browser for Business can block unvetted extensions before they interact with prompts, Guardz said, which moves the security decision ahead of the AI request rather than after the data has already left the tenant.

What can MSPs actually restrict now?

The integration adds policy controls for browser-based AI services including ChatGPT, Claude and Gemini. Managed service providers can apply customer-specific restrictions on copying, pasting, uploading and downloading by website or category. A reporting function lets them monitor AI tool usage for each client.

That granularity is the commercial hook. An MSP serving dozens of small businesses cannot ship one blanket AI policy, so per-customer rules and per-customer usage reports are what make browser control sellable through that channel.

It also answers a problem that grew out of the AI boom itself. Staff paste invoices, customer lists and contracts into chat windows, so controls on copy, paste, upload and download by site or category are the ones that touch real data movement, and Palo Alto Networks' own framing points at the same convergence.

Why does deployment speed matter?

Guardz says the product targets managed service providers supporting small business customers that want browser controls without a long deployment. Setup and default configuration can be handled quickly, including through remote monitoring and management tools.

An early-access user put it plainly. "The rollout through our RMM was super smooth. Within minutes, the Prisma Browser for Business was on every device, including their Chrome and Edge profiles, and it was quick and easy to configure and deploy," said Kevin Kehoe of Datawise Networks.

That matters because MSPs bill by seat and by client. A browser agent that takes days to roll out across Chrome and Edge profiles on customer devices is a project, not a product line item, and most small-business security budgets cannot absorb either the delay or the labor.

What are the two vendors claiming?

Dor Eisner, Chief Executive Officer and Co-Founder of Guardz, framed the deal around identity.

"Identity is the new center of gravity in cybersecurity, and the browser has become the primary gateway to the modern workspace. Traditional security tools operate in silos, leaving critical gaps in visibility and response," said Eisner. "Together with Palo Alto Networks, we're advancing a new era of identity-centric security operations, connecting signals across identity, browser, email, endpoint, and data into a unified security fabric that is powered by agents."

Shivam Srivastava, Vice President of Product at Palo Alto Networks, pointed at the small-business attack surface. "Browser is the core workspace for small businesses - where business apps, AI tools, and sensitive data converge. It also where a vast majority of attacks that target small businesses originate - from phishing to ransomware to fraud & scams," said Srivastava.

He also cited scale. Palo Alto Networks is "combining Palo Alto Networks' enterprise grade security, powered by intelligence from 70,000 customers and billions of threats blocked every day, with the wide coverage and support that Guardz provides to protect every small business," per the announcement.

Neither announcement included pricing, a general availability date, or detection numbers for the Man-in-the-Prompt research Guardz cited. For MSPs, the open question is whether joined browser, email and endpoint data shortens investigations in practice, and whether per-client AI usage reporting survives an audit.

The sharper test comes later, when a compromised extension reaches a prompt inside a signed-in session and the platform has to stop it without a human noticing the anomaly first. If Guardz's telemetry and Palo Alto Networks' enforcement hold that line across thousands of small-business tenants, browser control stops being a separate purchase and becomes part of the identity stack MSPs already sell.