The most dangerous object in the modern office may be the innocent browser tab. It is where a salesperson drops customer notes into an AI prompt, where an engineer uploads code to a new SaaS tool, and where a contractor signs into the right app with the wrong identity. To the worker, these are tiny gestures. To a security team, each can be a data-leakage event wearing business-casual clothes.
LayerX Security was built around a blunt observation: the browser had become the workplace, but much of the security stack was still guarding the roads leading to it. Network gateways could see traffic. Endpoint tools could inspect files and processes. Neither necessarily understood the moment a user pasted a customer list into ChatGPT, switched to a personal Google account or granted a cheerful-looking extension permission to read every page.
So LayerX put the checkpoint inside Chrome, Edge, Firefox and Safari. Its managed extension observed the session, added identity and behavioral context, and applied policy at the moment of action. It could warn, redact or block. The employee kept the familiar browser. The security team got the missing camera angle.
The browser won. LayerX charged admission.
Eshed and Vaisbrud founded LayerX in 2022 after work in military web attack and defense systems. The company emerged from stealth that October with $7.5 million led by Glilot Capital Partners and Kmehin Ventures. The origin story was not a pivot from a consumer app or a lucky pandemic accident. It was a product architecture wager: secure the browser employees already chose rather than build a replacement and ask the whole company to move.
That put LayerX in a useful third lane. Traditional Secure Service Edge and Cloud Access Security Broker products were strong at inspecting connections and sanctioned applications. Enterprise browsers such as Island promised deeper ownership of the browsing environment, but came with a visible change-management bill. LayerX argued that an enforced extension could deliver the important in-session controls without a browser migration or a network redesign.
“We need to bring as much security as possible to existing browsers.”Or Eshed, LayerX co-founder and CEO
The cost to build that bet was $45 million in disclosed venture funding: the seed, a $26 million Series A in 2024 led by Glilot+, and an $11 million extension in April 2025 led by Jump Capital. The latter came with unusually practical validation. Jump Trading had deployed LayerX, and its experience helped persuade the affiliated venture firm. By May 2026, Akamai said LayerX was on track for roughly $10 million in annual recurring revenue by year-end.
Capital in / outcome
Bars are scaled for readability; acquisition value is the approximate cash consideration announced by Akamai, subject to adjustments.
What happens between a click and a block
LayerX was marketed as one platform, but its job can be understood as a four-part loop. The browser extension sees an interaction. Context arrives from the user's identity, device, application and data. Cloud intelligence scores the risk. A policy chooses whether to allow, warn, redact or stop the action. Events then flow to the management console and existing security tools for investigation.
The product covered several budgets that had started to blur together. Its AI controls discovered sanctioned and shadow tools, inspected prompts and uploads, and stopped sensitive material before it reached a model. Its SaaS controls tracked unsanctioned apps and personal accounts. Web protection addressed phishing and malicious pages. Extension management inventoried plug-ins and analyzed permissions, publisher reputation, code behavior and usage. BYOD policies could make sessions read-only or add watermarks without enrolling the whole device.
This breadth explains the later change in language. “Browser security” described the delivery point. “Interaction security,” Akamai's post-acquisition term, described the larger thing being governed - the exchange among a person, an AI agent, an application and company data.
What failed first was visibility
LayerX's public customer stories repeat the same first failure: existing controls could not see enough of the session. WCF Insurance wanted one layer for phishing, web data leakage, malicious extensions and password reuse. Similarweb wanted to consolidate browser visibility. AGG, a law firm, needed sensitive-data controls without boxing employees out of useful sites. MediaTek and KnowBe4 confronted GenAI leakage and shadow SaaS. Dun & Bradstreet wanted visibility into file-less activity, personal identities and extensions.
The customers did not suddenly decide their firewalls were useless. They changed their minds about where the last mile ended. Generative AI made the gap impossible to dismiss because the risky object was often not a file crossing a known boundary. It was text in a prompt, information in a response, or an agent taking an action inside an authenticated session.
The copyable part is the friction budget
Founders may be tempted to copy “AI security” or “browser extension.” The more durable idea is less fashionable: LayerX treated workflow change as a product cost. It found a control point where buyers could add capability without demanding new daily behavior from every employee. That shortened the distance between a security team's yes and a workforce's actual adoption.
Where the shortcut stops working
The extension approach has boundaries. It is only as mandatory as the browser-management policy behind it. If users can create unmanaged profiles, remove the extension, switch to an uncovered browser or move the task into a native application, the control point develops exits. LayerX expanded into desktop AI visibility under Akamai for precisely this reason: work does not promise to remain inside one tab.
Conditions that weaken the model
- No reliable MDM or browser policy to force installation and prevent bypass.
- Critical work happens mostly in native apps, terminals or channels the extension cannot observe.
- The buyer wants full ownership of the browser build, not controls layered onto a consumer browser.
- Privacy, labor or regulatory rules prohibit the session-level monitoring required by the policy.
- The organization expects one extension to replace network, endpoint, identity and data security entirely.
Pricing was another private surface. LayerX sold enterprise contracts, with AWS Marketplace describing a user-based contract dimension, but did not publish a standard public rate. That means the honest cost calculation is larger than a license: covered users, management effort, policy design, privacy review and the security tools it can actually consolidate.
Akamai bought the point of interaction
Akamai announced the acquisition in May 2026 and closed it on July 2 for approximately $205 million in cash. The founders and team joined its Zero Trust organization. A month later, LayerX became Akamai Workforce Protector, adding desktop AI and agent visibility and integrating with Akamai's private-access products. AWS had already selected LayerX for Security Hub Extended, while a Google Chrome Enterprise collaboration covered extension risk.
The new name is corporate, but the old insight is intact. Work is no longer a place or even an application. It is a stream of small interactions: type, paste, upload, approve, ask an agent. LayerX made those verbs legible to security teams. Akamai's wager is that the company controlling those verbs can connect workforce security to the rest of the enterprise stack.
There is no magic in being close to the user. Proximity creates responsibility, false positives and uncomfortable questions about monitoring. Yet LayerX's result is a clean case study in product positioning. It chose the least disruptive place to enforce a newly urgent policy, then waited for the market to realize the browser was not merely where work was displayed. It was where work happened.