> Basically, instead of doing DLP/URL filtering/risk management on a MITM box, they're pushing it to the browser. This helps remove the need for TLS decryption, and the need to funnel their browser traffic to any particular tunnel endpoint.

This is where it should have been done in the first place instead of breaking TLS and creating enormous risks when that corporate MITM private key goes for a walk.

I think that these DLP/content inspection solutions should not be preferred as a first line or blanket solution because they are inherently risky and can easily be deployed wrong. Not to mention creating big privacy and security risks for users, such as when someone wants to check their bank balance from their work machine.

But in cases where there is a clear benefit when dealing with highly sensitive information, doing this inspection right in the browser is the least worst option from a security perspective when it is correctly integrated with the browser and not hacked on.

What do you specifically mean with "risk management"? Device posture?

I think we hit all the features you mention but not sure about the above.

Native DLP is specifically listed as a feature FYI, also mentions compatibility with Broadcom and Trellix.

Edit: "website filtering" too