Menlo IRIS: turn browser policy into observable evidence
An approved policy needs to reach the session where work happens. Assess behavior by user, browser and action before expanding restrictions.
Lire en portugaisBy Pentesty
The launch and its scope
Menlo announced IRIS on November 12 as a managed extension for existing browsers, including data-movement controls and extension inventory. Its announcement presents CDR and HEAT Shield AI as optional. The described offering does not establish which functions are licensed, configured or effective in a particular environment evaluating it.
To assess the proposal, begin with a business decision: which work should remain possible and which transfer should be prevented? Write examples in language the process owner can review. A pilot built around concrete actions lets the team discuss deployment limits and user experience without depending on a generic demonstration of the administrative dashboard or an assumed deployment configuration.
Define the unit of coverage
Choose an initial combination of test user, device, browser profile and authorized application. Record the extension configuration and policy version expected to reach that session. Where the organization uses several profiles, make each one an explicit exercise case. The matrix should show what was actually included, enabling owners to understand the population represented by the resulting observations.
Include a control case where a legitimate task should succeed. Use artificial text for the restriction scenario and different material for the allowed scenario. Document the destination and expected action beforehand, such as pasting a passage or uploading a disposable file. That preparation helps assess coverage beyond the presence of an extension icon and provides a repeatable starting point.
Observe the action and the user message
Perform each attempt through the application’s normal workflow and record the visible result, corresponding administrative event and time. Check whether the information reached the authorized test destination. A blocking notification and prevention of the actual transfer should be assessed in the same case. Keep artificial material out of services that are outside the approved scope of the exercise.
Ask the process owner to assess the message shown to the user. It should explain how to request help or an approved exception. Where a necessary action was blocked, record the business impact and correction path. A rule can produce its expected technical result while still requiring changes that let the team continue its authorized work with a usable support procedure.
Check administration and exceptions
Agree on a test procedure for loss of contact with central management, browser restart and an authorized policy change. Observe whether the session can identify its received rule and when the change took effect. Record unknown conditions rather than treating them as success. The process owner should explicitly accept any contingency behavior demonstrated by the pilot before it reaches additional users.
Include an additional extension already approved for the laboratory and check whether the inventory identifies it in the assessed session. Avoid installing suspicious material as a demonstration. The purpose is to connect inventory, ownership and administrative decisions using a known component. Assign responsibility for reviewing future changes and require a recorded expiry and justification for any temporary exception.
Approve expansion by workflow
Review the pilot with support staff before increasing the population. Collect successful legitimate actions, confirmed restrictions and inconclusive cases, identifying the corresponding user and profile combination. Record the effort needed to diagnose a failure as well. That information helps plan deployment and support capacity during policy changes, making operational cost and unresolved cases visible to the responsible business owner.
The deliverable should support repetition after a browser, extension or application update. Preserve configuration references, the results matrix and an authorized rollback procedure. Expansion should follow the assessed workflows and their owners. New profiles, transfer channels or licensed capabilities enter the plan as changes requiring their own evidence, with a review date and an accountable decision about the remaining uncertainty.
Frequently asked questions
What establishes that a session was covered?
Record the user, profile, configuration and received policy, plus an attempt with an observed outcome. An extension icon alone does not complete that verification.
Does the pilot need a malicious file?
Use artificial files and known extensions in the laboratory. The exercise should assess administration and authorized behavior without introducing suspicious material into the environment.
How should an exception be assessed?
Assign an owner, justification and expiry. Repeat the permitted action and check that the exception did not change other cases that should remain restricted.
When should policy be reassessed?
Reassess after material browser, extension, application or profile changes. Preserve previous cases to compare the effect on approved work.
Sources and references
Original Pentesty analysis, published November 12, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.