Marking its first acquisition since going public, Cloudflare Inc. today said it has bought S2 Systems Corp., a startup that protects companies against web-borne threats by isolating workers’ browsers from the internet.

Financial terms were not disclosed. S2 Systems’ office in Kirkland, Washington, which has about 10 workers, will turn into a Cloudflare engineering hub.

S2 Systems is the brainchild of David Harnett and Darren Remington, two Microsoft Corp. veterans who had spent more than a decade at the tech giant before striking off on their own. Hernett, the startup’s chief executive, worked at Microsoft Research, while Executive Chairman Darren Remington most recently led the company’s Startup Business Group.

S2 Systems has built a security platform that provides a layer of separation between the user’s browser and the internet. When workers open a web page, it isn’t downloaded onto their devices but rerouted to a cloud-based sandbox where the content is opened in isolation, which blocks any malware lurking within from going further. S2 then draws an interactive recreation of the isolated web page inside the user’s browser using the Skia open-source graphics library.

S2 is one of several startups that provide browser isolation capabilities. However, it claims one big advantage over the competition: performance.

Traditional browser isolation approaches, such as rendering a web page in the cloud and streaming a video recording to the user’s device, “can be slow, bandwidth-intensive, and it breaks many sophisticated web applications,” Cloudflare CEO Matthew Prince (pictured with co-founder and Chief Operating Officer Michelle Zatlyn) explained in a blog post. In contrast, Prince said, internal testing had shown S2 technology provided “an experience that was typically at least as fast as browsing locally and without broken pages.”

Cloudflare has used S2’s platform as a building block for a new security service called Gateway. Gateway is a managed firewall introduced today that, in addition to providing browser isolation features, allows enterprises to block users from visiting malicious domains and scans traffic for malware.

Cloudflare introduced Gateway alongside Cloudflare Access, another new security service. It’s a virtual private network that lets remote workers safely log into company applications via an encrypted network connection. Cloudflare Access is essentially an enterprise version of Warp, a consumer VPN the company debuted last April that has racked up millions of users worldwide.

Gateway and Cloudflare Access are the first offerings in a security product line the company dubs Cloudflare for Workers. “All Cloudflare for Teams products are informed by the threat intelligence we see across all of Cloudflare’s products,” Prince wrote. “We see such a large diversity of internet traffic that we often see new threats and malware before anyone else. We’ve supplemented our own proprietary data with additional data sources from leading security vendors.” 

Cloudflare for Teams represents a major expansion of the provider’s ambitions in the security market. The company has spent the last few years building out a breach prevention portfolio, focusing mostly on tools for protecting enterprises’ infrastructure. With Cloudflare for Teams, Cloudflare’s capabilities now extend to protecting workers’ devices as well.

Photo: NYSE/Twitter