About Offscript

Why we built it

People open internal apps on work laptops, personal phones, home computers and contractor machines. Most of those will never run an endpoint agent. Malicious extensions and injected scripts run inside those browser sessions. They read what's on the page and send it out, and server logs, EDR and WAFs never see it.

Browsers can already report this. Give your app a Content Security Policy with a reporting URL, and every browser that loads it reports scripts and connections the policy doesn't allow. We take those reports, check each URL against threat intelligence, and tell you when one is malicious. It works on any device, and setup is one header.

How we work

We collect as little as we can. We only receive CSP reports from your own apps, never browsing history, page contents or keystrokes, and we delete raw reports after 30 days. Detections keep the IP addresses of the browsers that reported them, and you choose how long: forever, a set number of days, or only until the alert goes out. You get detections on a dashboard, by email, in Slack, and through a webhook. If you already collect CSP reports, we forward them to your collector unchanged.

Offscript was founded by Dominic Couture, a security engineer with a background in application security and independent research into browser extensions, including the kind of malicious extension campaigns Offscript is built to catch.

Where it fits

Offscript works alongside your EDR and WAF. It covers what runs inside the browser, including on devices with no EDR. The same detections also serve as monitoring evidence for OWASP Top 10 A03, SOC 2, ISO 27001, and PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1.