Sensor vs Extension
Acium UBS has two on-device components, and they cover different ground. The extension is required and works on its own; the sensor is optional and unlocks additional enforcement and device-posture data. This page is a quick reference for what each one covers — for full detail on either, see Acium UBS basics.
Comparison
| Browser extension | Acium sensor | |
|---|---|---|
| Required? | Yes | No (optional) |
| Installs on | Chrome, Edge, Firefox | Windows or macOS device (not browser-specific) |
| Needs admin rights to install | No | Yes |
| Web Control (block/allow sites, YouTube filtering) | Enforces | — |
| AI and Data Controls (copy/paste/upload/download/camera/mic, sensitive-data masking) | Enforces | — |
| Extensions management (allow/block/force-install) | Enforces (see note below) | Required for full blocking (see note below) |
| Browser Settings (browser hardening policies) | — | Enforces |
| Browser Routing (reopen a URL in a different target browser) | — | Performs the actual reopen, via Detours (Windows only) |
| Authentication | Manual sign-in or browser-profile sign-in | Enables sensor-based silent (attestation) sign-in |
| Basic device/browser info (IP, hostname, OS, device type) | Collected the moment a user signs in | — |
| Full device inventory (serial number, domain name, per-browser profile list) | — | Collected |
| Windows device posture (BitLocker, TPM, SecureBoot, Defender, Device Guard, AppLocker, and more) | — | Collected (Windows only) |
| AI Tools & Agents (AI apps installed on the device, outside the browser) | — | Detected |
| Auto-deploys the extension to installed browsers | — | Yes |
| Security Events / activity data sent to the console | Yes | Relays through the extension |
What requires the sensor
Without the sensor, the extension alone still enforces Web Control and AI and Data Controls, and reports activity to the console. The following don't work, or work in a reduced form, without it:
- Extensions management enforcement — without the sensor, extensions over the configured risk threshold are only disabled, not fully blocked. Full blocking requires the sensor to be present on the device.
- Browser Routing — has no effect at all without the sensor, and only works on Windows even with it.
- Browser Settings profiles — not enforced without the sensor.
- Device details not collected without the sensor, and only available on Windows.
- AI Tools & Agents (device-installed AI apps, as opposed to browser-based AI usage) — not detected without the sensor.
- Silent, attestation-based sign-in — without the sensor, the extension falls back to browser-profile sign-in or a manual sign-in prompt.
An org-wide Allow device data collection without the Sensor setting exists (see Set up your organization) as a fallback for collecting device data on specific domains even when the sensor isn't installed.
Deploying either component
See Deploy the sensor and extension for installation methods, including deploying the sensor at scale with an RMM.