It's by certificate although the company does run an HTTP proxy for techies that doesn't MITM certs.

These days I can't be bothered to circumvent. If I want to do any sort of sensitive browsing at work (e.g. online banking) I just tether my laptop to my phone.