Cloud Access Security Broker (CASB)

A Cloud Access Security Broker (CASB) is a control layer that sits between users and cloud services and keeps an eye on how employees use them. It mediates traffic to SaaS, PaaS and IaaS applications, so an organization can see which cloud services are in use and stay in control of its data and access, and respond to threats in places a traditional firewall or web gateway cannot reach. The term was popularized by Gartner around 2012, which framed CASB through four pillars: visibility, compliance, data security and threat protection.

What is a CASB?

A CASB extends a company’s security rules beyond its own network — out to cloud services that people sign in to from any device and location. A regular firewall looks at network traffic at the internet edge. A CASB goes further and understands what happens inside the cloud application itself: who is signing in, to which service, what they do (download a file, share it, change permissions) and what kind of data is involved. That is why it can enforce a rule at the level of a specific in-app action, not just an IP address or domain.

A CASB does not replace the cloud provider’s own security. It works under the shared responsibility model: the provider looks after the infrastructure, while the CASB helps the customer organization watch over what it owns — configuration, access, data and what users do.

What are the four pillars of CASB?

• Visibility — discovering every cloud service in use, including shadow IT: apps that employees start using without IT approval. The CASB builds an inventory of those apps, scores their risk and shows who uses each one and how.
• Compliance — keeping cloud data in line with the law and internal rules, such as GDPR, HIPAA or PCI DSS, together with auditing and reporting.
• Data security — protecting data in motion, at rest and in use: spotting sensitive data, Data Loss Prevention (DLP, meaning leak prevention), encryption, tokenization and control over who can access which files.
• Threat protection — detecting malware, compromised accounts and behavior that deviates from the norm, such as a login from an unusual place or a sudden bulk download. Behavioral analytics (UEBA) helps here.

How does a CASB work?

A CASB’s work can be broken into three steps:

1. Discovery — finding all cloud applications, both sanctioned and unsanctioned. This usually happens by analyzing logs from firewalls and web proxies.
2. Classification — assigning a risk level to each service and to the data flowing through it.
3. Remediation — acting on the rules: allow, restrict or block an action, quarantine a file, require multi-factor authentication, raise an alert to the security team (SOC).

What are the CASB deployment modes?

• API mode (out-of-band) — connects directly to the cloud provider’s API. It can scan data at rest and configuration without redirecting traffic, but it does not block actions in real time and works only for sanctioned apps that expose an API.
• Forward proxy (inline) — user traffic goes through the CASB on its way to the cloud, so it can apply DLP and block actions on the fly. It usually needs an agent or configuration on a managed device.
• Reverse proxy (inline) — traffic goes through the CASB on the application side, usually thanks to integration with an identity provider (SAML, SSO). It also covers personal devices, but works only for apps that support such integration.
• Multimode (hybrid) — combines API and inline modes to get both broad coverage and real-time blocking at once.

Inline mode adds some latency and can become a point whose failure interrupts traffic. API mode avoids those costs but reacts only after the fact. The choice depends on what matters more: blocking things as they happen, or broad visibility and control over configuration.

CASB and shadow IT

Shadow IT means cloud services used without IT’s knowledge — from personal file-sharing accounts to unapproved AI tools. It is a real risk, because company data ends up outside the reach of the company’s rules and monitoring. A CASB discovers these apps from traffic, scores their risk and lets you decide: allow, restrict (for example, block uploads) or block entirely.

How does a CASB differ from DLP, SASE and SSE?

CASB vs. DLP. DLP is the technology that detects and blocks leaks of sensitive data. A CASB usually has DLP functions, but applies them in the context of cloud applications. Classic DLP protects data across the network, on endpoints and in on-premises storage. In practice the two often integrate or share the same rules.

CASB vs. SASE and SSE. Security Service Edge (SSE) is a cloud-delivered bundle of security services that combines CASB, a secure web gateway (SWG) and Zero Trust Network Access (ZTNA). Secure Access Service Edge (SASE) is the bigger picture: SSE plus networking functions (such as SD-WAN) in a single cloud platform. In other words, a CASB is part of SSE, and SSE is part of SASE. A standalone CASB still exists, but is increasingly absorbed into these platforms.

Why does a CASB matter for security and monitoring?

For the security team (SOC) and the people monitoring the network, a CASB is a valuable source of information about what happens inside cloud applications. That is not visible in firewall logs or NetFlow records. CASB events — logins, file operations, permission changes, attempts to share something externally — are usually forwarded to a SIEM and matched against other sources. This makes it easier to spot situations such as account takeover, data being moved to a personal cloud, or privilege abuse.

It is worth knowing the limits, though. API mode reacts with a delay, so it cannot stop an action at the moment it happens. Inline mode only covers traffic that passes through it — traffic from personal devices, networks outside the company’s control, or directly through application APIs can bypass it. Traffic is encrypted (TLS), so deeper inspection requires decrypting it, which raises questions about performance and privacy. A CASB is therefore a complementary layer, not a replacement for NDR, EDR or identity controls.

Learn more

• SaaS Security Posture Management (SSPM) — SSPM assesses SaaS security settings, while CASB controls access and monitors data use in SaaS apps.
• BYOD (Bring Your Own Device) — CASB helps enforce access and data policies for SaaS use on employee-owned devices.
• On-premise / Cloud / Hybrid — CASB is used to secure cloud app access in hybrid environments alongside on-premises controls.