What is a CASB? The Doorman for Your Cloud Services

A sales team stores customer data in a cloud storage service the IT department does not know about. Someone tries out an AI tool and uploads an internal document in the process. Both happen in minutes, and without the right controls, nobody notices. As work has shifted into SaaS services, IT has lost part of its view: data sits outside the company's own network and can be reached from any device and any location.

A Cloud Access Security Broker (CASB) brings that view back. You can think of it as a doorman for cloud services: it checks who wants in, watches what is carried out, and knows the guest list. This article explains what a CASB does, the four pillars Gartner has defined for it, how deployment works, and what matters when selecting one.

What is a CASB?

A CASB is a security solution that sits between users and cloud services, monitors activity, and enforces security policies. It protects SaaS applications as well as IaaS and PaaS environments against attacks and data leaks. A CASB is usually delivered as a cloud service itself; variants as on-premises software or hardware also exist.

The term does not stand for a single tool. A CASB bundles several security technologies into one package, including shadow IT discovery, access control, and data loss prevention (DLP). That is why the doorman image almost falls short: a CASB works more like a complete security team, with entry checks, camera surveillance, and rounds through the building.

The four pillars of a CASB

The analyst firm Gartner describes the tasks of a CASB in four pillars:

• Visibility: A CASB tracks down shadow IT, meaning cloud services used within the company without being officially documented or approved. Such services carry risks that nobody has assessed.
• Data security: A CASB prevents confidential data from leaving controlled systems. With the spread of AI tools, this issue has become more acute, because employees can upload protected data into such tools. Access control and DLP are the load-bearing techniques here.
• Threat protection: A CASB blocks attacks from outside and stops data leaks, for example through malware detection, sandboxing, packet inspection, URL filtering, and browser isolation.
• Compliance: The cloud is distributed and never entirely in the hands of a single company. That makes requirements such as SOC 2, HIPAA, or the GDPR harder to demonstrate. A CASB enforces controls that support this evidence.

Which functions are actually behind it?

Most CASB solutions provide a toolkit of several techniques. Typical ones include:

• Identity verification: ensures that users are who they claim to be, for example via a password and a second factor.
• Access control: governs what a user is allowed to see and do in an application.
• Shadow IT discovery: finds systems and services used for work without approval.
• Data Loss Prevention (DLP): closes data leaks and prevents data from leaving the company's platforms.
• URL filtering: blocks websites used for phishing or malware distribution.
• Packet inspection: examines inbound and outbound traffic for malicious activity.
• Sandboxing: runs suspicious programs in an isolated environment to examine their behavior.
• Browser isolation: moves browsing to a remote server so that malicious code never reaches the endpoint.
• Malware detection: identifies malicious software.

We have already described two of these building blocks in detail: Data Loss Prevention with Cloudflare One and Browser Isolation .

This list is not exhaustive, and some of these techniques are also found in other products. Many firewalls handle packet inspection, and many endpoint products detect malware. What sets a CASB apart is the bundling of these techniques specifically for cloud use.

Why companies use a CASB

Cloud data can be reached from any internet-capable device and from any network. Logging in to a corporate SaaS application from a private laptop on open Wi-Fi is technically no problem; with a classic on-premises application, it would be. This openness makes companies productive and vulnerable at the same time, because the company fully controls neither where the data is stored nor every access path.

Anyone who wants to secure the cloud therefore needs cloud-based security services. If they are bought individually (one platform for DLP, one for identity, one for malware protection), the result is multiple contracts, policies maintained in several places, and permanent administrative overhead. A CASB solves this through bundling: the techniques interlock, IT negotiates with one vendor, and administration often runs through a single dashboard.

Deployment: proxy or API

There are two fundamental deployment paths. As a proxy, the CASB inserts itself into the traffic between users and cloud services and inspects it in transit. Via APIs, it integrates directly with the cloud services and controls them from within, without sitting in the traffic path. Multimode CASBs combine both approaches. Connecting to an identity provider is also common, so that access and authentication policies apply with fine granularity per user.

What to look for when selecting one

• Scalability: A CASB processes large volumes of data across multiple cloud platforms. The provider must be able to grow with the company.
• Defense instead of alerts only: Some CASBs detect threats but cannot stop them. Without a blocking capability, the value remains limited.
• Integration: The CASB must connect all relevant systems. Gaps in integration mean blind spots for shadow IT and threats.
• Data protection: How does the provider itself handle customer data, and where does it process it? For companies under strict data protection requirements, this is a central question.

Who needs a CASB?

Almost every company that works with the cloud to any significant degree benefits from a CASB. That is especially true for organizations whose shadow IT is getting out of hand, and today that is many of them. Even a handful of unapproved SaaS services can enable data leaks that go unnoticed for a long time.

CASB as part of SASE/SSE

A CASB bundles security services for the cloud. SASE/SSE goes one step further and bundles the network as well: Secure Access Service Edge unites SD-WAN with CASB, Secure Web Gateway, Zero Trust Network Access, and Firewall-as-a-Service on one platform, delivered through a global network. Cloudflare One, for example, integrates CASB, DLP, SWG, and browser isolation in one service and delivers it close to the user.

How this model works as a whole is explained in our article What is SASE/SSE? .

CASB with KAEMI

As a managed security service provider and Cloudflare partner, KAEMI integrates CASB functions as part of a SASE/SSE architecture : from capturing actual cloud usage, to policy definition, to the ongoing managed service. If you want to know which cloud services are really in use in your company, talk to us .

This article draws on Cloudflare's learning article ("What is a CASB?").