CASB (Cloud Access Security Broker)

What is a CASB (cloud access security broker)?

A CASB (cloud access security broker) is a security control point placed between users and cloud services, enforcing the organization policy on the traffic or the data passing through it. Gartner defined the category around four pillars: visibility, compliance, data security, and threat protection. It emerged when employees started reaching cloud applications the corporate perimeter never saw.

How a CASB is deployed

• Forward proxy: traffic from managed devices is routed through the broker, usually through an agent.
• Reverse proxy: traffic to sanctioned applications is redirected through the broker at login.
• API mode: the broker connects to the application API and inspects data and configuration after the fact.
• Log analysis: firewall and proxy logs are parsed to discover which cloud services are in use.
• Most deployments combine several modes, since none of them covers every case alone.

Where the CASB model strains

Proxy modes assume managed devices and controllable network paths. Remote work, personal devices, and applications reached directly from a browser session weaken both assumptions. API mode avoids that but only covers applications the broker integrates with, which brings the problem back to inventory: a broker cannot govern an application nobody declared and no integration exists for.

Examples and use cases

A company deploys a CASB to block uploads of customer data to unsanctioned storage services, and it works on corporate laptops. The gap appears with an AI assistant that employees connect to the company drive through an OAuth grant, never touching the network path the broker watches. Detecting that means reading the grants inside the identity tenant rather than the traffic, which is the discovery layer Corma provides alongside the broker.

Related concepts

• Full visibility to prevent shadow IT
• IAM for security teams
• SaaS management platform

FAQ

What is the difference between CASB and SSPM?

A CASB controls access and data flow to cloud services, often in real time. SSPM inspects the security configuration inside SaaS applications through their APIs. One governs traffic, the other governs settings.

Is a CASB the same as a secure web gateway?

No. A secure web gateway filters general web traffic. A CASB understands specific cloud applications and applies policy at the level of the action taken inside them.

Does a CASB replace SaaS management?

No. It secures the applications it knows about. SaaS management answers which applications exist, who pays for them, and who holds a seat in each one.

Is CASB still a standalone category?

Increasingly it is bundled into broader security service edge and SASE platforms rather than bought on its own.

Request a demo