What Is a Cloud Access Security Broker (CASB)?

What Is a Cloud Access Security Broker?

As defined by Gartner in 2012, a CASB is a cloud-delivered solution that addresses security across four functions:

• Visibility: Identifies all cloud apps in use, including unsanctioned SaaS and GenAI apps.
• Data Security: Enforces DLP policies that prevent data leakage.
• Threat Protection: Flags malware, compromised accounts, and suspicious behavior. 
• Compliance: Applies consistent policy to comply with HIPAA, GDPR, and other regulatory requirements.

Why Is CASB Important?

Visibility Challenges: The Rise of Shadow AI

Many employees use GenAI apps that aren’t approved by IT, which creates risks that traditional, perimeter-based security can’t protect against.

CASB gives critical visibility into shadow AI risks. According to ThreatLabz researchers:

Data Security: Sensitive Data Moves Through Unsanctioned GenAI Apps

Generative AI amplifies the risk of data leakage because LLMs can store information from user prompts and output that information to other users. 

CASB data loss prevention (DLP) policies block users from uploading sensitive data to unsanctioned LLMs.

Threat Protection: SaaS Apps Spread Malware

Users sometimes upload or share infected files with trusted SaaS platforms. Those platforms can then distribute malware across your organization. Malware hidden in sanctioned SaaS apps can bypass traditional web security controls because it’s treated as trusted traffic.

CASB uses AI-powered threat detection to stop malware from spreading.

Compliance: Consistent Policy Enforcement Is a Requirement

Data breaches, which often stem from compliance challenges, now cost organizations almost $5M, on average (IBM Cost of a Data Breach Report 2026).

CASB enforces consistent policy across every cloud app so that security teams don’t have to configure each app manually. With consistent enforcement, organizations can maintain compliance with frameworks like HIPAA, GDPR, and PCI-DSS.

How Do CASBs Work?

CASB enforces security policy on cloud app traffic inline, via API integration, or via a multimode approach.

Inline CASB

Inline CASB includes two modes: forward proxy mode and reverse proxy mode. 

Forward proxy mode CASB sits inline between a user’s device and the internet. It intercepts requests for cloud services en route to their destination. 

In this mode, the proxy is typically an agent, proxy auto-configuration (PAC) file, or an explicit proxy configuration on a managed device.

Reverse proxy mode CASB provides real-time enforcement like forward proxy mode, but it sits between the user and the cloud app instead of between the user and the internet.

Reverse proxy mode secures BYOD environments. Because it integrates through single sign-on (SSO) and doesn’t require endpoint configurations, it can see traffic that forward proxies miss.

For example, when a contractor on an unmanaged device authenticates through the IdP, the IdP will redirect the session through CASB. The solution then enforces policy before the user accesses the app. 

While reverse proxy mode helps organizations secure BYOD, its coverage scope is limited. Each app must be configured to integrate with SSO, but that takes significant time and IT resources. Reverse proxies also miss traffic that doesn’t route through the IdP redirect, such as direct API calls or app-to-app connections.

API Mode CASB

Instead of sitting in the traffic’s path, API-based CASB connects directly to a cloud app’s API. It inspects data at rest inside the application. 

Multimode CASB

Proxy and API modes offer different types of coverage. Proxy modes identify risks in real time, but they can’t see what data is stored within applications. API mode detects risky actions within applications, but it can’t respond immediately. 

A multimode CASB gets the full benefits of inline and API-based CASB by running both modes simultaneously. With this approach, inline CASB gives immediate responses while API-based CASB provides the coverage needed to secure data in cloud apps. 

CASB, SSE, and SASE: How Do They Relate?

In 2019, Gartner introduced the secure access service edge (SASE) category to address remote work and SaaS app usage trends. The definition built on the CASB category that Gartner defined in 2012. SASE includes CASB, SD-WAN, and other security capabilities like SWG, ZTNA, and FWaaS. 

With SASE, organizations can consolidate policy management, reduce their security spend, and enforce data protection policies inline.

Gartner created another category, security service edge (SSE), in 2021. SSE represents the security side of SASE, and includes capabilities like CASB, SWG, ZTNA, and FWaaS. Many organizations start with SSE and deploy SASE when they're ready to refresh their existing networking infrastructure.

CASB vs. SSPM, DSPM, and SSE: How These Tools Compare

Understanding how tools like SaaS security posture management (SSPM), data security posture management (DSPM), CASB, and SSE compare makes it easier to see how these solutions fit into a broader security architecture.

When CASB Is Not Enough

Cloud access security brokers have some limitations. For example, they can’t see into SaaS-to-SaaS connections, OAuth connections, or misconfigurations inside of specific SaaS apps. They also can’t see data at rest in unconnected repositories.

SaaS security posture management was built to close the CASB visibility gap, and most organizations deploy the two solutions together.

Running CASB, DSPM, and DLP with a single SSE policy engine improves security further. IT can enforce policy from a shared identity context and a single dashboard. Teams no longer have to reconcile policy and enforcement across different platforms.

How CASB Works Alongside DLP, DSPM, and Advanced Threat Protection

CASB applies DLP policies across its inline and API-based inspection. DSPM extends that data classification into data at rest and across repositories that CASB can’t see.

Advanced threat protection, which includes malware scanning, sandboxing, and behavioral anomaly detection, runs inline with CASB’s traffic inspection. When they work together, CASB and advanced threat protection can:

• Correlate user behavior with threat signals, 
• Consistently enforce context-aware policies, and 
• Detect compromised accounts and insider threats across SaaS apps.

Top CASB Use Cases

1. Shadow IT Discovery and Control

CASB gives IT and security the visibility they need to get a handle on their shadow IT.

Real-world example: After adopting CASB, a global biopharma company discovered over 15,000 apps in their environment. With that visibility, their IT teams were able to deprecate unused apps and mitigate shadow IT risks.

2. Data Loss Prevention for SaaS and Cloud Data

DLP helps organizations control where sensitive data flows within the organization. CASB gives visibility into data and access across public clouds, SaaS apps, LLMs, and databases. It can immediately respond to risky shares. 

Real-world example: A leader in the food and beverage industry adopted CASB as a part of an SSE deployment. Each month the company prevents 4 million policy violations and blocks 14,000 threats, on average. 

3. Threat Prevention Across Cloud and SaaS Traffic

Once an infected file gets into a sanctioned cloud app, it can quickly spread to connected apps and other users’ devices. CASB defends against these threats in real time.

In addition to malware, cloud apps are vulnerable to attacks that use compromised accounts. User and entity behavior analytics (UEBA) functionality in CASB solutions helps address this risk. UEBA flags activity that deviates from a user’s established “normal” behavior, which can be an early indicator of compromise. 

These solutions also detect suspicious behavior such as large file downloads, access to data that’s outside the user’s normal scope of work, or bulk file sharing to external addresses. Once detected, these solutions trigger alerts and block activity like downloads to proactively stop attacks.

Real-world example: A government organization upgraded its technology to secure remote access for its employees. During this upgrade, it discovered that its old proxies weren’t consistently flagging malicious websites. With their new solution, the organization prevents about 7 million policy violations a month, on average.

4. Monitoring and Governing Shadow AI and GenAI App Usage

CASB gives IT teams visibility into shadow AI and helps enforce DLP policy to reduce the risk of data leakage.

Real-world example: A nonprofit organization rolled out CASB as a part of an AI security initiative. The organization generated reports to understand employee GenAI app usage and how that usage translated into data security risks. With these capabilities, the organization saved $500k from AI operations improvements alone.

How To Implement a CASB

1. Assess your environment. Understand what cloud services and applications you’re using. Then map where sensitive data currently lives and flows inside of your organization.  
2. Define policy requirements. Determine which access controls, DLP rules, and compliance frameworks the CASB needs to enforce. Evaluate SSE capabilities to see if you'd benefit from a broader SSE rollout, rather than adopting CASB as a point solution.  
3. Choose the right CASB vendor for your needs. Look for a multimode CASB solution that provides the integrations and policy requirements that you outlined earlier. 
4. Integrate with existing identity and security infrastructure. Connect CASB to your IdP/SSO and DLP engine. 
5. Roll out CASB in phases. Start by getting visibility into your baseline risks before moving on to policy enforcement. This will minimize any disruptions that users face during the rollout.
6. Continuously refine policies. Review your shadow IT discovery reports. Update sanctioned and unsanctioned app lists in addition to DLP rules as usage and risks change. 

CASB and AI Security

Generative AI has become the fastest-growing form of shadow IT. Enterprise AI and ML activity increased 83% year-over-year, and the ecosystem of AI apps almost quadrupled to over 3,400 applications (ThreatLabz 2026 AI Security Report). 

Much of that GenAI app usage happens outside of formal approval processes, which means that it falls into CASB’s domain.

Modern CASBs must scale to handle the volume of data being transferred to GenAI. In 2025 alone, data transfers to GenAI apps increased by 93% to over 18,000 terabytes of data (ThreatLabz 2026 AI Security Report).  

When deployed as a part of an AI-powered SSE platform, modern CASB solutions provide:

• Shadow AI discovery: The same application discovery engine that identifies unsanctioned SaaS apps can also identify unsanctioned GenAI apps. 
• DLP for AI prompts and uploads: Policies extend to govern what content users share in a GenAI prompt window.
• Behavioral threat detection: Anomaly detection flags compromised accounts and unusual traffic patterns.

Zscaler CASB

Zscaler delivers multimode CASB as a part of the Zero Trust Exchange platform, which provides both SSE and SASE capabilities. Zscaler has been named a Leader in the Gartner Magic Quadrant for SSE each year from 2021 to 2026.

With Zscaler CASB, organizations get:

• AI-powered data classification that surfaces sensitive data across SaaS apps, IaaS, and GenAI applications. Security teams enforce DLP policy without needing to manually audit each application. 
• Zscaler AI Guard inspects prompts and uploads to block sensitive data from reaching unsanctioned LLMs.
• ThreatLabz threat intelligence routes emerging attacker TTPs into detection models and dynamically updates policy enforcement.

Request a demo to see how Zscaler CASB can secure your organization.