[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is a CASB (Cloud Access Security Broker)?](/blog/casb) Publish date June 30, 2025 {x} minute read # What is a CASB (Cloud Access Security Broker)? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Catherine Chipeta](/team/catherine-chipeta) Cybersecurity Writer Catherine's work has influenced leaders in technology, SaaS, government, and financial services. Reviewed by [Axel Sukianto](/team/axel-sukianto) Marketing Director Table of contents Free resource ### [Download now](#) A [CASB (cloud access security broker)](https://www.upguard.com/glossary/casb) is an intermediary between users, an organization, and a cloud environment. CASBs allow organizations to manage cloud security and enforce [security policies](https://www.upguard.com/blog/information-security-policy) through a consolidated platform. The term CASB was [introduced by Gartner in 2012](https://www.gartner.com/en/information-technology/glossary/cloud-access-security-brokers-casbs), defined as “... on-premises, or cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the cloud-based resources are accessed.” CASBs are one of many emerging technologies recognized by Gartner, alongside other cloud security solutions, such as [Cloud Security Posture Management (CSPM)](https://www.upguard.com/blog/cspm) and [Cloud Infrastructure Entitlement Management (CIEM)](https://www.upguard.com/blog/cloud-infrastructure-entitlement-management). ## How Does a CASB work? CASBs protect the flow of data between an organization’s users and cloud services, such as [Software-as-a-Service (SaaS)](https://www.upguard.com/blog/saas-security-risks) products. They enact organizations’ security policies to offer comprehensive and consistent cloud security, across all applications and resources, accessed from any device. CASBs can integrate with other security functions, including: * [Data Leak Prevention (DLP)](https://www.upguard.com/blog/data-loss-prevention) * [Security Information and Event Management (SIEM) systems](https://www.upguard.com/blog/what-is-siem) * Firewalls * Secure Web Gateways (SWGs) ## CASB’s Role in Cybersecurity With [61% of businesses migrating their workloads to the cloud in 2020](https://techjury.net/blog/how-many-companies-use-cloud-computing/), organizations must effectively manage the cybersecurity risks and [cloud misconfigurations](https://www.upguard.com/blog/cloud-misconfiguration) which inevitably follow the implementation of new technology. Common cloud-based services like software-as-a-service (SaaS), platform-as-a-service (PaaS), and [infrastructure-as-a-service (IaaS)](https://www.upguard.com/blog/cloud-service-provider-roundup-the-best-of-the-best) all have their own independent security functions in place. While these [third-party vendors](https://www.upguard.com/blog/third-party-vendor) provide their own security and protection methods, there is no single management point for security teams. The [security posture](https://www.upguard.com/blog/security-posture) of each service provider also differs across platforms which increases the potential for threat actors to identify and [exploit](https://www.upguard.com/blog/exploit) cloud [vulnerabilities](https://www.upguard.com/blog/vulnerability). CASBs allow organizations to enforce their own security policies across all cloud services and user devices accessing the cloud through several functions. ### The Four Pillars of CASB Gartner categorizes CASBs’ functions into four pillars to achieve [network security](https://www.upguard.com/blog/network-security). #### 1. Visibility CASBs provide visibility over user behavior across the cloud. This visibility covers the usage of cloud apps that are deployed by an organization’s IT team (sanctioned apps) and those that are not (unsanctioned apps aka shadow IT). For sanctioned apps, CASBs can log and audit cloud usage patterns and other [indicators of compromise](https://www.upguard.com/blog/indicators-of-compromise) to prevent potential unauthorized access. For example, if a user is trying to access a SaaS application from two different geographical locations simultaneously, the CASB will flag this information and alert the[ information security](https://www.upguard.com/blog/information-security) team. CASBs identify the use of shadow IT, allowing organizations to determine what action to take next. Many CASB services also provide the [security rating](https://www.upguard.com/blog/what-are-security-ratings) of all applications users are attempting to access to help security teams determine whether or not to authorize access. #### 2. Compliance CASBs help organizations manage and [monitor regulatory compliance](https://www.upguard.com/blog/compliance-monitoring). Most service providers offer frameworks to guide the formation of security policies for recognized compliance regulations like [GDPR](https://www.upguard.com/blog/how-to-be-gdpr-compliant), [HIPAA](https://www.upguard.com/blog/hipaa-privacy-rule), [CCPA](https://www.upguard.com/blog/what-is-the-ccpa), and [FISMA](https://www.upguard.com/blog/fisma). A CASB will also log users’ access to data and identify all data stored in the cloud, enabling more efficient compliance auditing and reporting. #### 3. Data Security At their core, CASBs offer [data security](https://www.upguard.com/blog/data-security) and protection. They can recognize sensitive data such as Payments Card Industry (PCI) data, [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii), and [protected health information (PHI)](https://www.upguard.com/blog/protected-health-information-phi), and apply stricter security controls to ensure adequate protection. CASBs use data manipulation techniques to secure data including: * **Anonymization:** Removes identifying data completely. * **Pseudonymization: **Replaces identifying data with generic data, e.g. replacing a full birth date with the birth year. * **Tokenization: **Replaces identifying data with non-sensitive data - called tokens. #### 4. Threat Protection CASBs offer protection against [cyber threats](https://www.upguard.com/blog/cyber-threat) surrounding user behavior and data access to help prevent [cloud leaks](https://www.upguard.com/blog/what-are-cloud-leaks), [data breaches](https://www.upguard.com/blog/data-breach), [malware intrusions](https://www.upguard.com/blog/malware), and other [cyber attacks](https://www.upguard.com/blog/cyber-attack). Leveraging user behavior analytics, a CASB performs detailed logging to establish consistent operating patterns. They identify irregular behavior and challenge it with additional authentication. Organizations can also set automatic controls such as limiting file downloads, restricting users from accessing information not required for their job, and enforcing additional controls if a user is frequently accessing resources they don’t require. ### CASB Security Policies CASBs consolidate multiple security policies, enabling simultaneous enforcement across all cloud activity. Some examples of security policies enforceable by CASBs include: * User and Entity Behavior Analytics (UEBA) * Single Sign-On (SSO)/[Security Assertion Markup Language (SAML)](https://www.upguard.com/blog/what-is-saml) * Authentication * Authorization * Device Profiling * Credential Mapping * [Encryption](https://www.upguard.com/blog/encryption) * Logging * Alerting * Malware Detection and Prevention ## CASB Types The way in which a CASB secures access depends on which method of deployment it uses. There are three different types of CASBs deployment methods. ### API-based CASB API-based CASBs use custom code to facilitate access between the user and a specific cloud application. ### Agent-based CASB Agent-based CASBs are [forward proxies](https://www.upguard.com/blog/proxy-server) placed on a managed endpoint (e.g. company laptop), enabling it to enforce security policies before the endpoint accesses cloud apps. ### Agentless CASB Agentless CASBs are [reverse proxies](https://www.upguard.com/blog/proxy-server) that sit on the organization’s end, used to authorize or deny cloud access on a non-managed device (e.g. personal laptop) through authentication and security policies. ## CASB Use Cases and Benefits The types of CASB, or combination of types, your organization will need to implement depends on the use case. You may need a combination of CASB deployment methods to cover your specific needs. Below are some common CASB use cases and their benefits. ### Security for Bring Your Own Device (BYOD) As many organizations are introducing work from home or hybrid working models, bring your own device (BYOD) - the use of personal devices - is becoming a more common choice for employees and [third-party vendors](https://www.upguard.com/blog/what-is-third-party-risk), who also require some access to the cloud environment. Agentless CASBs allow security teams to manage authorization of unmanaged devices, through the use of a [reverse proxy](https://www.upguard.com/blog/what-is-a-reverse-proxy). When a user attempts to log in to a cloud service, the reverse proxy can either allow or deny the request and redirect the user accordingly with the permitted level of access. The use of a reverse proxy also eliminates privacy concerns, as the user does not need to install any additional certificates or other software directly onto their device. ### Preventing Cloud Leaks Implementing a cloud environment significantly increases an organization’s [attack surface](https://www.upguard.com/blog/attack-surface) by adding the risk of cloud leaks. Security teams must effectively manage the potential for [attack vector](https://www.upguard.com/blog/attack-vector) exploits like [malware](https://www.upguard.com/blog/malware), which could facilitate a [data breach](https://www.upguard.com/blog/data-breach). CASBs provide cloud security through several settings, for example, they can limit users’ access rights to [sensitive data](https://www.upguard.com/blog/sensitive-data) and corporate data and even restrict download rights for certain users/devices. CASBs can also examine data exchanges between a device and the cloud to check for [different types of malware intrusions](https://www.upguard.com/blog/types-of-malware). ### Providing Data Security Data security is a core pillar of a CASB’s functions and can identify sensitive data and apply appropriate data manipulation techniques when needed. Organizations can still perform analytics on this data. CASBs also provide [continuous security monitoring](https://www.upguard.com/blog/continuous-security-monitoring), allowing organizations to gain real-time insights into the security posture of any of their cloud service providers. ### Enabling Data Encryption Organizations can use API-based CASBs to enable data encryption. APT integrations allow organizations to use their own encryption algorithms instead of the cloud service provider’s methods. The use of independent encryption can help prevent [third-party data breaches](https://www.upguard.com/blog/prevent-third-party-data-breaches) as the service provider cannot access or view the information the data it is storing in the cloud. ### Monitoring and Managing Regulatory Compliance Organizations in all industries should ensure regulatory compliance monitoring is a priority in their [cybersecurity programs](https://www.upguard.com/blog/cyber-security). Keeping up-to-date with the latest regulatory requirements and managing compliance can be difficult in a rapidly changing threat landscape, [especially in financial services](https://www.upguard.com/blog/cybersecurity-regulations-financial-industry). As another core pillar of their functions, CASBs help organizations monitor and manage compliance through guided templates for compliance with global regulations and frameworks, alongside their data logging functionality. The data manipulation techniques that CASBs offer also allow organizations to remain compliant with privacy regulations, like GDPR and CCPA. ### Providing Access Control CASB solutions provide [access control](https://www.upguard.com/blog/access-control) to manage how users access and edit data by assigning specific permissions depending on their role in the organization’s requirements. ### Preventing Unauthorized Access [In 2020, 90% of companies were operating through a multi-cloud strategy.](https://techjury.net/blog/how-many-companies-use-cloud-computing/) The larger the cloud environment, the greater the risk of unauthorized access occurring through compromised accounts. CASBs use UEBA to ensure that users’ cloud behavior aligns with previously recorded usage logs. They alert security teams of any abnormal behavior and can provide additional data protection in such scenarios by enforcing extra authentication requirements, restricting or limiting data access, or entirely denying user access. ## The Future of CASBs The steady rise of organizations turning away from data centers and towards cloud computing solutions like AWS and Azure has increased the demand for cloud access brokers following their market introduction. Gartner’s introduction of the concept [Secure Access Service Edge (SASE)](https://www.upguard.com/blog/sase) in 2019 has further increased their demand, as security teams begin to implement SASE into their organizations. SASE involves the consolidation of network and security functions into a cloud-based service. The SASE security model outlines CASBs as one of five core security components, working alongside other vital network and security functions, including: * Software-defined Wide Area Network (SD-WAN) * Firewall-as a-service (FWaaS) * Secure Web Gateway (SWG) * [Zero-trust Network Access (ZTNA)](https://www.upguard.com/blog/sase#:~:text=The-,zero-trust%20network%20access%20\(ZTNA\),-information%20security%20model) CASB vendors are continuing to refine and diversify their capabilities, with many reputable solutions now offering both API-based and proxy-based services. ## Top CASB Vendors The following vendors provide organizations with effective CASB solutions. ### 1. McAfee MVISION Cloud [McAfee MVISION Cloud](https://www.mcafee.com/enterprise/en-au/products/mvision-cloud.html) provides comprehensive visibility and control for SaaS, PaaS, and IaaS, across Content and DevOps environments. Features: * Cloud registry * Cloud activity monitory * AI-driven activity mapper * [Insider threat detection](https://www.upguard.com/blog/insider-threat) * Guided learning * Structured data encryption ### 2. Microsoft Cloud App Security [Microsoft Cloud App Security](https://docs.microsoft.com/en-us/cloud-app-security/) operates on multiple clouds and provides visibility, control over data travel, and analytics to identify and combat cyber threats across all cloud services. Features: * Endpoint detection and response * Unified endpoint management * Identity and access management (IAM) * [Data loss prevention (DLP)](https://www.upguard.com/blog/data-loss-prevention) * Security workflow automation * [SIEM](https://www.upguard.com/blog/siem) * [Cloud security posture management (CSPM)](https://www.upguard.com/blog/cspm) * [Incident response](https://www.upguard.com/blog/incident-response-plan) ### 3. Broadcom (Symantec) CloudSOC Cloud Access Security Broker [Symantec CloudSOC Cloud Access Security Broker](https://www.broadcom.com/products/cyber-security/information-protection/cloud-application-security-cloudsoc) offers cloud app security by providing visibility, data security, and threat protection across sanctioned and unsanctioned cloud apps and services on SaaS, PaaS, and IaaS platforms. Features: * DLP * UEBA * Encryption * Contextual data for security incident remediation * Cloud service discovery and usage ### 4. Netskope Security Cloud [Netskope Security Cloud](https://www.netskope.com/products/casb) offers visibility, real-time data, and threat protection across all devices accessing cloud services, websites, and private apps. Features: * Cloud app risk scoring * DLP * Granular visibility and control * Real-time enforcement * Flexible third-party integrations ### 5. Bitglass Cloud Access Security Broker [Bitglass Cloud Access Security Broker](https://www.bitglass.com/managed-cloud-apps) protects data end-to-end, across all cloud apps and devices by enforcing access controls, limiting sharing, protecting against malware, avoiding data leakage, and more. Features: * DLP * [Zero-day threat protection](https://www.upguard.com/blog/zero-day) * UEBA * Anti-malware engine * Real-time security ### 6. Cisco Cloudlock [Cisco Cloudlock](https://umbrella.cisco.com/products/cloud-access-security-broker-casb) is an API-based cloud access security broker (CASB) that helps accelerate cloud usage by securing identities, data, and apps to combat account compromises, breaches, and cloud app ecosystem risks. Features: * DLP * Firewall * Security risk scoring * App discovery and analytics * Automated data protection and remediation workflows Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) October 29, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)