About cloud access security brokers

Safely enabling cloud services for people and enterprises

What is a cloud access security broker (CASB)?

By 2020, 60 percent of large enterprises will use a cloud access security broker.*

According to Gartner, a cloud access security broker (CASB) is an on-premises or cloud-based security policy enforcement point that is placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as cloud-based resources are accessed. Organizations are increasingly turning to CASB vendors to address cloud service risks, enforce security policies, and comply with regulations, even when cloud services are beyond their perimeter and out of their direct control. If you intend to use CASB to increase your confidence about your organization’s cloud service usage, consider taking a granular approach to policy enforcement and data protection. In other words, consider using a scalpel rather than a sledgehammer for your cloud security.

On November 1, 2018, Gartner released their 2018 CASB Magic Quadrant. Download a copy here.

*Gartner, “Magic Quadrant for Cloud Access Security Brokers,” Craig Lawson and Steve Riley, October 29, 2018.

The four pillars of CASBs


Companies need visibility and control across both sanctioned and unsanctioned services. Rather than take an “allow” or “block” stance on cloud services, cloud brokerage should enable IT to say “yes” to useful services while governing access to and activities and data within services. This could mean offering full access to a sanctioned suite like Microsoft Office 365 to users on corporate devices, but web-only email to users on unmanaged devices. It could also mean enforcing a “no sharing outside of the company” policy across a category of unsanctioned services. While cloud security is the key focus of a cloud access security broker, the other value is helping you get your arms around cloud spend. A CASB can help you discover all cloud services, report on what your cloud spend is, and find redundancies in functionality and license costs.


As organizations move more of their data and systems to the cloud, they must ensure they comply with the many regulations designed to ensure the safety and privacy of personal or corporate data. Cloud access security brokers can help ensure compliance in the cloud whether you are a healthcare organization worried about HIPAA or HITECH compliance, a retail company concerned with PCI compliance, or a financial services organization needing to comply with FFIEC and FINRA.

Data security

Accuracy comes from using highly sophisticated cloud DLP detection mechanisms like document fingerprinting, combined with reducing detection surface area using context (user, location, activity, etc.). When sensitive content is discovered in or en route to the cloud, the cloud access security broker (CASB) should allow IT the option of shuttling suspected violations efficiently to their on-premises systems for further analysis.

Threat protection

Organizations need to ensure their employees aren’t introducing or propagating cloud malware and threats through vectors such as cloud storage services and their associated sync clients and services. This means being able to scan and remediate threats in real time when an employee tries to share or upload an infected file or detecting and preventing unauthorized user access to cloud services and data.

Protect yourself against a host of cloud threats including malware and insider threats with cloud malware and threat capabilities that combine threat intelligence, static and dynamic malware analysis, prioritized analysis, and remediation of threats that may originate from—or be further propagated by—cloud services.

Top CASB use case categories

Govern usage

Govern your organization’s cloud usage with granular visibility and control. Rather than take a coarse-grained approach by blocking services, govern usage based on identity, service, activity, and data. Define policies based on service category or risk and choose from actions such as block, alert, bypass, encrypt, quarantine, and coach for policy enforcement.

Secure data

Protect and prevent the loss of sensitive data across all of the cloud services in your environment, not just the ones you sanction. Take advantage of advanced, enterprise DLP to discover and protect sensitive data in sanctioned cloud services and en route to or from any cloud service, sanctioned or unsanctioned, whether users are on premises, remote, on a mobile device, or accessing from a web browser, mobile app, or sync client.

Protect against threats

Guard against cloud-based threats such as malware and ransomware. Start with full visibility of all cloud services, even those using SSL-encrypted connections, and use anomaly detection, and threat intelligence sources such as which of your users has compromised accounts. Then layer in static and dynamic anti-malware detections, plus machine learning to detect ransomware. Finally, arm the rest of your security infrastructure with your findings through out-of-the-box integrations and workflows.

The CASB checklist

Your organization is evaluating cloud access security brokers to safely enable sanctioned and unsanctioned cloud services. This checklist gives you specific, use case-based examples that will help you differentiate between the CASB vendors you may be evaluating.

Leader in Gartner CASB Magic Quadrant – blog

Gartner recently released its first-ever Magic Quadrant for CASB solutions. Netskope was placed in the leaders quadrant and is positioned furthest for completeness of vision.

Learn more

CASB RFP - Template

Ready to start evaluating CASB vendors? Download our CASB RFP template, which includes questions about all of the functions cloud access security brokers provide.

Learn more

IDC MarketScape Worldwide Cloud Security Gateways Vendor Assessment

Netskope was named a leader in the IDC MarketScape Worldwide Cloud Security Gateways (CSG) Vendor Assessment.

Learn more

Gartner CASB Magic Quadrant now available

Read the full report