What is the difference between an SWG and a CASB?

A secure web gateway (SWG) is a web filter that protects outbound user traffic by inspecting HTTP and HTTPS and blocking dangerous sites. A cloud access security broker (CASB) sits between users and cloud services to find which services are used and enforce policy on them. One guards the open web, the other governs cloud applications.

What does NIST say about each?

NIST SP 800-215, a guide to securing the modern enterprise network, describes both as pieces of the modern enterprise network.

On SWGs, it says they are appliances used for policy-based access to and control of cloud-based applications, and for governance of access to the open web for users wherever they are: headquarters, branches, home and remote locations. An SWG is fundamentally a web filter that protects outbound user traffic through HTTP or HTTPS inspection. It also protects endpoints from web threats such as links to malicious or infected sites, and centralizes control, visibility and reporting. The document adds that they are not a replacement for web application firewalls.

On CASBs, it describes software that sits on the network between cloud service customers and cloud service providers. It traces two generations. The first generation focused on discovery: visibility into the cloud resources users access, which limits shadow IT. The current generation enforces security and governance policies for cloud applications, extending on-premises policy to the cloud. Its listed services include protecting enterprise data held with cloud providers and data moving in and out (including data loss prevention functions), tracking threats such as account hijacking and insider activity, and detecting misconfigurations in subscribed infrastructure services.

How do they differ in a day to day example?

A constructed example: an employee does two things on one afternoon.

1. Clicks a link in an email that goes to a lookalike login page.
2. Uploads a customer spreadsheet to a personal file sharing account.

The SWG sees the first: the domain is newly registered and classified as phishing, so the request is blocked and logged. The CASB handles the second: it recognizes the destination as an unapproved cloud storage service, or an approved one used with a personal tenant, and can block the upload or alert.

They answer different questions. The SWG asks "should this user reach this site?" The CASB asks "which cloud services are in use, who can do what in them, and is data going where it should?"

Where do they overlap?

Both inspect traffic, both enforce policy by user and application, and both can deliver from the cloud. Many products combine them. NIST SP 800-215 lists secure web gateway services, CASB services and browser isolation among the security services in an integrated SASE-style architecture, and notes that a router in an SD-WAN may include firewall and SWG functions.

So the question is rarely "which one?" It is "which of these functions do we need, and in which product?"

How should you decide?

• If your main exposure is users browsing the open web and downloading malware, start with web filtering.
• If your main exposure is unmanaged SaaS and data leaving through cloud services, start with CASB-type discovery and control.
• If staff work from home and branches, ask where the enforcement runs. A gateway only in the data center misses them.
• If you rely on a few approved SaaS apps, check what their built-in sharing and admin controls already offer before adding more.

Neither tool sees what it does not inspect. Encrypted traffic, unmanaged devices and applications reached through API connections need explicit design.

How to check or apply this

1. List the SaaS apps in use, approved or not, from logs or a short staff survey.
2. Decide which data may go to which cloud service, in a simple table.
3. Check where web filtering is enforced for remote users and branch offices.
4. Pilot discovery first and review results before enabling blocking.
5. Plan how encrypted traffic is inspected, and which categories you will not inspect, such as health or banking sites.
6. Review block and alert logs monthly, and tune.

Quick check

Sources

• NIST SP 800-215, Guide to a Secure Enterprise Network Landscape

Last reviewed: 18 October 2026.