A cloud access security broker (CASB) is a control point between an organization's users and its cloud services. It discovers which cloud apps are in use, enforces security and data policies on them, watches for account misuse and flags risky configuration. You need one when staff use many cloud services you do not directly manage.
What does NIST say a CASB is?
NIST SP 800-215 describes a CASB as software that sits on the network between cloud service customers and cloud service providers, and traces its evolution in two stages.
The first generation focused on discovery of resources. It gave visibility into all the cloud resources that the enterprise's users accessed, which minimizes shadow IT, meaning use of cloud applications not authorized by IT management, such as unapproved file sharing or collaboration software. It also produced some usage statistics.
The current generation enforces security and governance policies for cloud applications, extending on premises policies to the cloud. NIST lists its services as protecting enterprise data held at cloud providers, including data inflow and outflow, which is the data loss prevention role; tracking threats such as account hijacking, including detecting anomalies in users' cloud access behavior through user and entity behavior analytics; and detecting misconfigurations in subscribed infrastructure and cloud services, directing the enterprise to guidelines such as the Center for Internet Security benchmarks for public cloud services.
How does it work in practice?
Deployments differ, and the details depend on the product. In general, a CASB can see traffic by sitting in the path, for instance as a proxy, or by connecting to cloud providers through their APIs to read activity and settings. The path approach covers apps you have not connected, and the API approach sees data and configuration inside apps you have. Check which methods a product supports and what each covers.
What problems does it solve?
- Unknown cloud usage. A report of every cloud app staff use, and how much.
- Uncontrolled sharing. Rules about who can share which data outside the company.
- Account takeover. Alerts on unusual sign-ins or mass downloads in cloud apps.
- Configuration drift. Warnings when a sharing or access setting becomes too open.
What does it not solve?
A CASB does not secure the code you write. A flawed application you deploy to the cloud is still flawed. It does not replace identity controls such as MFA, and it does not replace endpoint security. It sees what flows through or is connected to it. Unmanaged devices and apps that bypass the path can fall outside its view. NIST also positions it among other network security components, such as secure web gateways, firewalls and zero trust network access, so it is one layer in a design rather than the design itself.
A constructed example
A 300 person company finds, from an outside report, that sensitive spreadsheets were shared through a personal file sharing account. A CASB discovery report shows 140 cloud apps in use, of which IT knew about 25. The team sanctions 10, blocks 30 that carry clear risk, and adds a rule that files marked confidential cannot be shared by public link. Two months later an alert shows a sales account downloading a full customer list at night, and the account is suspended and reset.
How do you decide?
Ask three questions. How much of your work now happens in cloud apps you do not run? Do you have data handling obligations that require control over sharing and location? Do you already have a web gateway, identity provider and logging that cover part of this? If the answer to the first two is yes and the third is no, a CASB is worth evaluating. If you mostly run your own cloud workloads, configuration posture and identity controls may need attention first.
How to check or apply this
- List the cloud services you know are in use and who owns each.
- Check proxy, DNS and identity logs for services nobody listed.
- Define which data may be shared outside the company and how.
- Decide whether you need path based coverage, API based coverage or both.
- Pilot with one department and measure alerts and false positives.
- Connect alerts to a person who can act.
- Review sanctioned apps every quarter.
Quick check
Is a CASB the same as a secure web gateway?
No. A gateway filters users' web traffic. A CASB focuses on cloud app usage, data policy and account behavior in those apps. Products sometimes combine them.
Does a CASB find shadow IT?
Discovery of unsanctioned cloud apps was the original CASB function, per NIST, but coverage depends on what traffic or logs the product can see.
Sources
Last reviewed: 18 October 2026.
