What is CASB?

CASBs organize their function around four pillars. Visibility comes first, since most organizations underestimate how many cloud applications employees actually use; a CASB discovers this shadow IT by analyzing firewall and proxy logs for traffic to known SaaS domains, building an inventory of sanctioned and unsanctioned applications in use, often numbering in the hundreds once every marketing tool, file-sharing service, and personal cloud storage account employees have signed up for is counted. Compliance enforcement applies data residency and regulatory policy, blocking or flagging actions that would move regulated data, health records, payment data, personal information, into a cloud service or region that violates HIPAA, PCI-DSS, or GDPR requirements. Data security applies DLP-style content inspection to data moving to and from cloud services, scanning uploads for sensitive patterns like credit card numbers or source code and blocking or encrypting matches before they leave the organization's control. Threat protection watches for anomalous behavior within cloud accounts themselves, an impossible-travel login, a sudden mass download from a file-sharing service, or malware uploaded to a shared drive that could propagate to every collaborator who opens it.

CASBs deploy through three architectural modes, each with different tradeoffs. Forward proxy mode sits inline on outbound traffic, inspecting and enforcing policy in real time, but requires routing traffic through the proxy via an agent or PAC file, which adds deployment overhead and can miss traffic from unmanaged devices. Reverse proxy mode redirects users through the CASB during SSO authentication, requiring no endpoint agent and covering unmanaged and BYOD devices, but only covers applications configured for SSO. API-based mode connects directly to a sanctioned SaaS application's management API, Microsoft 365, Google Workspace, Salesforce, Box, and scans data at rest and configuration settings after the fact rather than intercepting traffic in real time, which misses the moment of upload but gives deep visibility into files, sharing permissions, and account activity that proxy modes can't reach. Most enterprise CASB deployments combine API-based mode for sanctioned, high-value SaaS applications with proxy modes for broader traffic visibility across unsanctioned services.