CASB (Cloud Access Security Broker) is a security platform that sits between users and cloud services (SaaS, IaaS, PaaS) to enforce security policies, monitor usage, detect threats, and protect data. CASB extends corporate security controls into cloud applications that the organisation doesn't directly own — Microsoft 365, Salesforce, Google Workspace, Box, Slack, Workday, hundreds of others. CASB addresses the central security challenge of cloud-first organisations: thousands of users using thousands of cloud apps from anywhere, on any device. CASB is now typically part of broader SASE (Secure Access Service Edge) or SSE (Security Service Edge) platforms.

Gartner defines four CASB pillars: (1) **Visibility** — discover all cloud apps in use (sanctioned and Shadow IT), inventory users and data, generate risk scores, (2) **Compliance** — enforce regulatory requirements (GDPR, HIPAA, PCI-DSS, SOC 2) on cloud data, audit access, generate compliance reports, (3) **Data security** — DLP for cloud data (block sensitive uploads/shares), encryption, tokenisation, rights management, (4) **Threat protection** — detect compromised accounts, anomalous behaviour, malware in cloud storage, account takeover (ATO). Modern CASBs add zero-trust controls, identity-aware access, and integration with SOC platforms.

Five market leaders: (1) **Netskope** — long-standing CASB leader, broadest cloud app catalogue, integrated SASE platform, (2) **Microsoft Defender for Cloud Apps** (formerly MCAS) — best fit for M365 estates, included with E5/security add-on, (3) **Zscaler** — strong inline CASB integrated with ZIA proxy, part of comprehensive SASE, (4) **Forcepoint** — strong DLP heritage, part of SSE platform, (5) **Palo Alto Networks SaaS Security** (acquired Bridgecrew) — integrated with Prisma Access. Other notable: Cisco Cloudlock, Skyhigh Security (formerly McAfee), Lookout. Modern trend: standalone CASB declining; most enterprises buy SASE/SSE bundles that include CASB along with SWG, ZTNA, FWaaS.

Three deployment modes: (1) **API-based (out-of-band)** — CASB connects to SaaS app APIs (Microsoft Graph, Google Workspace, Salesforce, Box) to monitor, audit, and apply controls retrospectively; near-real-time, (2) **Forward proxy (inline)** — CASB sits between user and cloud app; users connect through CASB which inspects traffic in real time; requires endpoint agent or PAC file, (3) **Reverse proxy (inline)** — CASB acts as the cloud app's front door; cloud app traffic redirected through CASB; works without endpoint agent for browser-based access. API mode is easiest to deploy (no traffic redirection); inline modes give real-time blocking. Most enterprises deploy a hybrid — inline for high-risk actions, API for visibility and policy.

Three related cloud security categories: (1) **CASB (Cloud Access Security Broker)** — focused on SaaS application visibility, control, and data protection, (2) **SWG (Secure Web Gateway)** — modern proxy filtering web traffic; URL filtering, malware scanning, content inspection, (3) **SASE (Secure Access Service Edge)** — converged platform combining SWG + CASB + ZTNA + FWaaS + SD-WAN as cloud-delivered service. Most modern enterprises buy SASE bundles rather than standalone CASB. **SSE (Security Service Edge)** is the security-only subset of SASE (without SD-WAN) and is what most organisations actually buy first. Top SASE/SSE platforms: Zscaler, Palo Alto Prisma Access, Netskope, Cloudflare One, Cisco Umbrella, Microsoft Entra Internet Access.

Shadow IT (employees using unsanctioned cloud apps) creates security and compliance risks. CASB Shadow IT discovery: (1) **Network analysis** — analyses firewall, proxy, or SD-WAN logs to identify cloud app traffic, (2) **DNS analysis** — log integration shows which cloud apps users access, (3) **App risk scoring** — every discovered app gets a risk score based on security posture, compliance certifications, terms of service, (4) **User risk reporting** — which users use which risky apps, (5) **Sanction workflow** — security team approves, blocks, or replaces with approved alternatives. Typical findings: organisations expecting 50-100 cloud apps actually use 500-2000+. CASB visibility is often the first step in cloud security maturity.

CASB is a critical component of Zero Trust for cloud applications: (1) **Continuous verification** — CASB checks user, device, location, and risk for every cloud action, not just login, (2) **Least-privilege access** — CASB applies fine-grained controls (read-only, no download, no external sharing) per user and context, (3) **Device posture awareness** — CASB blocks actions from non-compliant devices (jailbroken, missing EDR, no encryption), (4) **Data-centric security** — CASB DLP and encryption follow data into the cloud and across SaaS, (5) **Anomaly detection** — CASB User and Entity Behavior Analytics (UEBA) detects compromised accounts. Zero Trust roadmaps typically include CASB in the first 12 months alongside ZTNA, MFA, and IdP.