CASB (Cloud Access Security Broker)

A CASB inspects traffic to sanctioned and unsanctioned SaaS apps (Microsoft 365, Salesforce, Box, ChatGPT, etc.) and applies controls across four pillars: visibility (shadow-IT discovery), compliance, data security (DLP, encryption, tokenization), and threat protection (UEBA, malware scanning). It is typically deployed as an API connector that reads cloud activity logs, a forward proxy on the network, or a reverse proxy integrated with SSO. CASB allows security teams to apply consistent controls across hundreds of SaaS apps that the enterprise does not directly operate. Modern offerings are usually delivered as part of an SSE/SASE platform together with SWG, ZTNA, and FWaaS.