A cloud access security broker (CASB) is security software that watches and controls what a company's staff do inside cloud applications, such as uploading, sharing and downloading files. A cloud application is software that a company rents over the internet, such as email, file storage or a CRM. Today a CASB is usually a part of SASE.
A CASB does three jobs. First, it finds every cloud application that staff use. Many of these were never approved by the IT team. Applications used without approval are called shadow IT. A company that thinks it uses 40 cloud applications often finds that its staff use more than 300. Second, it controls actions inside the applications. For example, it can allow staff to use the company's own file storage, but block uploads to a personal account in the same service. Third, it checks the files that are already stored in the approved applications.
A CASB works in two ways. Inline, it sits in the path of the traffic, inside the security cloud, and checks each action as it happens. Through an API, it connects directly to an approved cloud application. An API is a set of requests that one program can send to another. Through it, the CASB reads which files are stored in the application, and with whom each file is shared.
Say an employee in the recruitment team at a staffing firm in Gurugram is leaving to join a competitor. On her last Friday, she tries to upload a spreadsheet of 4,800 candidates' CVs and phone numbers to her personal cloud storage account. The CASB sees that the upload is going to a personal account, not to the company's account. It checks the file against data loss prevention (DLP) rules and finds thousands of phone numbers. It blocks the upload and alerts the security team. Through the API, it also finds a folder in the company's own storage that she had shared with "anyone with the link". It removes that link.
This is the customer's job, not the cloud company's. Under the shared responsibility model, the company that makes the application keeps the application running and secure. The customer is responsible for what its own staff upload and share.
A CASB is not the same as SaaS security posture management (SSPM). SSPM checks the settings of each application. The CASB watches the actions of the users. It knows who each user is through single sign-on (SSO). The newest cloud applications that staff use are AI tools. Controlling them is called shadow AI control.