Cloud Security · Core

CASB

Governs SaaS usage and cloud data.

7 options listedTypical cost: $36-$120/user/yrPROTECT (PR)

Overview

Cloud Access Security Brokers give visibility and control over sanctioned and shadow SaaS, enforcing DLP, access, and threat policies. They sit inline or via API to cloud apps. Now typically delivered within SSE/SASE suites. Licensed per user with feature tiers.

Governs SaaS sprawl once cloud apps proliferate.

Advantages

Netskope deep inline controls
Defender for Cloud Apps bundled with Microsoft
controls shadow SaaS and adds DLP.

Trade-offs

API vs inline trade-offs
best value inside an SSE suite (lock-in)
SaaS coverage breadth varies
per-user cost.

Open-source option

Inline/API CASB depends on a large global proxy fabric, vendor SaaS API integrations and managed threat/DLP intelligence, none of which has a credible self-hostable open-source equivalent.