What Is a CASB? The 2026 Definition, and Why the Old One Stopped Protecting You

A cloud access security broker (CASB) is the control point that sits between your people and the cloud apps they use, so you can see which SaaS and AI tools are in play, spot risky or publicly shared data, and enforce who gets in. The modern answer is not a standalone box. dope.security delivers CASB as two connected layers: CASB Neural for AI-powered visibility into data at rest, and on-device Cloud Application Control to keep people in your corporate tenants and out of personal ones. If you are learning the category from scratch, start with our secure web gateway and SSE buyer's guide.

What is a CASB?

A CASB is a security control that governs how your organization uses cloud applications. It answers three questions your firewall never could: which cloud apps are people actually using, what sensitive data is sitting in them, and who is allowed to sign in. The term was coined by Gartner around 2012, back when "the cloud" mostly meant a handful of sanctioned SaaS apps and the job was to bolt some visibility onto them.

The category has aged. The problem has not. If anything it got bigger. The average mid-market company now runs hundreds of SaaS apps, most of them signed up for without IT ever knowing, and a fast-growing pile of AI tools on top. A CASB is how you get that sprawl back under control. The question in 2026 is not whether you need CASB capabilities. You do. The question is what shape they should take, and that is where the old definition falls apart.

Our thesis is simple: a CASB you buy as a separate appliance or a separate cloud in 2026 is solving a 2014 problem. The modern version is cloud data visibility plus tenant control, delivered from the same agent that already inspects your traffic. More on that below, but first the fundamentals.

The four things every CASB is supposed to do

Analysts usually break CASB into four pillars, and they are still a useful map.

Visibility. Discover every cloud app in use, sanctioned or not. This is your Shadow IT (and now Shadow AI) picture. You cannot govern what you cannot see.

Data security. Find and protect sensitive data in cloud apps. That means catching a customer list sitting in a publicly shared Google Drive link, or PII in a file anyone with the URL can open. This is where CASB overlaps with data loss prevention.

Compliance. Prove that your cloud usage lines up with HIPAA, PCI, SOC 2, GDPR, and the rest. Auditors want to know where regulated data lives and who can reach it.

Threat protection. Spot compromised accounts, risky OAuth grants, and malware moving through cloud apps.

A tool that does all four well is worth having. The trouble is that most legacy CASBs were built to do them from the outside, as a separate product, and that architecture is exactly what makes them slow to deploy and blind to the newest risks.

CASB vs SWG vs DLP vs SSE: where does a CASB fit?

Here is the question most first-time buyers actually have: these acronyms overlap, so which one do I need? The honest answer is that they solve different slices of the same problem, and in a modern platform they stop being separate products at all.

CASB is one capability inside the broader SSE category. You rarely buy it alone anymore. For the full category map, see the SSE vs SASE buyer's guide.

API-based vs inline: the two ways a CASB works

Every CASB operates in one of two modes, and the difference matters more than the marketing lets on.

API-based (out-of-band). The CASB connects to your SaaS tenant through its API, for example Microsoft 365 or Google Workspace, and scans data that already lives there. It is great for finding a spreadsheet full of PII that someone shared with a public link last Tuesday. It does not sit in the traffic path, so it cannot stop something in real time, but it also cannot slow anything down.

Inline (proxy). The CASB sits in the traffic path and makes decisions as requests happen: block this upload, allow this login, coach this user. Real-time control is powerful. The catch is that legacy inline CASBs achieve it by routing your traffic through their data center first, which adds latency and one more thing to break.

You want both modes. The old market made you buy them as two products, often from two vendors, stitched together. That is the seam where deployments stall.

Why the old CASB definition stopped protecting you

Two things broke the classic CASB. The first is AI. The second is personal accounts on corporate-looking domains.

Start with AI. Employees now paste source code, customer data, and strategy docs into ChatGPT, Claude, Gemini, and Copilot. A CASB that only scans sanctioned SaaS tenants for files at rest sees none of that. It cannot read what someone typed into a prompt, and it usually cannot tell corporate ChatGPT from personal ChatGPT because both live on the same domain. Governing AI is now table stakes, and it is a big enough topic to have its own hub: our AI visibility and governance guide and our write-up on finding and governing Shadow AI both go deep.

Now the tenant problem. The single hardest control to get right is: allow the corporate Google or Microsoft or ChatGPT account, block the personal one, on the same domain. That decision cannot be made at the DNS layer, because DNS never sees the account. It cannot be made by a browser extension, because people switch browsers. It needs an HTTP header inspected inside decrypted TLS, which means a real proxy has to be in the path. Most legacy stacks can do it only if you buy the proxy, plus a data-protection add-on, plus a higher tier. That is a lot of SKUs for one policy.

The modern CASB: cloud visibility plus on-device tenant control

Here is the shape that actually fits 2026. Split the job into two layers and run both from the agent you already have on the device.

The first layer is cloud data visibility. CASB Neural connects by API to your Google and Microsoft 365 tenants and uses an LLM to categorize sensitive, publicly exposed files, so you find the shared-link PII and the externally exposed IP with one click, then remediate. That is the out-of-band pillar, done without a heavy appliance.

The second layer is tenant control, enforced on the device. Because dope.security runs a lightweight agent that already performs SSL inspection locally, it can read the tenant header inside decrypted TLS and make the corporate-vs-personal decision in real time, with no backhaul to a data center. Block the personal ChatGPT login, allow the enterprise one, on the same domain, from the endpoint. Pair that with Dopamine DLP catching sensitive data in uploads and prompts, and the four CASB pillars are covered without four separate products.

This is not theory. Greylock Partners, the Silicon Valley VC firm behind LinkedIn, Discord, and Figma, is a distributed, device-first team with a lean IT function. They moved off a DNS-based stack to dope.security and went from first proposal to signed contract in 27 days, precisely because the modern architecture did not require a data-center detour to enforce cloud policy. Read the Greylock story for the details.

How to choose a CASB in 2026

Skip the standalone-box mindset. Ask three questions instead. Does it see your AI usage, not just your sanctioned SaaS? Can it enforce corporate-vs-personal tenant control without shipping every packet to a data center first? And does it live in the same console as your SWG and DLP, or are you about to stitch three products together and own the seams forever?

If the honest answers point you toward a unified, agent-based platform, that is the point. A CASB should not be one more box to route traffic through. It should be a set of controls that ride along with the inspection you already do on the device. Cloud visibility for data at rest, tenant control for data in motion, one console, no backhaul. That is what a cloud access security broker looks like when you rebuild it for the way people actually work, and it is the reason the standalone CASB you were about to shortlist is already a generation behind. If you are still mapping the category, the SWG and SSE buyer's guide and the DLP buyer's guide are the two hubs worth reading next.

Want to see the modern version in action? Explore CASB Neural or book a 20-minute demo.