Zscaler CASB: Inline vs API, and What It Actually Covers

Quick answer: Yes, Zscaler is a CASB. Zscaler sells what it calls a multimode CASB: inline controls that ride on its cloud proxy for data in motion, plus out-of-band API scanning for data already sitting in SaaS and IaaS. The two modes see very different things. Inline sees what users do through the proxy. API sees what's already stored and shared in the tenant. Knowing which one answers your question is most of the buying decision.

CASB is one of those acronyms that means three different products depending on who's selling. So let's be specific about what a Zscaler CASB does, what each mode catches, and where an on-device approach changes the math.

Last updated: November 2026

What a CASB does, in one paragraph

A cloud access security broker sits between your people and your cloud apps. It answers four questions: which cloud apps are in use (shadow IT), who can access which tenant, what data is moving into those apps, and what data is already exposed inside them. Some CASBs answer those questions in the traffic path. Others answer them by connecting to the app's API after the fact. Zscaler does both, under one name.

How Zscaler CASB works: inline vs out-of-band

Zscaler's inline mode is part of its cloud proxy. Its out-of-band mode is an API connection to your SaaS tenants. Zscaler's own product blog puts it this way: real-time proxies provide inline scanning of data in motion, while API integrations offer out-of-band scanning for data at rest.

Per Zscaler's CASB product page:

• Inline uses Zscaler's proxy architecture and TLS/SSL inspection to discover shadow IT, block sensitive uploads with DLP, and stop malware on the way in. Traffic has to reach the Zscaler cloud for this to work.
• Out-of-band scans SaaS apps and cloud platforms through API integrations to find sensitive data at rest, crawl for risky file shares and revoke them, and scan stored files for malware.
• Zscaler lists Microsoft 365 and Salesforce as SaaS examples and Amazon S3 as an IaaS example, plus tenancy restrictions, SSPM, and UEBA on the same page.

If you want the deeper story on Zscaler's data inspection engine, we cover it in Zscaler DLP in 2026. For the platform as a whole, start with what is Zscaler.

What each CASB mode actually sees

Inline and API CASB answer different questions, and neither one answers all of them. Here's the split.

The takeaway: you want both. Inline stops the upload before it happens. API cleans up the mess that's already there.

Where the cloud-proxy model makes CASB harder

Zscaler's inline CASB is only as good as the traffic that reaches the Zscaler cloud. That's an architecture fact, not a knock on the features. Anything that bypasses the proxy, whether it's an SSL inspection exception, a cert-pinned desktop app, or a user off the forwarding path, is invisible to the inline half of the CASB.

It also means every inline check adds a network detour. Your users' SaaS sessions travel to a Zscaler data center to be inspected and then on to the app. We break down that cost in Zscaler vs dope.security.

How dope.security handles the CASB job

dope.security splits CASB into the two places it naturally belongs: the device for data in motion, and the tenant for data at rest.

On the device, the dope.SWG agent does the inline work locally, with no stopover in a vendor data center:

• Cloud Application Control restricts apps like Google, Microsoft 365, ChatGPT, and Claude to your corporate tenant and blocks personal accounts and personal email.
• Shadow IT and AI discovery shows which apps people use and whether the account is personal or corporate.
• Dopamine DLP reads uploads and AI prompts, classifies them with an LLM instead of regex, and can block sensitive files before they leave.

In the tenant, CASB Neural handles data at rest:

• One-click activation across Google Workspace and Microsoft 365. No connectors, no rules to write.
• Finds every externally or publicly shared Drive and OneDrive file and keeps monitoring for sharing changes.
• Uses large language models to identify PII, PCI, PHI, and IP, with a plain-language Dopamine Summary of why a file is sensitive.
• One-click remediation to make a file private again.

And for third-party app risk, AI-Powered SSPM inventories every app authorized on your Microsoft 365 or Google tenant, scores its risk, and recommends exactly which permission to revoke.

All of it lives in one console, dope.console, next to your web policy.

Zscaler CASB vs dope.security at a glance

Honest scope note: Zscaler's out-of-band CASB covers a broader app and IaaS catalog. CASB Neural focuses on Google Workspace and Microsoft 365, which is where most teams' shared files actually live.

Book a 20-minute demo to see CASB Neural scan your own tenant.

Frequently asked questions

Is Zscaler a CASB?

Yes. Zscaler offers a multimode CASB that combines inline controls in its cloud proxy with out-of-band API scanning of SaaS and IaaS data at rest.

What is the difference between inline and API CASB?

Inline CASB sits in the traffic path and can block risky uploads and personal-tenant logins in real time. API CASB connects to the app and finds data that's already stored or shared, then remediates it.

Does Zscaler CASB work if traffic bypasses the proxy?

The inline half doesn't. Traffic on SSL inspection bypass lists, or traffic that never reaches the Zscaler cloud, isn't inspected inline. API scanning still covers data at rest in connected tenants.

Does dope.security have a CASB?

Yes. Inline controls run on the device in dope.SWG through Cloud Application Control and Dopamine DLP, and CASB Neural covers data at rest in Google Workspace and Microsoft 365.

Related reading

• What Is Zscaler? How It Works and Where the Cloud Proxy Model Breaks
• Zscaler DLP in 2026
• Is Zscaler SASE or SSE?
• AI-Powered SSPM: CASB Neural Gets an Upgrade