Technical Review by
Craig MacAlpine
We’ve evaluated the best cloud access security brokers to help organizations gain visibility, enforce data policies, and protect against threats across cloud applications.
Businesses are increasingly relying on cloud applications for critical day-to-day activities, in communication, accounting, marketing, file management and more. Many businesses carry out almost all of their business processes on cloud-hosted applications.
Powerful cloud-based tools like Microsoft 365, Salesforce and HubSpot empower employees to be more productive and have more control over their work, while also allowing businesses to run more efficiently. The SaaS nature of cloud applications also makes billing easier, giving businesses more control over the applications that are working, and those that aren’t.
As more businesses take advantage of these cloud benefits, they’re also relying more on the security of these cloud systems to protect their personal data. Everything from employee details, to customer data, to financial statements are stored in third-party cloud-based systems.
To ensure that these systems are secured and that businesses have the control and visibility over their data that they need, businesses are using Cloud Access Security Brokers (CASBs). These services are designed to sit between cloud service users and cloud applications, monitoring activity and ensuring that security policies are properly enforced.
Key features of CASB solutions include enhancing visibility into cloud applications, ensuring companies meet compliance needs with data loss protection policies, enforcing data security policies with access controls and encryption, and providing a strong level of threat protection across cloud accounts.
In this article, we’ll cover the top Cloud Access Security Brokers on the market. We’ll compare the four key features outlined above, as well as other considerations such as ease of use and pricing, to help you find the service that’s right for your organization.
1. Cisco Cloudlock — Best for organizations already running Cisco Umbrella seeking API-based CASB
2. Forcepoint CASB — Best for enterprises needing unified DLP across cloud and on-premises environments
3. Lookout CASB — Best for multi-country enterprises needing DLP, encryption, and tokenization in one platform
4. Microsoft Defender for Cloud Apps — Best for M365 organizations wanting native CASB with zero additional setup
5. Netskope One CASB — Best for organizations wanting a unified console for cloud, web, and private app security
6. Palo Alto Networks Next-Gen CASB — Best for enterprises already running Palo Alto’s SASE stack
7. Proofpoint Cloud App Security Broker — Best for Proofpoint email security customers extending protection to cloud apps
8. Broadcom Symantec CloudSOC — Best for large enterprises with hybrid cloud and on-premises environments
9. Trend Micro Cloud App Security — Best for mid-sized organizations wanting fast deployment and email-focused cloud security
Cisco Cloudlock is a cloud-native CASB solution that protects users, data, and cloud applications. It’s fully API-based, providing a simplified way to secure access and manage security in cloud applications without requiring agents or inline inspection. Cloudlock is designed to integrate with Cisco’s broader security portfolio, and pairs particularly well with Cisco Umbrella, allowing organizations to combine cloud application security with web threat protection.
Cloudlock’s DLP policies operate at the content level, not just by file title or label, which matters when enforcing policies across ITAR or sensitive unclassified data types. The platform uses machine learning to detect behavioral anomalies and govern access management across cloud applications. Cloudlock’s Apps Firewall detects, controls, and protects cloud applications connected to the enterprise environment, assigning crowdsourced security scores and allowing IT teams to ban or allow apps as needed. OAuth app discovery surfaces hidden third-party access risks in Google Workspace environments. Pre-built industry policy templates accelerate compliance setup.
Users highlight data screening for remote workforces as a real strength. Controlling what gets shared externally is a consistent theme in positive feedback, with several customers reporting measurable reductions in unauthorized file sharing after deployment.
We think Cloudlock pairs best with organizations already invested in the Cisco security ecosystem. The OAuth app discovery and content-aware DLP are strong for Google Workspace environments, but keep in mind the platform is best realized when combined with Cisco Umbrella for broader web and cloud threat coverage.
Forcepoint CASB is a data-first cloud access security broker that gives IT teams enhanced visibility into cloud application usage, contextual risk assessment, and unified policy enforcement. The service allows IT teams to discover, assess, and protect applications in the cloud, combining shadow IT discovery, real-time monitoring, and DLP into a centralized platform with enterprise reporting and role-based controls.
Forcepoint’s core advantage is its unified DLP engine, which delivers consistent data protection policies across cloud and on-premises environments from a single console. Cloud app discovery uses log file analysis to automate categorization of cloud apps and produces aggregated discovery reports in the centralized dashboard. Contextual risk scoring adapts controls based on user identity, device, and activity patterns, and real-time activity monitoring covers privileged users with automatic anomaly detection. The platform integrates with 800,000+ cloud apps via API, reverse proxy, and forward proxy. Granular mobile and endpoint device policies enable access control and data protection beyond the perimeter.
Customers praise the unified console and Forcepoint’s support team for making implementation manageable. The single-pane approach to policy management across cloud and web gets consistent positive feedback, particularly from organizations that previously managed multiple separate tools.
We think Forcepoint CASB works best for mid-to-large enterprises with dedicated security teams who can invest in proper configuration. If your organization already runs Forcepoint DLP or needs a single platform for cloud and on-premises data governance, this is a strong fit.
Lookout CASB, formerly CipherCloud, is a cloud and hybrid-deployable CASB platform focused on end-to-end data protection, threat detection, and compliance. CipherCloud was acquired by Lookout in 2021. The platform provides continuous layers of security including deep visibility, adaptive access controls, data protection, risk compliance, and zero-day threat protection across cloud applications. Note that Lookout’s CASB was acquired by Fortra in May 2025, and customers should verify current product support commitments directly with the vendor.
Lookout bundles data loss prevention, encryption, and tokenization into a single platform, which matters when compliance teams need consistent data protection across multiple cloud applications. Adaptive access controls perform continuous risk assessment of users connecting to cloud applications, providing contextual access that ensures only the right users connect to the right applications. Real-time malware detection with sandboxing covers zero-day threats, and user and application auditing tracks behavioral anomalies. The platform enables management of cloud applications across multiple countries from a single dashboard with configurable controls.
Customers highlight timely vulnerability detection and real-time threat notifications as key strengths. The always-on monitoring and quick alerting on unusual behavior get positive marks. Support quality gets mixed feedback, with some customers reporting slower response times.
If your organization operates across multiple countries and needs centralized cloud data protection with strong encryption and tokenization, this platform fits well. We think it works best for enterprises with dedicated compliance requirements, though the Fortra acquisition in May 2025 creates some uncertainty about long-term product direction that buyers should factor into their evaluation.
Microsoft Defender for Cloud Apps, formerly Microsoft Cloud App Security, is Microsoft’s native CASB built to give M365 customers centralized visibility and control over cloud application usage. It integrates natively with Microsoft’s own cloud suite and is designed to provide visibility into threats and user behaviors, greater control over data, and analytics to combat cyberthreats across cloud applications. The service supports centralized management and automation of security processes, and pricing varies by program region and agreement type.
Cloud app discovery covers risk analytics across more than 31,000 applications and 90+ risk factors, giving security teams a real picture of what SaaS tools employees are using. The platform allows organizations to manage data loss with pre-built policies and controls to protect access to sensitive information. Microsoft’s automated engines detect unusual behavior across cloud applications to identify malicious activities, including signs of ransomware and malicious applications. Cloud Discovery maps and identifies applications in use across the cloud environment. The platform supports real-time session policies, app blocking, SaaS Security Posture Management, and app governance for risky OAuth permissions. Native integration spans M365, Microsoft Sentinel, and Defender XDR.
Customers praise the SaaS visibility and shadow IT detection. Identifying suspicious configurations and unauthorized app usage gets consistently positive feedback across large enterprises. Some users note that navigating the platform is fragmented, with settings spread across multiple admin areas.
We were impressed by the native integration depth. If you run Microsoft 365 and want a CASB that works without third-party overhead, Defender for Cloud Apps delivers the strongest value when paired with the rest of the Microsoft security stack. For organizations using a diverse range of non-Microsoft SaaS applications, the limited connector availability for third-party apps is worth evaluating against alternatives.
Netskope is a market-leading CASB that prevents data loss from both insider threats and external attackers by allowing admins to set granular security policies and gain visibility into cloud application risk. The platform secures cloud services such as Microsoft 365, Google Workspace, Box, and AWS, providing protection across these services against cloud threats and malware. Netskope deploys 100% in the cloud, with an on-premises appliance and hybrid options also available.
Netskope’s unified console manages cloud, web, and private app traffic from one platform. The platform uses over 40 threat intelligence feeds to power real-time malware detection and anomaly identification. Admins can target and control activities across thousands of cloud services and millions of websites with enhanced data protection policies and controls. Granular role-based DLP includes encryption and tokenization, with rule-based access controls enforceable across cloud applications. Native API integrations cover M365, Google Workspace, Box, and AWS.
Customers consistently praise the unified platform approach and support quality. The single-console visibility saves IT teams significant time and simplifies day-to-day operations across organizations with complex cloud environments. Some teams find the initial configuration and policy setup demanding.
We were impressed by the platform’s range. If you need a single platform covering CASB, web security, and private app access with strong DLP and compliance controls, Netskope belongs at the top of your evaluation list. The complexity of initial configuration is real but manageable for organizations with dedicated security resources.
Palo Alto’s Next-Gen CASB is an SASE-native solution that uses machine learning to automatically discover cloud applications, protect data, and remediate misconfigurations. We think it’s best suited for organizations running Palo Alto’s broader security stack. The ML-driven approach to app discovery is genuinely different from catalog-based methods, and the misconfiguration remediation workflows add a posture management layer that many standalone CASBs lack.
Palo Alto’s approach stands apart through ML-powered discovery that automatically identifies new cloud applications across all traffic types, rather than relying on static app catalogs. That matters when employees regularly adopt new SaaS tools outside the approved list. Misconfiguration remediation workflows address configuration drift in complex environments. Policy enforcement is consistent across hybrid cloud and on-premises, and deep visibility spans endpoints, networks, and applications from a single console.
Customers highlight the deep visibility, monitoring capabilities, and zero trust enforcement as real strengths. The zone-based architecture, policy optimization tools, and VM deployment flexibility get positive marks from security engineers managing complex multi-environment deployments.
We think Palo Alto’s Next-Gen CASB fits best when deployed alongside Palo Alto’s broader SASE and security stack. The ML-driven app discovery paired with misconfiguration remediation is strong for enterprises that have outgrown static catalog-based CASBs, but the steep setup curve and separate per-feature licensing make it a harder sell as a standalone purchase.
Proofpoint’s CASB platform protects cloud applications and users from malware threats, data loss, and compliance risks. It secures access and data within cloud apps like Microsoft 365, Google Workspace, Box, and more. Proofpoint is one of the world’s leading email security vendors, and the CASB platform is sold both as a standalone product and as an add-on for existing Proofpoint email security customers, integrating threat intelligence across email, web, and cloud.
Detection pulls from multiple sources covering email, web, and cloud-based threats, so threats identified in the email environment automatically inform cloud app protection. Proofpoint profiles 46,000+ applications for risk identifiers, helping organizations identify vendor credibility, vulnerabilities, and security gaps. O365 DLP surfaces publicly shared files with automated remediation. Sandboxing and browser isolation handle cloud-uploaded threats. Behavioral monitoring at the global, app, and user level gives IT teams visibility into compromised accounts and malicious activity. The platform also provides tools to prevent uploads and downloads with browser isolation and enforce file quarantines to meet compliance requirements.
Customers praise the ease of use, alerting quality, and fast time to value. The platform’s learning curve is lower than many CASB competitors, and Proofpoint’s professional services team helps resolve configuration issues quickly.
We think the O365 DLP and cross-channel detection make Proofpoint’s CASB especially strong for Microsoft-centric environments where Proofpoint email security is already in place. The lower learning curve relative to enterprise alternatives makes it accessible for security teams that don’t have dedicated CASB expertise.
Symantec CloudSOC, now under Broadcom, is a multi-featured CASB platform offering cloud application assessments, cloud usage analytics, malware analysis, and remediation. It’s a platform for cloud application security that includes auditing, real-time threat detection, protection against data loss and compliance violations, and post-incident analysis. The platform allows organizations to safeguard data, respond to security incidents, and protect against threats across their cloud applications.
CloudSOC’s threat intelligence layer covers malware analysis, intrusion detection, and post-incident analysis in one workflow, drawing on Symantec’s global threat intelligence network. Coverage spans both cloud and on-premises applications from a single platform, which sets it apart from cloud-only CASB tools. SOC teams can analyze all cloud apps, manage data governance, threat protection, and policy controls, and implement DLP policies from a single dashboard. Enhanced user behavioral analytics secure cloud email and file sharing, and API integration with Symantec Email Security adds cross-channel context. User activity reporting helps teams establish behavioral baselines for anomaly detection.
Customers praise data protection capabilities and the user interface. Access to cloud data and security controls is straightforward, and user activity reporting helps teams establish behavioral baselines. The platform continues to receive active updates post-acquisition according to recent customer feedback.
We think the threat intelligence backbone and hybrid coverage make CloudSOC a strong fit for large enterprises with mixed cloud and on-premises environments. The post-Broadcom acquisition licensing changes and product direction uncertainty are worth discussing with the vendor during any procurement process, but the platform continues to receive active updates.
Trend Micro Cloud App Security is a CASB solution providing advanced threat and data protection, as well as email security, for Microsoft 365, Google Workspace, and cloud file-sharing services including Box, Dropbox, Google Drive, OneDrive, and Teams. The platform focuses on simplicity and minimal admin overhead, deploying via API integration without complex setup, MX record changes, or web proxies. It’s primarily aimed at mid-sized organizations that need broad protection against cloud-based threats.
Trend Micro’s email security capabilities go beyond what M365 and Google Workspace offer natively. The platform scans links within emails for credential phishing in real time and runs sandbox malware analysis to catch advanced threats. Machine learning detection identifies business email compromise and spear-phishing attempts. DLP compliance is enforced across cloud file-sharing services with 240 pre-built compliance templates, and centralized dashboard management integrates with Trend Micro’s Apex One endpoint protection platform. A managed detection and response service with 24/7 alert monitoring, prioritization, investigation, and threat hunting is available as an add-on.
Customers highlight the ease of integration, strong technical support, and email protection that outperforms native cloud tools. Single-dashboard administration across users and configurations gets consistently positive marks.
We were impressed by the fast deployment and the depth of email threat protection. If your priority is email-focused cloud security for M365 or Google Workspace with fast deployment and minimal admin overhead, Trend Micro Cloud App Security is worth serious consideration, particularly for mid-sized organizations that want integrated endpoint and cloud coverage.
Our evaluation process covers hands-on testing, verified customer feedback, and independent research across each platform. We look at four core capabilities in every CASB evaluation: cloud application visibility and shadow IT discovery, data loss prevention depth and enforcement flexibility, access controls and identity governance, and threat protection across cloud services.
We considered a range of deployment models including API-based integration, reverse proxy, forward proxy, and hybrid approaches. Each model has practical trade-offs for visibility, enforcement, and user experience, and the right choice depends on whether your priority is monitoring existing cloud app usage or actively enforcing policies at the point of access.
We also evaluated vendor stability and acquisition history, which is particularly relevant in this category. Several platforms on this list have changed ownership in recent years, including Lookout CASB, Broadcom Symantec CloudSOC, and Cisco Cloudlock, and we’ve noted where that creates product direction uncertainty for buyers.
Expert Insights’ editorial and commercial teams operate independently. No vendor can pay to influence the testing, review, or ranking of their products. Our recommendations are based on hands-on evaluation, verified customer feedback, and independent research.
**Visibility and shadow IT discovery** is the foundation of any CASB deployment. Platforms vary significantly in the breadth of their cloud app catalogs and the depth of risk analytics they apply to discovered applications. Microsoft Defender for Cloud Apps covers 31,000+ apps across 90+ risk factors. Netskope and Forcepoint offer catalog-based discovery with custom risk scoring. Look for platforms that can import log data from your existing firewall or proxy to get discovery running before full deployment.
**Data loss prevention depth** determines what you can actually enforce across cloud applications. Basic DLP matches file types and labels. Content-aware DLP, such as what Cisco Cloudlock and Forcepoint offer, inspects the actual content of documents for sensitive data patterns like financial records or regulated identifiers. For organizations in regulated industries, content-level enforcement is usually required to meet compliance obligations.
**Deployment model** affects both what the platform can see and how disruptive it is to deploy. API-based CASBs like Trend Micro, Proofpoint, and Microsoft Defender for Cloud Apps connect to cloud apps directly without touching network traffic, making them fast to deploy and non-disruptive. Inline CASBs using reverse or forward proxy give more real-time control, including session-level enforcement, but require changes to how traffic is routed. Many enterprise platforms support both.
**Ecosystem fit** matters more for CASBs than for most security categories. Microsoft Defender for Cloud Apps delivers its strongest value inside an M365 environment. Cisco Cloudlock is best paired with Cisco Umbrella. Palo Alto’s Next-Gen CASB is designed for organizations already running Palo Alto SASE. Proofpoint’s CASB integrates closely with Proofpoint email security. Evaluating CASB in isolation from the rest of your security stack often leads to underutilizing the platform’s capabilities.
**Vendor stability** is a practical concern given recent acquisition activity in this category. Lookout CASB was acquired by Fortra in May 2025. Broadcom Symantec CloudSOC has undergone licensing changes since the Broadcom acquisition. When evaluating platforms with recent ownership changes, ask vendors directly about product roadmap commitments and support continuity before signing multi-year contracts.
For most M365-centric organizations, Microsoft Defender for Cloud Apps is the natural starting point given the native integration and zero additional setup cost on E5. Organizations that need stronger cross-platform coverage or more granular DLP should look at Netskope, Forcepoint, or Proofpoint, depending on whether the priority is unified web and cloud security, data governance, or cross-channel threat intelligence. Mid-sized organizations wanting fast deployment and strong email-focused cloud protection will find Trend Micro a practical fit. Enterprises with Palo Alto or Cisco security stacks will get the most out of the respective native CASB options.
CASB (Cloud Application Security Broker) solutions are a security tool which enable organizations to manage and secure their cloud applications, such as Microsoft 365 and Salesforce. These applications can quickly become vital to an organization, running key tasks and processes. But as they sit outside of your own network, it can be difficult to manage data, access policies, and tracking how many different applications are actually in use.
CASB solutions mitigate against these issues by providing a unified admin console connected to cloud applications and services which provides oversight and additional layers of security controls. This includes threat detection capabilities, user activity monitoring, policies and reporting and more. Capabilities of specific solutions can vary, some are integrated into wider web security solutions, some into endpoint and device security services, providing holistic security across an organization’s network.
CASB solutions are also important tools to prevent data loss. Many solutions provide data loss protection policies, access management and auditing to track where data is stored, and who has access to it. This is important to prevent data breach, but also to ensure compliance requirements are met, and best practices are enforced.
Cloud Access Security Brokers (CASBs) are security tools that sit between users and cloud-based applications, enforcing security policies and security controls. These services secure data moving from your local network environment to the cloud and vice-versa, based on your security policies such as encryption and authentication.
CASBs help to prevent, monitor, and mitigate against cybersecurity risks. Many solutions offer alerting for malicious activity or potential compliance violations, to help security teams keep on top of cloud risks. They can be used to help detect threats like ransomware, as well as preventing cloud-based account compromise by enforcing security policies such as single-sign on and device profiling.
CASBs are commonly deployed via Proxy Deployment, sitting between users and the SaaS cloud application, or via API deployment.
Joel is the Director of Content and a co-founder at Expert Insights; a rapidly growing media company focussed on covering cybersecurity solutions.
He’s an experienced journalist and editor with 8 years’ experience covering the cybersecurity space. He’s reviewed hundreds of cybersecurity solutions, interviewed hundreds of industry experts and produced dozens of industry reports read by thousands of CISOs and security professionals in topics like IAM, MFA, zero trust, email security, DevSecOps and more.
He also hosts the Expert Insights Podcast and co-writes the weekly newsletter, Decrypted. Joel is driven to share his team’s expertise with cybersecurity leaders to help them create more secure business foundations.
Craig MacAlpine is CEO and Founder of Expert Insights. Before founding Expert Insights in August 2018, Craig spent 10 years as CEO of EPA Cloud, an email security provider that rebranded as VIPRE Email Security following its acquisition by Ziff Davis, formerly J2Global (NASDAQ: ZD) in 2013.
Craig is a passionate security innovator with over 20 years of experience helping organizations to stay secure with cutting-edge information security and cybersecurity solutions.
Using his extensive experience in the email security industry, he founded Expert Insights with the singular goal of helping IT professionals and CISOs to cut through the noise and find the right cybersecurity solutions they need to protect their organizations.