Best 9 Cloud Access Security Brokers (CASBs) For Enterprise (2026)

We reviewed the leading CASB platforms on cloud application discovery depth, DLP enforcement, and how well they integrate with existing identity and network security controls.

Last updated on May 15, 2026 20 Minutes To Read
Joel Witts Written by Joel Witts
Craig MacAlpine Technical Review by Craig MacAlpine

Quick Summary

We’ve evaluated the best cloud access security brokers to help organizations gain visibility, enforce data policies, and protect against threats across cloud applications.

Best 9 Cloud Access Security Brokers (CASBs) For Enterprise (2026)

Businesses are increasingly relying on cloud applications for critical day-to-day activities, in communication, accounting, marketing, file management and more. Many businesses carry out almost all of their business processes on cloud-hosted applications.

Powerful cloud-based tools like Microsoft 365, Salesforce and HubSpot empower employees to be more productive and have more control over their work, while also allowing businesses to run more efficiently. The SaaS nature of cloud applications also makes billing easier, giving businesses more control over the applications that are working, and those that aren’t.

As more businesses take advantage of these cloud benefits, they’re also relying more on the security of these cloud systems to protect their personal data. Everything from employee details, to customer data, to financial statements are stored in third-party cloud-based systems.

To ensure that these systems are secured and that businesses have the control and visibility over their data that they need, businesses are using Cloud Access Security Brokers (CASBs). These services are designed to sit between cloud service users and cloud applications, monitoring activity and ensuring that security policies are properly enforced.

Key features of CASB solutions include enhancing visibility into cloud applications, ensuring companies meet compliance needs with data loss protection policies, enforcing data security policies with access controls and encryption, and providing a strong level of threat protection across cloud accounts.

In this article, we’ll cover the top Cloud Access Security Brokers on the market. We’ll compare the four key features outlined above, as well as other considerations such as ease of use and pricing, to help you find the service that’s right for your organization.

Best Cloud Access Security Brokers Shortlist

1. Cisco Cloudlock — Best for organizations already running Cisco Umbrella seeking API-based CASB

2. Forcepoint CASB — Best for enterprises needing unified DLP across cloud and on-premises environments

3. Lookout CASB — Best for multi-country enterprises needing DLP, encryption, and tokenization in one platform

4. Microsoft Defender for Cloud Apps — Best for M365 organizations wanting native CASB with zero additional setup

5. Netskope One CASB — Best for organizations wanting a unified console for cloud, web, and private app security

6. Palo Alto Networks Next-Gen CASB — Best for enterprises already running Palo Alto’s SASE stack

7. Proofpoint Cloud App Security Broker — Best for Proofpoint email security customers extending protection to cloud apps

8. Broadcom Symantec CloudSOC — Best for large enterprises with hybrid cloud and on-premises environments

9. Trend Micro Cloud App Security — Best for mid-sized organizations wanting fast deployment and email-focused cloud security

1.

Cisco Cloudlock

Cisco Cloudlock Logo

Cisco Cloudlock is a cloud-native CASB solution that protects users, data, and cloud applications. It’s fully API-based, providing a simplified way to secure access and manage security in cloud applications without requiring agents or inline inspection. Cloudlock is designed to integrate with Cisco’s broader security portfolio, and pairs particularly well with Cisco Umbrella, allowing organizations to combine cloud application security with web threat protection.

Cisco Cloudlock Key Features

Cloudlock’s DLP policies operate at the content level, not just by file title or label, which matters when enforcing policies across ITAR or sensitive unclassified data types. The platform uses machine learning to detect behavioral anomalies and govern access management across cloud applications. Cloudlock’s Apps Firewall detects, controls, and protects cloud applications connected to the enterprise environment, assigning crowdsourced security scores and allowing IT teams to ban or allow apps as needed. OAuth app discovery surfaces hidden third-party access risks in Google Workspace environments. Pre-built industry policy templates accelerate compliance setup.

What Customers Say

Users highlight data screening for remote workforces as a real strength. Controlling what gets shared externally is a consistent theme in positive feedback, with several customers reporting measurable reductions in unauthorized file sharing after deployment.

Our Take

We think Cloudlock pairs best with organizations already invested in the Cisco security ecosystem. The OAuth app discovery and content-aware DLP are strong for Google Workspace environments, but keep in mind the platform is best realized when combined with Cisco Umbrella for broader web and cloud threat coverage.

Strengths

  • Content-level DLP beyond simple file classification
  • OAuth app discovery surfaces hidden third-party access risks in Google environments
  • Pre-built industry policy templates for fast compliance setup
  • API-based deployment with no agents or inline inspection required
  • Integrates with Cisco Umbrella for combined web and cloud application protection

Cautions

  • Reviews note that third-party integrations lag outside the Cisco ecosystem
  • Customers flag limited endpoint integration requiring separate EDR management
2.

Forcepoint CASB

Forcepoint CASB Logo

Forcepoint CASB is a data-first cloud access security broker that gives IT teams enhanced visibility into cloud application usage, contextual risk assessment, and unified policy enforcement. The service allows IT teams to discover, assess, and protect applications in the cloud, combining shadow IT discovery, real-time monitoring, and DLP into a centralized platform with enterprise reporting and role-based controls.

Forcepoint CASB Key Features

Forcepoint’s core advantage is its unified DLP engine, which delivers consistent data protection policies across cloud and on-premises environments from a single console. Cloud app discovery uses log file analysis to automate categorization of cloud apps and produces aggregated discovery reports in the centralized dashboard. Contextual risk scoring adapts controls based on user identity, device, and activity patterns, and real-time activity monitoring covers privileged users with automatic anomaly detection. The platform integrates with 800,000+ cloud apps via API, reverse proxy, and forward proxy. Granular mobile and endpoint device policies enable access control and data protection beyond the perimeter.

What Customers Say

Customers praise the unified console and Forcepoint’s support team for making implementation manageable. The single-pane approach to policy management across cloud and web gets consistent positive feedback, particularly from organizations that previously managed multiple separate tools.

Our Take

We think Forcepoint CASB works best for mid-to-large enterprises with dedicated security teams who can invest in proper configuration. If your organization already runs Forcepoint DLP or needs a single platform for cloud and on-premises data governance, this is a strong fit.

Strengths

  • Unified DLP engine across cloud and on-premises environments
  • Contextual risk scoring adapts controls by user, device, and activity
  • Centralized shadow IT dashboard with customizable risk ratings
  • Integrates with 800,000+ cloud apps via API, reverse proxy, and forward proxy

Cautions

  • Users report complex initial policy configuration for CASB newcomers
  • RegEx-based detection needs careful tuning to avoid false negatives
3.

Lookout CASB

Lookout CASB Logo

Lookout CASB, formerly CipherCloud, is a cloud and hybrid-deployable CASB platform focused on end-to-end data protection, threat detection, and compliance. CipherCloud was acquired by Lookout in 2021. The platform provides continuous layers of security including deep visibility, adaptive access controls, data protection, risk compliance, and zero-day threat protection across cloud applications. Note that Lookout’s CASB was acquired by Fortra in May 2025, and customers should verify current product support commitments directly with the vendor.

Lookout CASB Key Features

Lookout bundles data loss prevention, encryption, and tokenization into a single platform, which matters when compliance teams need consistent data protection across multiple cloud applications. Adaptive access controls perform continuous risk assessment of users connecting to cloud applications, providing contextual access that ensures only the right users connect to the right applications. Real-time malware detection with sandboxing covers zero-day threats, and user and application auditing tracks behavioral anomalies. The platform enables management of cloud applications across multiple countries from a single dashboard with configurable controls.

What Customers Say

Customers highlight timely vulnerability detection and real-time threat notifications as key strengths. The always-on monitoring and quick alerting on unusual behavior get positive marks. Support quality gets mixed feedback, with some customers reporting slower response times.

Our Take

If your organization operates across multiple countries and needs centralized cloud data protection with strong encryption and tokenization, this platform fits well. We think it works best for enterprises with dedicated compliance requirements, though the Fortra acquisition in May 2025 creates some uncertainty about long-term product direction that buyers should factor into their evaluation.

Strengths

  • DLP, encryption, and tokenization unified in one platform
  • Adaptive access controls adjust dynamically based on continuous risk signals
  • Multi-country cloud management from a single dashboard
  • Real-time malware detection with sandboxing for zero-day threats

Cautions

  • Acquired by Fortra in May 2025, creating product direction uncertainty
  • Reviews note pricing runs high compared to alternatives
4.

Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps Logo

Microsoft Defender for Cloud Apps, formerly Microsoft Cloud App Security, is Microsoft’s native CASB built to give M365 customers centralized visibility and control over cloud application usage. It integrates natively with Microsoft’s own cloud suite and is designed to provide visibility into threats and user behaviors, greater control over data, and analytics to combat cyberthreats across cloud applications. The service supports centralized management and automation of security processes, and pricing varies by program region and agreement type.

Microsoft Defender for Cloud Apps Key Features

Cloud app discovery covers risk analytics across more than 31,000 applications and 90+ risk factors, giving security teams a real picture of what SaaS tools employees are using. The platform allows organizations to manage data loss with pre-built policies and controls to protect access to sensitive information. Microsoft’s automated engines detect unusual behavior across cloud applications to identify malicious activities, including signs of ransomware and malicious applications. Cloud Discovery maps and identifies applications in use across the cloud environment. The platform supports real-time session policies, app blocking, SaaS Security Posture Management, and app governance for risky OAuth permissions. Native integration spans M365, Microsoft Sentinel, and Defender XDR.

What Customers Say

Customers praise the SaaS visibility and shadow IT detection. Identifying suspicious configurations and unauthorized app usage gets consistently positive feedback across large enterprises. Some users note that navigating the platform is fragmented, with settings spread across multiple admin areas.

Our Take

We were impressed by the native integration depth. If you run Microsoft 365 and want a CASB that works without third-party overhead, Defender for Cloud Apps delivers the strongest value when paired with the rest of the Microsoft security stack. For organizations using a diverse range of non-Microsoft SaaS applications, the limited connector availability for third-party apps is worth evaluating against alternatives.

Strengths

  • Native integration with M365, Sentinel, and Defender XDR
  • Shadow IT discovery across 31,000+ apps and 90+ risk factors
  • Real-time session policies and app blocking
  • SSPM and app governance for risky OAuth permissions

Cautions

  • Users report fragmented navigation with settings spread across multiple areas
  • Customers note limited connector availability for non-Microsoft SaaS apps
5.

Netskope One CASB

Netskope One CASB Logo

Netskope is a market-leading CASB that prevents data loss from both insider threats and external attackers by allowing admins to set granular security policies and gain visibility into cloud application risk. The platform secures cloud services such as Microsoft 365, Google Workspace, Box, and AWS, providing protection across these services against cloud threats and malware. Netskope deploys 100% in the cloud, with an on-premises appliance and hybrid options also available.

Netskope One CASB Key Features

Netskope’s unified console manages cloud, web, and private app traffic from one platform. The platform uses over 40 threat intelligence feeds to power real-time malware detection and anomaly identification. Admins can target and control activities across thousands of cloud services and millions of websites with enhanced data protection policies and controls. Granular role-based DLP includes encryption and tokenization, with rule-based access controls enforceable across cloud applications. Native API integrations cover M365, Google Workspace, Box, and AWS.

What Customers Say

Customers consistently praise the unified platform approach and support quality. The single-console visibility saves IT teams significant time and simplifies day-to-day operations across organizations with complex cloud environments. Some teams find the initial configuration and policy setup demanding.

Our Take

We were impressed by the platform’s range. If you need a single platform covering CASB, web security, and private app access with strong DLP and compliance controls, Netskope belongs at the top of your evaluation list. The complexity of initial configuration is real but manageable for organizations with dedicated security resources.

Strengths

  • Unified console for cloud, web, and private app traffic
  • 40+ threat intelligence feeds for real-time malware and anomaly detection
  • Granular role-based DLP with encryption and tokenization
  • Native API integrations with M365, Google Workspace, Box, and AWS

Cautions

  • Reviews flag complex initial deployment and policy configuration
  • Customers note the UI lacks intuitiveness for log access and custom reports
6.

Palo Alto Networks Next-Gen CASB

Palo Alto Networks Next-Gen CASB Logo

Palo Alto’s Next-Gen CASB is an SASE-native solution that uses machine learning to automatically discover cloud applications, protect data, and remediate misconfigurations. We think it’s best suited for organizations running Palo Alto’s broader security stack. The ML-driven approach to app discovery is genuinely different from catalog-based methods, and the misconfiguration remediation workflows add a posture management layer that many standalone CASBs lack.

Palo Alto Networks Next-Gen CASB Key Features

Palo Alto’s approach stands apart through ML-powered discovery that automatically identifies new cloud applications across all traffic types, rather than relying on static app catalogs. That matters when employees regularly adopt new SaaS tools outside the approved list. Misconfiguration remediation workflows address configuration drift in complex environments. Policy enforcement is consistent across hybrid cloud and on-premises, and deep visibility spans endpoints, networks, and applications from a single console.

What Customers Say

Customers highlight the deep visibility, monitoring capabilities, and zero trust enforcement as real strengths. The zone-based architecture, policy optimization tools, and VM deployment flexibility get positive marks from security engineers managing complex multi-environment deployments.

Our Take

We think Palo Alto’s Next-Gen CASB fits best when deployed alongside Palo Alto’s broader SASE and security stack. The ML-driven app discovery paired with misconfiguration remediation is strong for enterprises that have outgrown static catalog-based CASBs, but the steep setup curve and separate per-feature licensing make it a harder sell as a standalone purchase.

Strengths

  • ML-powered discovery automatically identifies new cloud apps across all traffic
  • Misconfiguration remediation workflows for complex environments
  • Consistent policy enforcement across hybrid cloud and on-prem
  • Deep visibility across endpoints, networks, and applications

Cautions

  • Steep learning curve for setup and policy fine-tuning
  • Reviews note confusing licensing with separate subscriptions per feature set
7.

Proofpoint Cloud App Security Broker

Proofpoint Cloud App Security Broker Logo

Proofpoint’s CASB platform protects cloud applications and users from malware threats, data loss, and compliance risks. It secures access and data within cloud apps like Microsoft 365, Google Workspace, Box, and more. Proofpoint is one of the world’s leading email security vendors, and the CASB platform is sold both as a standalone product and as an add-on for existing Proofpoint email security customers, integrating threat intelligence across email, web, and cloud.

Proofpoint Cloud App Security Broker Key Features

Detection pulls from multiple sources covering email, web, and cloud-based threats, so threats identified in the email environment automatically inform cloud app protection. Proofpoint profiles 46,000+ applications for risk identifiers, helping organizations identify vendor credibility, vulnerabilities, and security gaps. O365 DLP surfaces publicly shared files with automated remediation. Sandboxing and browser isolation handle cloud-uploaded threats. Behavioral monitoring at the global, app, and user level gives IT teams visibility into compromised accounts and malicious activity. The platform also provides tools to prevent uploads and downloads with browser isolation and enforce file quarantines to meet compliance requirements.

What Customers Say

Customers praise the ease of use, alerting quality, and fast time to value. The platform’s learning curve is lower than many CASB competitors, and Proofpoint’s professional services team helps resolve configuration issues quickly.

Our Take

We think the O365 DLP and cross-channel detection make Proofpoint’s CASB especially strong for Microsoft-centric environments where Proofpoint email security is already in place. The lower learning curve relative to enterprise alternatives makes it accessible for security teams that don’t have dedicated CASB expertise.

Strengths

  • Cross-channel threat intelligence from email, web, and cloud
  • O365 DLP surfaces publicly shared files with automated remediation
  • Lower learning curve than most enterprise CASB platforms
  • Sandboxing and browser isolation for cloud-uploaded threats

Cautions

  • Users report false positives in data content alerts requiring manual triage
  • Customers mention cumbersome log searching for incident investigation
8.

Broadcom Symantec CloudSOC

Broadcom Symantec CloudSOC Logo

Symantec CloudSOC, now under Broadcom, is a multi-featured CASB platform offering cloud application assessments, cloud usage analytics, malware analysis, and remediation. It’s a platform for cloud application security that includes auditing, real-time threat detection, protection against data loss and compliance violations, and post-incident analysis. The platform allows organizations to safeguard data, respond to security incidents, and protect against threats across their cloud applications.

Broadcom Symantec CloudSOC Key Features

CloudSOC’s threat intelligence layer covers malware analysis, intrusion detection, and post-incident analysis in one workflow, drawing on Symantec’s global threat intelligence network. Coverage spans both cloud and on-premises applications from a single platform, which sets it apart from cloud-only CASB tools. SOC teams can analyze all cloud apps, manage data governance, threat protection, and policy controls, and implement DLP policies from a single dashboard. Enhanced user behavioral analytics secure cloud email and file sharing, and API integration with Symantec Email Security adds cross-channel context. User activity reporting helps teams establish behavioral baselines for anomaly detection.

What Customers Say

Customers praise data protection capabilities and the user interface. Access to cloud data and security controls is straightforward, and user activity reporting helps teams establish behavioral baselines. The platform continues to receive active updates post-acquisition according to recent customer feedback.

Our Take

We think the threat intelligence backbone and hybrid coverage make CloudSOC a strong fit for large enterprises with mixed cloud and on-premises environments. The post-Broadcom acquisition licensing changes and product direction uncertainty are worth discussing with the vendor during any procurement process, but the platform continues to receive active updates.

Strengths

  • Global threat intelligence network for real-time detection and post-incident analysis
  • Covers both cloud and on-premises applications from one platform
  • User activity analytics for behavioral baselining and shadow IT discovery
  • Integrates with Broadcom's broader enterprise security portfolio

Cautions

  • Post-acquisition licensing and product direction changes create procurement uncertainty
  • Reviews note limited recent feedback makes long-term reliability harder to assess
9.

Trend Micro Cloud App Security

Trend Micro Cloud App Security Logo

Trend Micro Cloud App Security is a CASB solution providing advanced threat and data protection, as well as email security, for Microsoft 365, Google Workspace, and cloud file-sharing services including Box, Dropbox, Google Drive, OneDrive, and Teams. The platform focuses on simplicity and minimal admin overhead, deploying via API integration without complex setup, MX record changes, or web proxies. It’s primarily aimed at mid-sized organizations that need broad protection against cloud-based threats.

Trend Micro Cloud App Security Key Features

Trend Micro’s email security capabilities go beyond what M365 and Google Workspace offer natively. The platform scans links within emails for credential phishing in real time and runs sandbox malware analysis to catch advanced threats. Machine learning detection identifies business email compromise and spear-phishing attempts. DLP compliance is enforced across cloud file-sharing services with 240 pre-built compliance templates, and centralized dashboard management integrates with Trend Micro’s Apex One endpoint protection platform. A managed detection and response service with 24/7 alert monitoring, prioritization, investigation, and threat hunting is available as an add-on.

What Customers Say

Customers highlight the ease of integration, strong technical support, and email protection that outperforms native cloud tools. Single-dashboard administration across users and configurations gets consistently positive marks.

Our Take

We were impressed by the fast deployment and the depth of email threat protection. If your priority is email-focused cloud security for M365 or Google Workspace with fast deployment and minimal admin overhead, Trend Micro Cloud App Security is worth serious consideration, particularly for mid-sized organizations that want integrated endpoint and cloud coverage.

Strengths

  • API-based deployment with no MX record changes for M365
  • 240 pre-built compliance templates for fast DLP policy setup
  • Sandbox analysis and ML detection beyond native email security
  • Centralized dashboard with Apex One endpoint integration

Cautions

  • Users mention dashboard reporting lacks customization
  • Reviews report slow config syncing across cloud environments after updates

How We Compared The Best Cloud Access Security Brokers

Our evaluation process covers hands-on testing, verified customer feedback, and independent research across each platform. We look at four core capabilities in every CASB evaluation: cloud application visibility and shadow IT discovery, data loss prevention depth and enforcement flexibility, access controls and identity governance, and threat protection across cloud services.

We considered a range of deployment models including API-based integration, reverse proxy, forward proxy, and hybrid approaches. Each model has practical trade-offs for visibility, enforcement, and user experience, and the right choice depends on whether your priority is monitoring existing cloud app usage or actively enforcing policies at the point of access.

We also evaluated vendor stability and acquisition history, which is particularly relevant in this category. Several platforms on this list have changed ownership in recent years, including Lookout CASB, Broadcom Symantec CloudSOC, and Cisco Cloudlock, and we’ve noted where that creates product direction uncertainty for buyers.

Expert Insights’ editorial and commercial teams operate independently. No vendor can pay to influence the testing, review, or ranking of their products. Our recommendations are based on hands-on evaluation, verified customer feedback, and independent research.

What To Look For In A Cloud Access Security Broker

**Visibility and shadow IT discovery** is the foundation of any CASB deployment. Platforms vary significantly in the breadth of their cloud app catalogs and the depth of risk analytics they apply to discovered applications. Microsoft Defender for Cloud Apps covers 31,000+ apps across 90+ risk factors. Netskope and Forcepoint offer catalog-based discovery with custom risk scoring. Look for platforms that can import log data from your existing firewall or proxy to get discovery running before full deployment.

**Data loss prevention depth** determines what you can actually enforce across cloud applications. Basic DLP matches file types and labels. Content-aware DLP, such as what Cisco Cloudlock and Forcepoint offer, inspects the actual content of documents for sensitive data patterns like financial records or regulated identifiers. For organizations in regulated industries, content-level enforcement is usually required to meet compliance obligations.

**Deployment model** affects both what the platform can see and how disruptive it is to deploy. API-based CASBs like Trend Micro, Proofpoint, and Microsoft Defender for Cloud Apps connect to cloud apps directly without touching network traffic, making them fast to deploy and non-disruptive. Inline CASBs using reverse or forward proxy give more real-time control, including session-level enforcement, but require changes to how traffic is routed. Many enterprise platforms support both.

**Ecosystem fit** matters more for CASBs than for most security categories. Microsoft Defender for Cloud Apps delivers its strongest value inside an M365 environment. Cisco Cloudlock is best paired with Cisco Umbrella. Palo Alto’s Next-Gen CASB is designed for organizations already running Palo Alto SASE. Proofpoint’s CASB integrates closely with Proofpoint email security. Evaluating CASB in isolation from the rest of your security stack often leads to underutilizing the platform’s capabilities.

**Vendor stability** is a practical concern given recent acquisition activity in this category. Lookout CASB was acquired by Fortra in May 2025. Broadcom Symantec CloudSOC has undergone licensing changes since the Broadcom acquisition. When evaluating platforms with recent ownership changes, ask vendors directly about product roadmap commitments and support continuity before signing multi-year contracts.

The Bottom Line

For most M365-centric organizations, Microsoft Defender for Cloud Apps is the natural starting point given the native integration and zero additional setup cost on E5. Organizations that need stronger cross-platform coverage or more granular DLP should look at Netskope, Forcepoint, or Proofpoint, depending on whether the priority is unified web and cloud security, data governance, or cross-channel threat intelligence. Mid-sized organizations wanting fast deployment and strong email-focused cloud protection will find Trend Micro a practical fit. Enterprises with Palo Alto or Cisco security stacks will get the most out of the respective native CASB options.

FAQs

Cloud Access Security Brokers (CASBs) FAQs

Written By Written By
Joel Witts
Joel Witts Content Director

Joel is the Director of Content and a co-founder at Expert Insights; a rapidly growing media company focussed on covering cybersecurity solutions.

He’s an experienced journalist and editor with 8 years’ experience covering the cybersecurity space. He’s reviewed hundreds of cybersecurity solutions, interviewed hundreds of industry experts and produced dozens of industry reports read by thousands of CISOs and security professionals in topics like IAM, MFA, zero trust, email security, DevSecOps and more.

He also hosts the Expert Insights Podcast and co-writes the weekly newsletter, Decrypted. Joel is driven to share his team’s expertise with cybersecurity leaders to help them create more secure business foundations.

Technical Review Technical Review
Craig MacAlpine CEO and Founder

Craig MacAlpine is CEO and Founder of Expert Insights. Before founding Expert Insights in August 2018, Craig spent 10 years as CEO of EPA Cloud, an email security provider that rebranded as VIPRE Email Security following its acquisition by Ziff Davis, formerly J2Global (NASDAQ: ZD) in 2013.

Craig is a passionate security innovator with over 20 years of experience helping organizations to stay secure with cutting-edge information security and cybersecurity solutions.

Using his extensive experience in the email security industry, he founded Expert Insights with the singular goal of helping IT professionals and CISOs to cut through the noise and find the right cybersecurity solutions they need to protect their organizations.