Cloud Access Security Brokers

The KuppingerCole Leadership Compass on Cloud Access Security Brokers (CASBs) examines how organizations can regain security, compliance, and governance control in hybrid IT environments where multiple SaaS, IaaS, on-premises, and hosted services coexist. CASBs emerged because traditional security and access governance tools were slow to extend into cloud usage, creating gaps such as unmanaged “shadow IT,” inconsistent policy enforcement, and heightened exposure to data theft, corruption, and malware insertion. CASB capabilities cluster around discovering which cloud services are used (and by whom), controlling access and transactions across users/devices/locations, and protecting sensitive data in cloud services via detection, blocking, quarantining, encryption, or tokenization. Modern “CASB 2.0/CASB+” solutions increasingly combine functions traditionally associated with DLP, rights management, and secure web gateways, delivered through network-based proxy controls, API-based integration with cloud services, or a hybrid of both.

The evaluation framework emphasizes discovery depth (identity attribution, risk profiling, traffic analysis), granular access control (policy standards support, adaptive authentication, integration with directories/IDaaS and cloud-native controls), cloud data security (classification, DLP/RMS integration, encryption and key management), compliance (regulatory templates, certifications, reporting), and cyber security (malware controls, anomaly detection, integration with security intelligence systems). The Compass cautions that vendor selection requires deeper analysis and proof-of-concept validation beyond chart positions.

Overall Leaders are CipherCloud, McAfee, Microsoft, Oracle, Palo Alto Networks, and Symantec, with Microsoft and Symantec highlighted for integrated CASB 2.0 platforms after acquisitions. Product and Innovation Leadership particularly favor CipherCloud, Microsoft, Netskope, Oracle, and Symantec, while Market Leadership reflects global reach, elevating large vendors such as Microsoft, Symantec, Cisco, and others. Correlated matrices show weak alignment between market share and product strength, identifying vendors that “overperform” on capability relative to market presence and vice versa.

• CASBs provide discovery of cloud services being used, control over access and data transfer, and protection of data against unauthorized access, leakage, and cyber threats.
• CASB+ solutions use two primary discovery/control models: network-based control (such as proxies) and cloud-service-based control using APIs.
• Some CASB vendors have been acquired by major security software vendors and integrated into broader toolsets.
• Microsoft acquired Adallom and integrated it into Microsoft Enterprise Mobility + Security as Microsoft Cloud App Security.
• Symantec CloudSOC incorporates cloud data protection capabilities acquired and developed through Blue Coat.
• Cisco acquired Cloudlock Inc. and integrated the product as Cisco Cloudlock.
• McAfee closed its acquisition of Skyhigh Networks in January 2018 and sells the CASB as McAfee MVISION Cloud.
• Oracle acquired Palerra (formerly Palerra LORIC) and developed Oracle CASB Cloud Service with added DLP and malware scanning.
• Palo Alto Networks acquired CirroSecure in 2015, launched it as Aperture, and extended CASB proxy capabilities in 2017 via GlobalProtect cloud service.
• The Overall Leaders listed are CipherCloud, McAfee, Microsoft, Oracle, Palo Alto Networks, and Symantec.

• “CASBs address the challenges of security and compliance around the use of cloud services.”
• “In an ideal world, the functionality to manage access to cloud services and to control the data that they hold would be integrated with the normal access governance and cyber security tools used by organizations.”
• “The next generation CASB 2 or CASB+ solutions now on the market providing several of these functions, sometimes through inbuilt capabilities and sometimes through integration with other products.”
• “The better solutions use a combination of the two.”
• “Access to cloud services and the ability to upload/download content should ultimately be governed through the same processes as access to other kinds of services.”
• “Selecting a vendor of a product or service must not be only based on the comparison provided by a KuppingerCole Leadership Compass.”
• “However, a thorough selection includes a subsequent detailed analysis and a Proof of Concept pilot phase, based on the specific criteria of the customer.”
• “It comes as no surprise that these are mainly the very large vendors, while vendors below the line frequently are innovative but focused on specific regions.”
• “This matrix shows a picture that is typical for evolving market segments, with a rather broad distribution of the various players across the quadrants and a weak correlation between Market Leadership and Product Leadership.”
• “The spider graphs add an extra level of information by showing the areas where products are stronger or weaker.”