Automation comes to CASB

Cloudflare CASB has gained automatic remediation policies, letting security teams define event-driven logic that revokes risky file shares or fires custom webhooks without a human in the loop.

CASB was introduced to give organizations continuous visibility into SaaS posture through a clientless integration, surfacing overshared files, dormant admin keys and tokens, and OAuth apps with excessive permissions. Like most SaaS Security Posture Management (SSPM) tooling, it has largely been a passive alarm system: it reports what is wrong and leaves the fix to administrators. At tenant scale that queue grows quickly — a single bad sharing policy in Google Workspace can produce thousands of findings in seconds, and the gap between detection and a manual fix can stretch into hours or days.

From manual actions to standing response logic

Manual remediation actions, shipped earlier this year, let teams resolve misconfigurations straight from the Cloudflare dashboard instead of signing in to multiple SaaS portals. Each remediation still needed a person to confirm it, even for a finding type they had handled many times before.

CASB policies replace that confirmation step with a native automation engine inside Cloudflare One. Rules are authored once, then evaluated the moment a finding appears, with the engine executing whatever the customer configured — a remediation action, a webhook, or both.

Consider an organization that forbids public file sharing but exempts marketing users who work with external parties. Conventional SSPM flags the permitted activity and drops it into a queue alongside hundreds of real violations. A CASB policy matches the finding, revokes the public share within minutes, and keeps the backlog from filling up. Teams can lean on native CASB remediation or route events into their own automation and notification stack rather than building an event processing system.

Architecture and delivery guarantees

The engine runs entirely on the Cloudflare developer platform. The findings engine enqueues an orchestration message to Cloudflare Queues, and a Worker consumer checks incoming findings against policy configurations. On a match, the Worker creates the job and passes it to the remediations pipeline, which executes on Cloudflare Workflows for durable, fault-tolerant processing — jobs survive process restarts and retries happen automatically.

Vendor rate limits are absorbed by the same layer: when a third-party API returns a rate limit error, the Workflow pauses for the appropriate backoff window and retries instead of discarding the job. Cloudflare's target from detection to completed remediation is five minutes or less.

Defining a policy

Policies are created in the Cloudflare dashboard. A policy can carry both a remediation and a webhook action, but the minimum configuration requires four choices:

  • Vendor. Pick the vendor and integration or tenant the policy applies to.
  • Integration. Target specific integrations, or apply the policy across all integrations for that vendor.
  • Finding type. Choose the CASB finding type that should trigger the policy.
  • Action. Available actions are filtered by finding type and fall into two categories:
    • Run remediations. First-party actions Cloudflare performs directly against the SaaS integration API. File and folder finding types in Microsoft and Google Workspace are currently covered. Integrations may need upgrading permissions to read/write.
    • Send webhooks. Deliver finding details to configured webhook destinations — Slack, Microsoft Teams, Jira, ServiceNow, Tines, or any custom HTTP endpoint.

Audit and execution records

Every policy action generates two kinds of logs under Insights in Cloudflare One.

Admin Activity logs track changes to a policy definition: who created, edited, or disabled it, and when. If a policy was switched off and a risk slipped through, the audit trail provides the timeline.

Cloud & SaaS Security policies logs are a new log class capturing runtime outcomes — the finding that triggered the policy, the file acted on, success or failure, and the specific error when something fails, such as a 401 Unauthorized or a vendor API rate limit response. For compliance work this equates to proof of fix, linking a finding such as an overshared Q4_Financials.pdf to a specific automated action and timestamp.

Availability and what's next

CASB Policies are live now in the Cloud & SaaS findings section of the dashboard. Set your Microsoft 365 or Google Workspace integration to Read-Write permissions and create a first remediation policy. Support for Custom Findings is planned for the coming weeks, aimed at organizations that need to augment or define their own detection logic.