From detection to action in the CASB findings page

Cloudflare CASB customers can now take direct action on risky file-sharing findings from within the Cloudflare One dashboard. The new Remediation capability lets security teams clean up misconfigured shares across connected SaaS apps without leaving the CASB interface.

The release marks a turning point for Cloudflare’s API-based CASB. Since launch, the product has focused on visibility—connecting to SaaS providers, consolidating misconfigurations, and flagging overshared files. Remediation extends that into a fix-it workflow, moving CASB from a reporting layer to an active security control.

Closing the visibility-to-fix loop

Until now, CASB users had to export findings and chase down the right person in each app to correct share settings. Remediation removes that friction by executing the fix directly from the CASB Findings page. For file-sharing issues in Microsoft 365 and Google Workspace, triggering the Remove sharing action immediately strips the risky sharing configuration—whether that’s a public link, org-wide access, or an external share. Files and ownership are never touched; only the over-permissive share link is removed.

The fix targets the most common oversharing scenarios seen in production environments:

  • Public links that allow anyone on the internet to view or edit a file
  • Tenant- or domain-wide shares intended for a small group
  • External shares to personal accounts or untrusted domains
  • Any of the above when matched against a DLP profile, such as files containing customer records or credentials

Why Microsoft 365 and Google Workspace comes first

The two platforms host the bulk of business-critical documents for most organizations—financials, product roadmaps, contracts, HR records—and they’re where temporary sharing arrangements tend to stick around long after their usefulness. Microsoft 365 remediation covers OneDrive and SharePoint; Google Workspace covers Drive files including Docs, Sheets, and Slides.

Every remediation action is recorded in Cloudflare One’s Admin logs, providing visibility into which files were actioned by whom and when.

Architecture: engineered for durable execution

The Remediation system runs on Cloudflare Workers infrastructure, combining Workers, Workflows, Queues, Workers KV, Secrets Store, and Hyperdrive. When a job is initiated, an API call hits a Worker, which queues the job for a second Worker that starts a Workflow. Credentials are distributed securely via KV and Secrets Store, and the Workflow executes third-party API calls and records the outcome in a database through Hyperdrive.

Vendor API rate limits (429 responses) are an inevitability at scale. Workflows’ native retry handling and built-in step logging removed the need for complex custom state tracking or per-action serverless functions. Performance during load testing and early access showed a p50 end-to-end job completion time of 48 seconds and p90 of 72 seconds; issues with third-party APIs are handled without team intervention.

2024 roadmap: quarantine, webhooks, autonomy

File-sharing remediation for the two leading productivity suites is the opening move—planned changes extend CASB further:

  • Quarantine actions to move or isolate high-risk files
  • Custom Webhook actions to trigger downstream workflows like ticket creation or chat alerts
  • Autoremediation policies for scoped fixes with CASB acting automatically
  • Custom findings to track patterns or access conditions specific to each customer
  • Bulk Remediation for applying fixes across similar findings in one operation
  • Extended SaaS coverage targeting Box, Dropbox, Salesforce, GitHub, Slack, Atlassian, and others

How to get started: existing Cloudflare One and CASB customers can integrate Microsoft 365 or Google Workspace with Read-Write permissions, then remediate directly from file-sharing finding panels. New users can sign up for the 50-seat free tier, or consult Cloudflare experts for larger deployments. A paid CASB license is required for Remediation.