Cloudflare CASB adds automated remediation policies

Cloudflare has launched automatic remediation policies for its Cloud Access Security Broker (CASB), allowing security teams to define event-driven logic that triggers immediate actions when misconfigurations or risks are detected. This update aims to reduce the window between detection and remediation, which has traditionally relied on manual intervention and could span hours or days—leaving sensitive data exposed to unauthorized access or leaks.

How the feature works

Cloudflare CASB policies function as automated workflows that execute predefined actions when specific findings are identified. Security teams can configure policies to revoke access to overshared files, dispatch webhooks to security operations centers (SOCs), or forward events to security orchestration, automation, and response (SOAR) platforms. The system supports native remediation actions for Microsoft and Google Workspace, as well as custom webhook integrations with tools like Slack, Microsoft Teams, Jira, and ServiceNow.

Policies are built using a rule-based engine that matches findings to actions. For example, an organization can enforce a policy prohibiting public file sharing while exempting specific users or groups, such as marketing teams that frequently collaborate externally. When a violation is detected, the system automatically revokes the public share within minutes, reducing the backlog of manual remediation tasks. The architecture leverages Cloudflare’s developer platform, including Cloudflare Queues and Workers, to ensure durable, fault-tolerant execution with retries for failed actions, such as API rate limits.

Implementation and compliance

To create a policy, users navigate to the Cloudflare dashboard, select the vendor and integration (e.g., Microsoft 365 or Google Workspace), choose the finding type, and define the action—either a remediation or a webhook. The system requires read-write permissions for integrations to enable automated actions. Each policy execution generates logs under two categories: Admin Activity logs, which track changes to policy definitions, and Cloud & SaaS Security policies logs, which record runtime outcomes, including success or failure details and error messages (e.g., API rate limits or unauthorized access).

These logs serve as compliance proof, linking specific findings (e.g., an overshared file) to automated actions and timestamps. Cloudflare has set a target of five minutes or less from detection to remediation, though actual performance may vary based on vendor API responsiveness and rate limits.

What’s next

Cloudflare plans to expand CASB policies to support Custom Findings, allowing organizations to define or augment detection logic for unique security requirements. The feature is available now for customers with Microsoft 365 or Google Workspace integrations configured with read-write permissions. New users can sign up for 50 free seats under the Cloudflare One suite or consult Cloudflare’s team for larger deployments.