See risk, fix risk: introducing Remediation in Cloudflare CASB (opens in new tab)
Cloudflare CASB now lets customers remediate risky SaaS file-sharing directly from the Cloudflare One dashboard, rather than merely identifying problems. The initial release targets Microsoft 365 and Google Workspace, removing public, organization-wide, or external sharing without deleting files or changing ownership. Cloudflare concludes that durable, workflow-based execution makes remediation scalable, observable, and easier to operate. ## CASB as a Centralized SaaS Risk View - CASB connects to services including Microsoft 365, Google Workspace, Slack, Salesforce, Box, GitHub, Jira, and Confluence through APIs. - It provides: - A consolidated view of misconfigurations, overshared files, and risky access. - Continuous scanning as users collaborate and adopt new tools. - Searchable and exportable findings for triage and reporting. - Previously, fixing findings required using each application’s admin interface or submitting tickets to application owners. ## File-Sharing Remediation - The new **Remove sharing** action can address: - Public links that allow anyone to view or edit files. - Company-wide sharing when only a few users need access. - Sharing with external domains or personal accounts. - Any of these risks involving files that match a DLP profile, such as customer records, credentials, or financial data. - Remediation removes the risky sharing configuration only: - Files are not deleted. - Ownership is not changed. - Progress and outcomes are tracked in CASB, while actions are recorded in Cloudflare One Admin logs and can be exported to a SIEM. ## Microsoft 365 and Google Workspace - The initial integrations focus on business-critical documents stored in: - OneDrive and SharePoint. - Google Drive, including Docs, Sheets, and Slides. - Common examples include temporary public editing links, company-wide documents forgotten after an event, and sensitive spreadsheets shared with contractors’ personal accounts. - Teams can now resolve findings directly in CASB instead of exporting CSVs and relying on application owners to make changes. ## Durable Remediation Architecture - Cloudflare designed the system for speed, resilience, and ease of use using: - Workers - Workflows - Queues - Workers KV - Secrets Store - Hyperdrive - The process is: - An API call sends a remediation job to a Worker. - The Worker places it on a Queue. - A second Worker starts a Workflow. - Credentials are securely provided through Workers KV and Secrets Store. - The Workflow gathers information and calls third-party APIs. - Hyperdrive records the final result. - Workflows’ native retries handle vendor API rate limits such as HTTP 429 responses, while built-in step logging shows retry activity. - Load testing and early customer usage produced a median completion time of 48 seconds and a p90 of 72 seconds. ## Planned Expansion - Cloudflare plans to add: - Quarantine actions that move or isolate high-risk files. - Custom Webhooks for ticketing, chat notifications, and external automation. - Carefully scoped autoremediation policies. - Custom CASB findings based on organization-specific patterns, data types, or access conditions. Organizations using Microsoft 365 or Google Workspace can use CASB Remediation to turn detected sharing risks into tracked, auditable fixes. The planned quarantine, webhook, and automated-policy features could further position CASB as an active security control plane rather than a passive reporting tool.