Cloudflare CASB gains automatic remediation for risky file shares

Cloudflare has added automatic remediation policies to its cloud access security broker (CASB), letting security teams define event-driven responses — revoking a risky file share, dispatching a webhook, or both — that execute the moment a new finding is detected, with no human step in between. The company announced the feature on the Cloudflare blog on September 11.

From passive alerts to automated response

CASB, part of Cloudflare One, connects to SaaS applications without a client and continuously surfaces posture risks such as overshared files, dormant administrator keys and tokens, and OAuth applications granted excessive permissions. According to Cloudflare, tools in the SaaS Security Posture Management (SSPM) category have mostly behaved like detection-only systems: they report what is wrong but leave the fixing to administrators.

That burden can scale badly. Cloudflare points out that one misconfigured sharing setting across a Google Workspace tenant can generate thousands of findings almost instantly, and even disciplined teams face a gap of hours or days between detection and remediation — ample time for a sensitive document to be downloaded, forwarded or indexed.

Earlier this year Cloudflare introduced manual remediation actions, so administrators could resolve findings from the Cloudflare dashboard instead of hopping between vendor consoles. Each action still required a person to confirm it, even for finding types seen many times before. The new policies remove that human from the loop.

How the policies work

A policy is an automated workflow attached to a finding type. When the scanning service detects a match, the policy triggers a remediation action, sends a webhook, or does both — so organizations can lean on Cloudflare's native remediation or route events to their own systems, such as a security operations center or a SOAR platform.

Cloudflare offers a common scenario: an organization bans public file sharing but exempts its marketing team, which regularly collaborates with external parties. With queue-oriented tools, permitted exceptions pile up next to genuine violations and each needs individual triage. With policies in place, the public share is revoked within minutes of detection.

Building a policy means selecting a vendor, choosing the integration or tenant it applies to (or all integrations for that vendor), picking a finding type, and choosing an action. Actions fall into two categories:

• Remediations: first-party actions Cloudflare executes against the SaaS integration's API. These currently cover Microsoft and Google Workspace file and folder finding types, and may require upgrading the integration's permissions to read/write.
• Webhooks: finding details delivered to destinations including Slack, Microsoft Teams, Jira, ServiceNow and Tines, or any custom HTTP endpoint.

The webhook payload carries the finding's severity and type, the affected asset's name and vendor, and file metadata such as access level, download counts and ownership details.

Built on Cloudflare's own developer platform

The backend runs entirely on the Cloudflare developer platform, the same one available to customers. When a finding is detected, the findings engine enqueues a message on Cloudflare Queues; a Worker checks whether a policy matches and, if so, hands a job to the remediation pipeline, which runs on Cloudflare Workflows for durable execution. Jobs survive process restarts and retries happen automatically. If a vendor API returns a rate-limit error, the workflow pauses for a backoff window and retries rather than dropping the job. Cloudflare's target from detection to completed remediation is five minutes or less.

Auditability

Every policy action produces two classes of logs under Insights in Cloudflare One. Admin Activity logs record changes to policy definitions — who created, edited or disabled a policy, and when — providing a timeline if a policy was turned off and a risk slipped through. A new Cloud & SaaS Security policies log captures runtime outcomes: which finding fired, which file was acted on, whether the action succeeded, and the specific error, such as an authorization failure or rate limit, if it failed.

Why it matters

The interval between detecting a SaaS misconfiguration and fixing it is where data actually leaks. By closing that loop automatically — and pairing native remediation with webhook handoffs to existing tooling — Cloudflare shifts CASB from a reporting tool into a response system, and it does so on the same Queues, Workers and Workflows primitives any customer can build with. The limits are worth noting: built-in remediation currently applies only to Microsoft and Google Workspace file and folder findings, so other risk types still depend on webhook-driven external automation. For organizations running those suites at scale, moving from triage queues to minutes-long remediation meaningfully shrinks the exposure window.