Datasheet | SASE Cloud Access Security Broker (CASB)

Check Point SASE Cloud Access Security Broker (CASB)

SAAS SECURITY WITH CHECK POINT SASE

Complete Inline and API-Based Protection for Your Entire SaaS Ecosystem

Security for SaaS applications in the enterprise comes down to two issues: control and visibility. Your teams rely on a growing ecosystem of SaaS tools, but many apps go unmonitored or misused exposing sensitive data and creating compliance gaps. Check Point SASE delivers full Cloud Access Security Broker (CASB) capabilities natively integrated into a unified SASE platform combining inline and API-based enforcement for complete visibility, data protection, threat prevention, and compliance across your SaaS ecosystem. No standalone CASB product required. Discover unsanctioned applications, evaluate risk, and enforce custom usage policies across more than 10,000 SaaS applications. Protect data at rest across leading SaaS platforms such as Google Workspace, Microsoft 365 (OneDrive, SharePoint, Teams), Salesforce, Jira, Slack, GitHub, Box, and Dropbox.

Key Challenges for Securing SaaS

• Sensitive Data Everywhere - SaaS applications hold personal records, payment data, source code, and more all living outside the traditional perimeter.
• Complex to Secure - You need a unified approach that simplifies security for the sprawling ecosystem of SaaS applications, APIs, and third-party integrations.
• Multiple Threat Vectors - Organizations face continual risk of data leakage, unauthorized access, and abuse by unsafe services.

Check Point’s discovery and continuous monitoring ensure these connections are detected, evaluated, and secured in real time.

Full CASB Capabilities: Inline and API-Based SaaS Protection

Check Point SASE combines inline and API-based enforcement for end-to-end SaaS security. Inline inspection enforces policies on web and SaaS traffic in real time. API-based scanning protects data at rest and in-SaaS activity, without requiring an agent. Together, they deliver comprehensive visibility, data protection, compliance management, and threat prevention across your entire SaaS ecosystem.

Control SaaS Usage

Check Point’s SaaS Application Control enables policy enforcement across more than 10,000 SaaS applications. Create allow or disallow rules for specific apps and user groups, including time-based access rules that limit usage to certain hours or days. Block usage entirely or restrict access during non-business hours: your policies match your exact needs.

Tenant Restrictions lets you limit access to only your organization's sanctioned SaaS tenants preventing users from logging into personal or unauthorized instances of apps like Microsoft 365 or Google Workspace, a common vector for data exfiltration.

Inline DLP inspects uploads and posts in real time using Check Point's AI-powered classification engine with 800+ predefined data types, while inline Threat Prevention scans downloads and web content for known and unknown malware, powered by ThreatCloud AI.

Out-of-Band DLP and Threat Prevention

API-based scanning delivers deep visibility and control over data and threats—even without inline deployment or an endpoint agent. This protects unmanaged devices and secures in-SaaS activity such as editing files online or changing sharing permissions.

• Data Loss Prevention - Detect and prevent sensitive data exposure at rest. Scan files and unstructured content including Jira tickets, Microsoft Teams messages, and Slack conversations. AI-powered classification covers 800+ predefined data types—PII, financial data, credentials, intellectual property, and custom types you define.
• Over-Sharing Protection - Continuously scan sharing permissions, identify policy violations, and automatically remediate risky access—including revoking overly broad permissions.
• Threat Prevention - Scan SaaS data at rest for known and unknown malware. Detect infected files and respond automatically, with options for immediate threat removal.

Supported Apps - Google Workspace, Jira, Salesforce, Microsoft (OneDrive, SharePoint, Teams), Dropbox, Box, Slack, and GitHub—with more coming soon.

AI-powered data classification drives accuracy across all scanning. Locally hosted LLMs and lightweight ML classifiers—combining NLP, Named Entity Recognition, and neural models—identify sensitive data while an ML-driven context layer reduces false positives. Define custom data types to match your organization's needs.

Discover and Secure Your SaaS Ecosystem

Beyond protecting data, you need full visibility into your SaaS footprint. Check Point maps every API, application, and plugin across your environment, and then helps you reduce risk with prioritized insights and guided remediation.

• Shadow SaaS Discovery: Near-immediate discovery of unsanctioned connections between your official SaaS apps and the third-party services your workforce connects to them including every API, application and plugin. It is backed by a catalog of more than 100,000 applications with risk assessments, certifications, and other critical details.
• Risky Connection Prevention: Automatically terminate compromised SaaS-to-SaaS connections before threat actors reach platforms like Microsoft 365 or Salesforce.

SAAS SECURITY WITH CHECK POINT SASE

• Identity & Anomaly Detection: AI-powered detection of data theft, supply chain attacks, and account takeover through behavioral analysis, threat intelligence, and historical SaaS activity data.
• Extended Visibility: Correlate SaaS discovery with data from Check Point Firewalls for broader threat context.

AI-Powered Data Classification

Check Point's DLP engine natively incorporates AI/ML-driven capabilities for superior classification accuracy. A multilayered architecture combines private, locally hosted LLMs for semantic data labeling with optimized lightweight ML classifiers that use NLP, Named Entity Recognition (NER), and neural network models to identify sensitive data such as PII and PHI. An ML-driven context classification layer around traditional regex and keyword matches significantly improves precision and reduces false positives.

SaaS Security Posture Management

Continuously assess and harden the security posture of your SaaS environment.

• Configuration Risk Remediation: Continuously monitor SaaS configurations for misconfigurations and compliance violations, with single-click remediation to fix gaps and improve native SaaS security settings.
• Compliance Readiness: Security posture assessment aligned with NIST best practices that map to common regulatory requirements (e.g. HIPAA, SOC 2, GDPR), helping maintain an audit-ready posture.
• Supported Apps: Asana, Atlassian, AWS, BambooHR, Bitbucket, Box, Dropbox, Freshdesk, GitHub, GitLab, Google Workspace, HubSpot, Jira, Microsoft OneDrive, Microsoft SharePoint, Microsoft Teams, Monday, Okta, OneLogin, Ping Identity, Salesforce, ServiceNow, Slack, Smartsheet, Zendesk, Zoom.

Prevent Threats Automatically

Check Point SASE enables automatic detection and prevention for SaaS-specific risks. ML-driven engines identify anomalous behavior and can automatically stop threats.

• Automatically stop, and get alerts for, anomalous activity via AI leveraging historical data on SaaS activity within and across organizations.
• Customize your SaaS security policies with the level of automation that’s right for you, namely read-only mode, approval-required or full autonomy.

Quick Time-to-Value

Check Point SASE CASB provides streamlined onboarding, an insights dashboard that populates quickly for your API connections, and a much lower barrier to managing SaaS security.

• Cloud-based solution with fast deployment time.
• Quick time to value - Information, insights and policies are available within minutes of installation.
• Remediate gaps with a single click.
• Intuitive interface reduces onboarding time for administrators.

Stay Ahead of SaaS Security Risks

Check Point SASE delivers comprehensive SaaS protection. Control usage with SaaS Application Control, detect anomalies with AI, and shut down risky SaaS integrations in real time. Secure SaaS applications as part of your complete SASE deployment. Start reducing risks and improving compliance today.