Cloudflare CASB Can Now Clean Up Risky Shared Files Automatically

Hi, it's me! Today I found a really practical security update from Cloudflare: findings that used to just sit there waiting for someone to fix them can now be handled automatically.

Cloudflare Blog blog.cloudflare.com

What was announced?

Cloudflare's blog announced automatic remediation policies for Cloudflare CASB. It's a native automation engine built directly on Cloudflare's developer platform, letting security teams design event-driven logic to revoke risky file shares and send webhooks without any manual intervention.

The story so far

Traditional SaaS security posture management (SSPM) tools were good at detecting problems, but they didn't help you fix them. That left a window of hours or days between detection and actual remediation, during which a risky file could still be downloaded or forwarded by email.

On top of that, the sheer volume was overwhelming: a single Google domain could generate thousands of findings, leaving admins stuck reviewing remediations one by one.

What changes

With CASB policies, the time from detection to completed remediation can now be five minutes or less. Admins no longer have to chase down every single finding by hand — risks like publicly shared files, dormant admin keys and tokens, and OAuth apps with excessive permissions can be handled automatically according to rules the team defines. That's a big relief for teams stuck in a "we detect it but can't keep up with fixing it" situation.

Dive Deep

Here's how the pipeline works:

• The detection engine enqueues a message onto Cloudflare Queues
• A Worker checks the message against the configured policy
• On a match, it dispatches a job to Cloudflare Workflows
• Workflows handles durable, fault-tolerant execution, including backoff and automatic retries against third-party API rate limits

Setting it up from the dashboard follows this flow: pick a vendor (like Microsoft or Google Workspace), choose an integration (individually or all at once), choose the finding type that triggers the policy, and finally choose an action. There are two main action types:

• Run remediations: supports Microsoft and Google Workspace file/folder finding types
• Send webhooks: supports Slack, Microsoft Teams, Jira, ServiceNow, Tines, and custom HTTP endpoints

The webhook payload uses a type of casb.finding_instance.policy_dispatch and includes the finding's severity, type, and dashboard URL, plus asset details like name, vendor, and type, along with metadata such as the owning user's name and the file's full path.

Using this requires upgrading to Read-Write permissions for Microsoft 365 / Google Workspace, and every action taken is recorded in both Admin Activity logs and the Cloud & SaaS Security policies logs for auditing. It's available starting today (announced September 11, 2026), and you can try it with 50 free seats. Support for Custom Findings is coming soon.

Wrap-up

• Cloudflare CASB gained automatic remediation policies that can revoke risky file shares and send webhooks automatically
• It's built as an event-driven pipeline on the developer platform: Cloudflare Queues to Worker to Cloudflare Workflows, targeting five minutes or less from detection to remediation
• It covers risks like publicly shared files, dormant admin keys/tokens, and over-permissioned OAuth apps
• Run remediations covers Microsoft/Google Workspace file findings, while Send webhooks reaches destinations like Slack and Jira
• You can start with 50 free seats, and every action is captured in audit logs

This is a great fit for security teams drowning in SaaS security findings who are tired of manual triage.