CloudflareMichael LeslieAnnouncement
Cloudflare CASB now supports automatic remediation policies that respond to newly detected SaaS security findings without requiring an administrator to act on each instance. Teams can match policies by vendor, integration or tenant, and finding type, then revoke file-sharing access, send finding details to webhooks, or do both; first-party remediation currently covers Microsoft and Google Workspace file and folder findings. The backend enqueues findings to Cloudflare Queues, uses a Worker to match policy configurations, and runs matched jobs through Cloudflare Workflows, which provides durable execution, retries, and rate-limit backoff. Policies generate administrator-activity and runtime execution logs, while the stated target from detection to completed remediation is five minutes or less; support for Custom Findings is planned for the coming weeks.
SaaS Security Posture Management tools often identify misconfigurations but leave administrators to remediate them manually. A single file-sharing policy violation can create thousands of findings, leaving a detection-to-remediation window of hours or days during which sensitive files may be downloaded, forwarded, or indexed.
CASB policies provide event-driven workflows that match findings by vendor, integration or tenant, and finding type, then invoke native remediation actions, send webhooks, or both. The implementation uses Cloudflare Queues, a Worker consumer, and Cloudflare Workflows for durable execution, automatic retries, and vendor rate-limit backoff.
Policies can revoke public file shares automatically and send finding details to destinations including Slack, Microsoft Teams, Jira, ServiceNow, Tines, or custom HTTP endpoints.
The remediation pipeline runs on Cloudflare Workflows, so jobs survive process restarts, retry automatically, and pause during third-party API rate limits before retrying.
Two log categories provide governance and verification: Admin Activity logs record policy changes, while Cloud & SaaS Security policies logs record invocation outcomes, acted-on files, and errors.
Summaries are generated from the original by a language model. Check the original before relying on it.
See the idea
AssemblyScript is a TypeScript-like way to target WebAssembly. This explainer shows how source becomes a sandboxed module, crosses explicit host boundaries, and fits performance-sensitive services.
Amazon SQS connects producers and workers, but its real design test is failure. Compare the processing path with the signals and controls needed when queue operations break.
Keep reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
One useful email. Unsubscribe anytime.
