---
title: "Introducing automatic remediation policies with Cloudflare CASB"
description: "Cloudflare CASB now supports automatic remediation policies that respond to newly detected SaaS security findings without requiring an administrator to act on each instance. Teams can match policies by vendor, integration or tenant, and finding type, then revoke file-sharing access, send finding details to webhooks, or do both; first-party remediation currently covers Microsoft and Google Workspace file and folder findings. The backend enqueues findings to Cloudflare Queues, uses a Worker to match policy configurations, and runs matched jobs through Cloudflare Workflows, which provides durable execution, retries, and rate-limit backoff. Policies generate administrator-activity and runtime execution logs, while the stated target from detection to completed remediation is five minutes or less; support for Custom Findings is planned for the coming weeks."
---

# Introducing automatic remediation policies with Cloudflare CASB

[Cloudflare](https://yomu.fyi/company/cloudflare) · Michael Leslie · Sep 11, 2026

**Type:** Announcement

## Summary

Cloudflare CASB now supports automatic remediation policies that respond to newly detected SaaS security findings without requiring an administrator to act on each instance. Teams can match policies by vendor, integration or tenant, and finding type, then revoke file-sharing access, send finding details to webhooks, or do both; first-party remediation currently covers Microsoft and Google Workspace file and folder findings. The backend enqueues findings to Cloudflare Queues, uses a Worker to match policy configurations, and runs matched jobs through Cloudflare Workflows, which provides durable execution, retries, and rate-limit backoff. Policies generate administrator-activity and runtime execution logs, while the stated target from detection to completed remediation is five minutes or less; support for Custom Findings is planned for the coming weeks.

## Context

SaaS Security Posture Management tools often identify misconfigurations but leave administrators to remediate them manually. A single file-sharing policy violation can create thousands of findings, leaving a detection-to-remediation window of hours or days during which sensitive files may be downloaded, forwarded, or indexed.

## Approach / What changed

CASB policies provide event-driven workflows that match findings by vendor, integration or tenant, and finding type, then invoke native remediation actions, send webhooks, or both. The implementation uses Cloudflare Queues, a Worker consumer, and Cloudflare Workflows for durable execution, automatic retries, and vendor rate-limit backoff.

## Takeaways

- Policies can revoke public file shares automatically and send finding details to destinations including Slack, Microsoft Teams, Jira, ServiceNow, Tines, or custom HTTP endpoints.
- The remediation pipeline runs on Cloudflare Workflows, so jobs survive process restarts, retry automatically, and pause during third-party API rate limits before retrying.
- Two log categories provide governance and verification: Admin Activity logs record policy changes, while Cloud & SaaS Security policies logs record invocation outcomes, acted-on files, and errors.

**Tags:** [Automation](https://yomu.fyi/topic/automation), [CASB](https://yomu.fyi/topic/casb), [Cloudflare One](https://yomu.fyi/topic/cloudflare-one), [Security](https://yomu.fyi/topic/security)

- Source: [Cloudflare](https://blog.cloudflare.com/casb-policies)
- Source URL: https://blog.cloudflare.com/casb-policies
- Ingested by Yomu: 2026-09-11T16:01:05.561Z

[Read original post](https://blog.cloudflare.com/casb-policies)