CASB for SMBs: Find & Fix Risky Cloud Access Before a Breach

Last month I got a call from the ops head of a 60-person export firm in Ludhiana. Someone outside the company had opened a Google Sheet full of vendor bank details and GST numbers. Not hacked. Just opened, because eight months earlier an intern had set the sharing to "Anyone with the link can view" so a shipping partner could see a delivery schedule. That link had been forwarded, pasted into a WhatsApp group, and quietly indexed. Nobody noticed until a competitor started quoting suspiciously accurate prices.

This is the quiet risk that most Indian SMBs carry right now. Not ransomware headlines, but hundreds of small exposures: publicly shared files, a marketing team using a free file-transfer SaaS nobody approved, an old AWS S3 bucket left open from a 2022 project, service accounts with keys that never rotate. IBM's Cost of a Data Breach report has pegged the India average breach cost at roughly ₹19.5 crore, and a large share of incidents trace back to misconfiguration and stolen credentials rather than sophisticated attacks. For a firm running lean, one such incident can wipe out a year of margin.

This post is about how CASB cloud security for SMBs actually works in practice: what a Cloud Access Security Broker finds, how it fixes exposed files and misconfigured sharing across AWS, GCP, Azure, Google Workspace and Microsoft 365, how to spot shadow SaaS your team quietly signed up for, and what it realistically costs to run in rupees. No vendor gloss. Just the stuff I brief clients on before we deploy.

Key Takeaways

• A CASB gives you one dashboard to see risky cloud access across Workspace, 365, and your IaaS accounts, instead of checking each console manually.
• The three biggest SMB exposures are public/anyone-with-link file sharing, over-privileged accounts and old access keys, and shadow SaaS bought on personal cards.
• Start with a discovery-only assessment for 2 to 4 weeks before you enforce a single policy. You will be surprised what turns up.
• Microsoft 365 E5 or Business Premium plus Defender for Cloud Apps, or a standalone tool like Netskope or Zscaler, are the realistic options. Budget roughly ₹350 to ₹1,200 per user per month depending on route.
• Remediation is 20% tooling and 80% policy and habit. Fix the sharing defaults and offboarding process or the alerts come back next quarter.
• Tie CASB findings to your DPDP Act and data residency obligations so security spend also covers compliance.

What is a CASB and why should an Indian SMB care?

A Cloud Access Security Broker sits between your users and your cloud services. Think of it as a checkpoint and a set of cameras. It watches who is accessing which cloud app, from where, what data they are moving, and whether any of it breaks a rule you have set. It works in a few modes: reading activity through API connections to services like Google Workspace and Microsoft 365, inspecting traffic inline through a proxy, and analysing firewall or proxy logs to reveal unsanctioned apps.

Ten years ago CASBs were enterprise-only, sold in six-figure dollar deals. That changed. Microsoft folded serious CASB capability into 365 licensing, and standalone vendors built SMB tiers. Today a 40-person accounting firm in Pune can run meaningful cloud visibility for the cost of a mid-range office rent.

Here is why it matters specifically in India. First, the DPDP Act now puts real obligations on how you handle personal data, and "we didn't know that file was public" is not a defence. Second, most SMBs run a messy hybrid: some servers still on-prem, a bit of AWS, Workspace or 365 for email, and a dozen SaaS tools. Nobody has a single view. A CASB is the cheapest way to get one. If you are still figuring out where your data even lives, our note on data residency rules for Indian SMBs is worth reading alongside this.

What risky cloud access actually looks like in a real company

Let me walk through an anonymised case, because the categories mean nothing until you see them in a real environment.

Case study: a 45-person logistics firm in Gurgaon

The company ran Google Workspace Business Standard for around 45 users, an AWS account hosting a shipment-tracking app, and a scatter of SaaS tools. Turnover in the ops team was high. When we connected a CASB in discovery mode, here is what the first two weeks surfaced:

• 312 files shared as "anyone with the link", including two folders with driver Aadhaar copies and one spreadsheet of client payment terms.
• 17 files shared externally to personal Gmail addresses of people who had left the company months earlier.
• Nine active user accounts belonging to ex-employees that were never disabled, three with admin rights.
• An AWS IAM user with an access key that was 631 days old and full S3 permissions, created for a one-off data export.
• Two S3 buckets set to public read, one holding scanned proof-of-delivery images with signatures and phone numbers.
• Shadow SaaS: 23 distinct cloud apps in use, including a free PDF-merger site and a US-based file-transfer tool the team used for large manifests. Only 6 were officially sanctioned.

None of this was malicious. It was accumulated over three years of "just get it done." The remediation cost in tooling was modest. The cost of ignoring it could have been a reportable breach under DPDP plus a very awkward conversation with their largest client, an FMCG brand with its own security audit requirements.

Common mistake: Teams rush to switch on enforcement and start blocking apps on day one. This creates a flood of angry support tickets and people find workarounds, which makes your visibility worse. Run in monitor-only mode first, learn the real workflows, then enforce selectively. You cannot secure a process you have never observed.

How does a CASB find exposed files and misconfigured sharing?

The file-sharing problem is where most SMBs get the fastest return, so let me be specific about how it works.

For Google Workspace and Microsoft 365, the CASB connects via API using an admin consent flow. It then scans Drive, SharePoint and OneDrive for every file and its sharing state. It classifies files by content, using patterns for things like PAN numbers, Aadhaar, GST identifiers, bank account formats and credit card numbers. So instead of "312 public files" you get "312 public files, of which 14 contain what looks like Aadhaar data." That prioritisation is the whole point.

For AWS, GCP and Azure, the CASB or its cloud-security posture management module reads configuration through read-only IAM roles. It flags public buckets, over-permissive security groups, unencrypted volumes, stale access keys and dormant privileged accounts. It maps findings against benchmarks like CIS, which is handy when a client's customer sends an audit questionnaire.

The remediation workflow, step by step

1. Connect in read-only mode. Grant API access to Workspace/365 and read-only IAM roles to your cloud accounts. No changes yet.
2. Run discovery for 2 to 4 weeks. Let it build a baseline of normal behaviour and a full inventory of shares, permissions and apps.
3. Triage by data sensitivity. Sort findings so anything containing PII, financial data or client contracts sits at the top. Ignore the public "office lunch photos" folder for now.
4. Fix the crown jewels manually first. Revoke external sharing on the sensitive files, lock the public S3 buckets, disable ex-employee accounts, rotate old keys. Do this with a named owner and a change log.
5. Set automated policies. For example: block any file containing an Aadhaar pattern from being shared externally, and quarantine any newly created public bucket automatically.
6. Change the defaults. In Workspace or 365 admin, restrict "anyone with the link" sharing at the domain level. This stops the problem regenerating.
7. Wire alerts into a channel people watch. Route high-severity alerts to a Teams or WhatsApp group, not just an email nobody opens.

Step 6 is the one that separates a real fix from a cleanup that unravels in six months. If your Workspace or 365 setup was never hardened properly, our team handles that as part of Google Workspace licensing and setup and Microsoft 365 licensing engagements, so the secure defaults are baked in from the start.

How do you catch shadow SaaS your team never told you about?

Shadow SaaS is the sleeper risk. A designer signs up for a free image tool with the company Gmail. Sales uses a scheduling app that stores customer phone numbers on servers you cannot name. Each is small. Together they are a data map you do not control.

A CASB discovers shadow SaaS two ways. If you route web traffic through it or feed it your firewall and proxy logs, it identifies every cloud service being reached and scores each app for risk: where it is hosted, its compliance certifications, its data-handling reputation. For OAuth-based apps, the API connection to Workspace or 365 reveals every third-party app that users granted access to, which is often a longer and scarier list than the browsing data.

Practical approach for an SMB:

• Pull the OAuth app inventory from your Workspace or 365 admin console first. It is free and takes an afternoon.
• Sort by scope. Any app with broad Drive or mail read access is a priority to review.
• Revoke anything unused, unknown, or from a vendor you cannot verify.
• Publish a short "approved tools" list so people know what to use instead of hunting for free alternatives.

Pro tip: The most common shadow SaaS in Indian SMBs is free PDF and file-conversion websites where staff upload invoices, GST returns and contracts to compress or merge them. Those files sit on unknown servers. Give your team a sanctioned tool and this single change removes a surprising amount of risk.

Which CASB approach fits an Indian SMB budget?

There are three realistic routes. The right one depends on what you already license and how much inline control you want. Rough per-user monthly pricing below is indicative for planning; actual pricing varies with volume and reseller terms.

Option	Best for	What you get	Indicative ₹/user/month	Watch out for
Microsoft Defender for Cloud Apps (via 365 E5 or add-on)	Firms already on Microsoft 365	Strong CASB for the Microsoft stack, shadow IT discovery, session control	~₹500 to ₹1,200 (bundled in E5)	Best value only if you use the wider E5 features; weaker outside Microsoft world
Netskope	Multi-cloud, heavy SaaS use	Deep inline inspection, granular DLP, strong app risk database	~₹700 to ₹1,100	Overkill for a 15-person shop; needs skilled configuration
Zscaler	Distributed teams, secure web access focus	SASE-style approach, good shadow IT and inline control	~₹650 to ₹1,000	Priced and pitched at scale; SMB tiers vary by partner
Google Workspace security (built-in + add-ons)	Workspace-first small teams	DLP, external sharing controls, alert center, context-aware access	Included in Business Plus/Enterprise tiers	Not a full CASB; limited visibility outside Workspace
Cloud-native CSPM (AWS/GCP/Azure tools)	IaaS-heavy firms	Misconfiguration and posture checks for your infrastructure accounts	Usage-based, often a few thousand ₹/month	Covers infrastructure, not SaaS sharing or shadow apps

My honest guidance for most SMBs: if you are already paying for Microsoft 365 Business Premium or moving toward E5, start with Defender for Cloud Apps because you may not need to buy anything extra. If your world is Google Workspace, the built-in DLP and sharing controls plus a light CSPM tool for your AWS or GCP accounts covers 80% of the risk. Only reach for Netskope or Zscaler when you genuinely have complex multi-cloud, distributed teams and dedicated security ownership.

Deciding between these is exactly the kind of thing our IT consulting practice scopes before you commit to a licence. We look at what you already own so you are not double-paying, and if the answer is a broader cloud cleanup, that flows into our cloud migration and managed services work.

How does CASB tie into DPDP Act and data residency compliance?

Security tooling that also ticks compliance boxes is easier to justify to a promoter watching every rupee. A CASB helps on several fronts.

Under the DPDP Act, you are accountable for personal data you process, including breaches caused by careless sharing. A CASB gives you the discovery and controls to demonstrate you actively find and lock down exposed personal data, which matters if you ever have to explain your practices. It also produces audit trails, useful when a larger client or a bank runs a vendor security assessment on you.

On residency, the CASB's app-risk data tells you where a given SaaS stores data. That feeds directly into your residency decisions, especially for sectors with tighter rules. If you handle patient data, read our healthcare cloud compliance guide. And since egress and cross-region data movement have cost as well as compliance implications, our piece on cloud egress fees blowing up SMB budgets pairs well here.

A realistic 30-day rollout plan

Here is how I sequence a first CASB deployment for a typical 30 to 80 person Indian SMB, so you can brief a vendor or run it internally.

1. Days 1 to 3: Inventory what you have. List every cloud account, admin owner, and the licences you already pay for. Decide route from the table above.
2. Days 4 to 7: Connect the CASB in read-only mode to Workspace/365 and to AWS/GCP/Azure via read-only roles. Feed in firewall logs if available.
3. Days 8 to 21: Discovery. Let it build baselines. Do not touch enforcement. Review findings weekly with the person who actually owns the data.
4. Days 22 to 25: Triage and manual remediation of top-severity items: sensitive public files, public buckets, ex-employee accounts, stale keys.
5. Days 26 to 28: Set automated policies and change org-level sharing defaults. Publish the approved-tools list.
6. Days 29 to 30: Document the baseline, set a monthly review cadence, and route alerts to a monitored channel.

If you want alerts pushed somewhere your team genuinely reads, we often wire high-severity notifications into WhatsApp using the WhatsApp Business API, or into internal systems via custom software integrations. And email remains the top breach vector, so pair CASB with the practices in our email security guide for SMBs.

Frequently asked questions

What is the difference between a CASB and a firewall?

A firewall controls network traffic in and out of your network based on ports and IP rules. A CASB understands cloud applications and data: who shared which file with whom, what SaaS apps people use, and whether specific data left a service. They complement each other rather than replace one another.

Do I need a CASB if I only use Google Workspace or Microsoft 365?

You need the visibility a CASB provides, but you may not need a separate product. Both Workspace higher tiers and Microsoft 365 include native DLP, sharing controls and app discovery that cover a lot of ground. A standalone CASB adds value once you run multiple clouds or heavy third-party SaaS.

How much does CASB cloud security cost for a small business in India?

Budget roughly ₹350 to ₹1,200 per user per month depending on the route. If it comes bundled with a Microsoft 365 tier you already need, the marginal cost can be close to zero. Cloud-native posture tools for AWS or GCP are usage-based and often only a few thousand rupees monthly for a small footprint.

Will a CASB slow down my team or block their tools?

Not if you deploy it sensibly. Start in monitor-only mode, learn real workflows, and enforce selectively on genuinely risky behaviour. The friction comes from blunt day-one blocking, which is exactly why you run discovery first.

Can a CASB find files an ex-employee still has access to?

Yes. This is one of its most useful functions. It surfaces files shared externally to specific email addresses and flags accounts that should have been disabled, which is a very common gap in firms with staff turnover.

Does a CASB help with DPDP Act compliance?

It helps you discover and control exposed personal data and produces audit trails, which supports demonstrating reasonable security practices. It is one part of DPDP readiness, alongside consent handling, data mapping and breach processes, not a complete compliance solution by itself.

How long before a CASB shows results?

You usually see meaningful findings within the first week of discovery. A full first cleanup, from connection to remediated crown jewels and enforced policies, fits comfortably in about 30 days for a typical SMB.

Where to start

You do not need an enterprise security team to get real value from CASB cloud security for SMBs. You need a clear-eyed look at what you actually run, a discovery phase that shows you the truth, and the discipline to fix defaults so problems do not regenerate. The logistics firm in Gurgaon went from 312 public files and open buckets to a clean, monitored posture in about five weeks, and the biggest change was not the tool. It was the sharing defaults and the offboarding checklist.

If you would rather not stumble through vendor sales decks and licence tiers alone, that is precisely where we help. Have a look at our full services overview, and if cloud posture is part of a bigger modernisation push, our digital transformation playbook shows how the pieces fit. When you are ready to scope a discovery assessment, get in touch with eDarpan and we will map your risk before you spend a single rupee on new licences.

Image credit: Sad Cartoon versus Technology by Sean Loyless via flickr (BY 2.0), sourced through Openverse.