A CASB controls the use of SaaS applications. In 2026, FortiCASB provides the API CASB for FortiGuard CASB and FortiSASE, complemented by inline mode.
A CASB (Cloud Access Security Broker) gives an organisation visibility and control over the use of cloud applications: which services are used, what data is stored and shared in them, and whether their configuration complies with security rules. At Fortinet, FortiCASB is the API-based CASB service. In 2026, it is no longer presented as a standalone offering: it forms the API part of the FortiGuard CASB service and powers the "API-based CASB" feature of FortiSASE, while inline control is provided by FortiGate, FortiSASE and FortiClient.
The growing adoption of SaaS applications (email, storage, collaboration, CRM) inevitably moves part of the data outside the perimeter controlled by the firewall. A CASB addresses four main needs:
There are two different ways to implement a CASB, and they do not answer the same questions, which is why they are often combined.
API mode connects directly to SaaS applications through their programming interfaces, using OAuth 2.0 authentication. It works out of band: it is not in the path of user traffic and therefore has no impact on performance. It sees the data already stored in the service, the sharing settings and the configurations, regardless of where the user connected from. On the other hand, it acts after the fact and depends on the APIs made available by each SaaS provider.
Inline mode inspects traffic in real time, at the level of a firewall, a proxy or a SASE service. It can block an action as it happens, for example an upload to personal storage. However, it requires SSL/TLS decryption of the traffic and only sees what passes through the control point.
At the time of writing, we have found no end-of-life announcement for FortiCASB in Fortinet's public sources; its documentation is still published and updated. Its positioning within the product range, however, has clearly changed:
In practice, when you start a new project, the Fortinet CASB offering should now be approached as a function of the SASE platform and the Security Fabric rather than as a standalone product. Before making any commitment, check the commercial status and support dates in the "Product Life Cycle" portal of Fortinet support, which is the authoritative source.
Whatever solution you ultimately choose, the overall approach remains essentially the same:
Today, a CASB is no longer regarded as a standalone tool that works on its own. It is one of the building blocks of SASE, alongside the secure web gateway, ZTNA and firewall as a service. It complements the Zero Trust approach: after controlling who accesses an application, it controls what is done with the data once access has been granted.
Cloud application security requires an understanding of shared responsibility models, data governance and provider mechanisms. Preparation for CSA CCSK v5 covers these fundamentals in a vendor-neutral way, and ISC2 CCSP goes deeper into cloud security architecture and operations. For data protection in the Microsoft 365 ecosystem, Microsoft SC-401 covers classification and data loss prevention.
FortiCASB has not disappeared, but it is now part of a broader offering: the API CASB within the FortiGuard CASB service and FortiSASE, complemented by the inline CASB of FortiGate and FortiClient. For security teams, the key point is to combine both modes in order to see both the data already stored in the cloud and the real-time flows.