Cloud & DevOpsNote
14 of 20 SSE products sell a CASB; only Netskope puts it in the base tier
How many SASE and SSE products offer a CASB, how many include it in the base price, and which keep logs in India, counted as of September 2026.
A CASB is now a module, not a product, and it is rarely in the price you were first quoted. Of the 20 SASE and SSE products in TechBag’s guide at the end of September 2026, 14 offer a cloud access security broker. One, Netskope One SSE, includes it in the base tier. The other 13 sell it as a higher edition or an add-on.1
Our 2024 version of this post explained what a CASB does: finds the shadow SaaS your staff use, stops sensitive data leaving through it, and checks the settings of the SaaS you do sanction. That explanation still holds. What changed is how it is sold, and that is what decides the bill.
01Offered by 14, bundled by one
CASB and DLP are on offer from 14 of 20 products, but only one puts CASB in the base tier and none puts DLP there
SASE and SSE products offering each module, and including it in the base tier, of 20 in TechBag's guide, 30 September 2026
- In the base tier
- Higher edition or add-on
- Not offered
Table view
| In the base tier | Higher edition or add-on | Not offered | |
|---|---|---|---|
| Web gateway | 17 | 1 | 2 |
| ZTNA | 15 | 1 | 4 |
| CASB | 1 | 13 | 6 |
| DLP | 0 | 14 | 6 |
| Firewall | 7 | 3 | 10 |
| Isolation | 0 | 6 | 14 |
Source: TechBag SASE & SSE guide, modules and bundled fields per product; TechBag count · as of 30 September 2026
The web gateway and zero-trust access are what the base tier buys almost everywhere. CASB, DLP and browser isolation are where quotes diverge from the demo. Zscaler’s base edition is the gateway, with CASB and DLP sold as higher editions or add-ons; Cloudflare One is free for up to 50 users and US$7 a user a month after that, but expanded CASB and custom DLP arrive only in the quoted Enterprise tier.1
02The third job is usually a separate purchase
The 2024 post’s third area, SaaS posture management, is now mostly sold as its own category. CrowdStrike’s Falcon Shield, built on the Adaptive Shield acquisition, watches misconfigurations, over-permissioned identities and third-party app connections across SaaS tenants.2 For an all-Microsoft estate, Defender for Cloud Apps is the CASB already inside the Defender XDR family.3 Check what you already own before you price a new module.
03In India, ask where the logs sit
Of the 14 CASB products, seven document named Indian points of presence and two more an India region. Only two, both Netskope’s, document that logs and the management plane stay in India; Netskope records a Mumbai management plane for DPDP-aligned residency.1 That is the question that bites: CERT-In’s Directions of 28 April 2022 require ICT system logs to be kept for 180 days within Indian jurisdiction, and a CASB’s activity log is exactly the record an incident report needs.4 The DPDP Rules, notified on 13 November 2025, bring their security-safeguard and breach-notice duties into force on 13 May 2027.5 Prices in this category are in US dollars per user; TechBag quotes them in INR, and 18% GST applies on top. Banks and SEBI-regulated entities should map the vendor’s log location to their own regulator’s rules before signing.
Sources
- TechBag, SASE & SSE guide: 20 products by module, base-tier bundle, India PoPs and in-country logs — vendor-doc-verified 22 August 2026; counted as at 30 September 2026
- TechBag, CrowdStrike Falcon Shield intel page (SaaS security posture, built on Adaptive Shield) — page as at 30 September 2026
- TechBag, Microsoft Defender for Endpoint intel page (the Defender XDR family, including Defender for Cloud Apps) — page as at 30 September 2026
- CERT-In, Directions under section 70B(6) of the IT Act, 2000 (180-day logs within Indian jurisdiction; six-hour reporting) — 28 April 2022
- Legismith Partners, DPDP Rules 2025 commencement timeline — Rules notified 13 November 2025
Related on TechBag: the Netskope CASB intel page covers inline and API modes and instance awareness.
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
