--- title: "14 of 20 SSE products sell a CASB; only Netskope puts it in the base tier" summary: "How many SASE and SSE products offer a CASB, how many include it in the base price, and which keep logs in India, counted as of September 2026." url: https://www.thetechbag.com/blog/casb-securing-cloud format: Note desk: "Cloud & DevOps" published: 2026-06-17 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["CASB","SSE","SASE","shadow IT","DLP","SSPM","Netskope","Zscaler","Cloudflare","CERT-In","DPDP"] cover: https://www.thetechbag.com/blog/covers/casb-securing-cloud.png --- # 14 of 20 SSE products sell a CASB; only Netskope puts it in the base tier *How many SASE and SSE products offer a CASB, how many include it in the base price, and which keep logs in India, counted as of September 2026.* Note · Cloud & DevOps · By TechBag · Published 2026-06-17 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/casb-securing-cloud A CASB is now a module, not a product, and it is rarely in the price you were first quoted. Of the 20 SASE and SSE products in TechBag’s guide at the end of September 2026, 14 offer a cloud access security broker. One, Netskope One SSE, includes it in the base tier. The other 13 sell it as a higher edition or an add-on.[1] Our 2024 version of this post explained what a CASB does: finds the shadow SaaS your staff use, stops sensitive data leaving through it, and checks the settings of the SaaS you do sanction. That explanation still holds. What changed is how it is sold, and that is what decides the bill. ## Offered by 14, bundled by one **Figure: CASB and DLP are on offer from 14 of 20 products, but only one puts CASB in the base tier and none puts DLP there** *SASE and SSE products offering each module, and including it in the base tier, of 20 in TechBag's guide, 30 September 2026* Web gateway 17 20 products ZTNA 15 4 20 products CASB 13 6 20 products DLP 14 6 20 products Firewall 7 3 10 20 products Isolation 6 14 20 products | | In the base tier | Higher edition or add-on | Not offered | | --- | --- | --- | --- | | Web gateway | 17 | 1 | 2 | | ZTNA | 15 | 1 | 4 | | CASB | 1 | 13 | 6 | | DLP | 0 | 14 | 6 | | Firewall | 7 | 3 | 10 | | Isolation | 0 | 6 | 14 | Source: TechBag SASE & SSE guide, modules and bundled fields per product; TechBag count · as of 30 September 2026 The web gateway and zero-trust access are what the base tier buys almost everywhere. CASB, DLP and browser isolation are where quotes diverge from the demo. Zscaler’s base edition is the gateway, with CASB and DLP sold as higher editions or add-ons; Cloudflare One is free for up to 50 users and US$7 a user a month after that, but expanded CASB and custom DLP arrive only in the quoted Enterprise tier.[1] TechBag countHow we counted A product “offers” a module when the guide lists it as documented and available, bundled or licensed; it is “in the base tier” when the guide records it as included without a separate SKU. The 14 CASB products come from nine vendors: Zscaler, Netskope, Palo Alto Networks, Fortinet, Cisco, Cloudflare, Versa, Cato and Trend Micro.[1] ## The third job is usually a separate purchase The 2024 post’s third area, SaaS posture management, is now mostly sold as its own category. CrowdStrike’s Falcon Shield, built on the Adaptive Shield acquisition, watches misconfigurations, over-permissioned identities and third-party app connections across SaaS tenants.[2] For an all-Microsoft estate, Defender for Cloud Apps is the CASB already inside the Defender XDR family.[3] Check what you already own before you price a new module. Our view Ask every vendor for three line items: CASB, DLP and the edition that contains both. A quote that says “SSE platform” and nothing else is pricing the gateway you saw in the demo, not the data protection you bought it for. ## In India, ask where the logs sit Of the 14 CASB products, seven document named Indian points of presence and two more an India region. Only two, both Netskope’s, document that logs and the management plane stay in India; Netskope records a Mumbai management plane for DPDP-aligned residency.[1] That is the question that bites: CERT-In’s Directions of 28 April 2022 require ICT system logs to be kept for 180 days within Indian jurisdiction, and a CASB’s activity log is exactly the record an incident report needs.[4] The DPDP Rules, notified on 13 November 2025, bring their security-safeguard and breach-notice duties into force on 13 May 2027.[5] Prices in this category are in US dollars per user; TechBag quotes them in INR, and 18% GST applies on top. Banks and SEBI-regulated entities should map the vendor’s log location to their own regulator’s rules before signing. How we did this Figures as of 30 September 2026 All counts are TechBag counts of the SASE & SSE guide as committed on 30 September 2026 (20 products, 11 vendors; vendor documentation verified 22 August 2026). Zscaler Digital Experience lists no security module and counts as offering none. India points of presence and log storage are counted only where the guide records vendor documentation; “not documented” is not “absent”. Standalone CASB and SSPM products outside the guide (Skyhigh Security, Microsoft Defender for Cloud Apps, Falcon Shield) are not in the count. Prices are those recorded in the guide; none were re-fetched for this rewrite. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [TechBag, SASE & SSE guide: 20 products by module, base-tier bundle, India PoPs and in-country logs](https://www.thetechbag.com/browse/network-security-sase/sase-sse) — vendor-doc-verified 22 August 2026; counted as at 30 September 2026 2. [TechBag, CrowdStrike Falcon Shield intel page (SaaS security posture, built on Adaptive Shield)](https://www.thetechbag.com/crowdstrike/crowdstrike-falcon-shield) — page as at 30 September 2026 3. [TechBag, Microsoft Defender for Endpoint intel page (the Defender XDR family, including Defender for Cloud Apps)](https://www.thetechbag.com/microsoft/microsoft-defender-for-endpoint) — page as at 30 September 2026 4. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (180-day logs within Indian jurisdiction; six-hour reporting)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 5. [Legismith Partners, DPDP Rules 2025 commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — Rules notified 13 November 2025 Related on TechBag: the [Netskope CASB intel page](https://www.thetechbag.com/netskope/netskope-casb) covers inline and API modes and instance awareness. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [SASE & SSE guide](https://www.thetechbag.com/browse/network-security-sase/sase-sse) — 20 products by module, base-tier bundle and India PoPs - [Netskope CASB](https://www.thetechbag.com/netskope/netskope-casb) — inline and API modes, instance awareness, Mumbai management plane - [Cloudflare One (Zero Trust)](https://www.thetechbag.com/cloudflare/cloudflare-one-zero-trust) — free to 50 users; expanded CASB at Enterprise