Netskope CASB — Inline + API Data Protection & Shadow IT

① Shadow IT, the CCI score, and what “sanctioned” really means

Walk into any Indian IT shop and ask “how many cloud apps do your staff use?” The honest answer is “far more than we approved.” A team signs up for a free file-share to send a client a large video; someone uses a personal Notion for meeting notes; a developer pushes a snippet to a personal GitHub. None of it went through IT. That sprawl is Shadow IT, and the first job of CASB is simply to see it.

Netskope discovers apps two ways. From inline traffic it sees apps live as users touch them; from imported firewall/proxy logs it discovers apps even before steering is fully rolled out. Every discovered app is matched against the Cloud Confidence Index (CCI) — a database of 85,000+ cloud apps (plus hundreds of GenAI tools) each scored from 1 to 100 across 50-plus enterprise-readiness attributes adapted from the Cloud Security Alliance.

That 1–100 number rolls up into a Cloud Confidence Level (CCL) band. Think of it like a restaurant hygiene rating posted before you eat there: Excellent (90–100), High (75–89), Medium (60–74), Low (50–59), Poor (below 50). An L1 analyst uses the band to triage — a Poor app handling client PII gets escalated; an Excellent one used by a few people might just get sanctioned.

Now the word that trips up every newcomer. Sanctioned just means “approved by your organisation’s policy” — it is an admin tag you apply in the catalog. It is not the same as Managed, which means your org owns the tenant and can grant Netskope OAuth access to its API. The two are independent axes: you can have a sanctioned-but-unmanaged app (a team’s approved-but-self-signed-up Trello) and even an unsanctioned-but-managed corner case. Mixing these up is the single most common CASB confusion.

Four CASB words to never mix up

Tap each — these four decide which control you can actually apply.

② App instances — your corporate Drive vs someone’s personal one

Here is the problem a plain web filter cannot solve. Priya at ICICI is told: “let staff use our corporate Google Drive, but stop them copying client data into their personal Google Drive.” Both are drive.google.com. Block the domain and you kill the business; allow it and the leak is wide open. You need to tell the two tenants apart.

Netskope does this with an app instance. Think of “Google Drive” as a bank brand; your corporate Drive and an employee’s personal Drive are two branches (instances) of that brand. Each instance has an Instance ID. Once you tag the corporate instance Sanctioned and personal as Unsanctioned, your policy can target just the personal one.

There are two ways to tag an instance, and both need an Inline CASB licence. Method 1 (from a discovered app): go to Skope IT → Applications, pick the app Netskope has already seen in traffic, and choose New App Instance. Method 2 (define it up front): go to Policies → Profiles → App Instance → New Custom App Instance → New App Instance and fill in the fields manually. Either way you set the Instance ID, Instance Name, and Tag, then Save.

One catch to remember for the exam and the lab: the App Instance Tag is only selectable as a policy destination when the destination is Any Web Traffic, a Category, or a Cloud App — and it needs the Inline CASB licence. Also, some traffic has no real tenant (a public share link, an unauthenticated request, a service account): Netskope gives these a placeholder Instance ID, so don’t write a per-tenant rule expecting a real corporate ID there.

③ Inline vs API — stop it live, or clean what’s already inside

CASB enforces in two completely different ways, and knowing which to reach for is the heart of this lesson. Inline CASB is in-band: traffic is steered through Netskope’s forward proxy, so it sees activity as it happens and can block, coach or allow in real time. API Data Protection is out-of-band: Netskope holds a delegated OAuth grant into a managed SaaS tenant and inspects data at rest already inside the app.

The cleanest analogy: inline is the security guard at the office door, checking every person and parcel in real time as they enter and leave. API is the night auditor who walks the filing room after hours, reviewing documents already stored inside. The guard can stop you mid-step; the auditor can’t — but the auditor finds what’s already there. You want both.

A second, sharper rule: API needs a managed app. Because it works through the SaaS provider’s API with an admin OAuth grant, it only works where your org owns the tenant — Microsoft 365, Google Workspace, Salesforce, Box and similar. A sanctioned-but-unmanaged app can’t be API-scanned at all; inline is your only lever there. (Heads-up if you administer M365: Microsoft apps sometimes need an OAuth re-grant after permission changes, or the connector quietly stops scanning.)

④ Build it: block personal-instance uploads, keep corporate working

Now we put the three ideas together into one real Real-time Protection policy — the exact screen you’ll touch on day one. The goal: staff can use the corporate instance freely, but uploading client data to a personal instance of the same app is blocked with a coaching page. The build order matches the console fields top to bottom.

Read the fields like a sentence: who (Source — Users / Groups / OUs, with optional Exclusions), to where (Destination — a Cloud App, Category, App Instance tag, or Private App Segment), doing what (Activities & Constraints — Upload, Download, Edit, Share, Post, with constraints like File Size / File Type), checked by which profile (a DLP or threat profile), with what governed activity action (Alert, Block, Quarantine, User Alert/Coach, Allow). Name it, optionally add Email + a Policy Schedule, and Save.

Skope IT > Events > Application Events
Filter:  user = karthik.r@icici  AND  app = "Google Drive"
         AND  instance = personal  AND  activity = Upload

timestamp           user        app           instance   activity  action  policy
2026-06-05 14:22:07  karthik.r   Google Drive  personal   Upload    block   Block-Personal-GDrive-PII
2026-06-05 14:25:51  karthik.r   Google Drive  corporate  Upload    allow   —

The personal-instance upload shows action=block with your policy name; the corporate upload is allowed. If the personal row shows instance=Untagged, your App Instance Profile is missing — fix the tag first.