Application Lists
Identify named web applications by host name, so policy uses terms people understand.
SaaS visibilityApplication control
See and Control the SaaS Apps Your Staff Actually Use
Customer problem
Shadow IT Is Now SaaS
Signing up for a new SaaS tool takes a work email and a few minutes. That is good for productivity, but IT often cannot say which cloud applications people actually use.
Much of it happens from home networks the office gateway never sees, and none of it needs IT approval.
Without an inventory, an owner or consistent control, unapproved tools go unreviewed.
- No inventory of SaaS applications in use
- Personal cloud storage holding work files
- Free tools holding customer details
- Work content pasted into consumer AI assistants
- Unreviewed terms, data location and access controls
- No reliable way to block an app for every user
THE COSGRID SOLUTION
SaaS Visibility From the Device
SecureWebAccess runs on the device through the COSGrid endpoint agent. It shows which web applications users reach and lets you allow or block them by user and group. Policy follows the user, in the office or away from it.
With SecureWebAccess, organisations can
- See which web applications users and devices reach
- Allow, block or bypass named applications
- Set different application rules per user and group
- Export usage logs to their SIEM
- Apply the same policy on office, home and public networks
How It Works
Observe on the Device
Each web request is matched on host name against application and category lists, wherever the user works.
Log With Context
Logs record user, device, host, action, category or application, and the process that made the request.
Review Usage
Export logs to Splunk, Elasticsearch or a CEF tool to review application usage alongside other security data.
Decide and Enforce
Allow, block or bypass applications per user and group, with a default action. Blocked users see a block page.
Key Benefits
Per-Group Control
Give finance, engineering and contractors different application rules, without blanket blocks.
Usage Evidence
Logs show which apps are used, by whom and from which device.
Process Context
See whether a desktop application, rather than a browser, is reaching an unapproved service.
Follows Remote Users
On-device enforcement applies on any network, and keeps the last policy if the policy service is unreachable.
Clear Block Messages
A block page tells users the request was stopped by policy, for fewer support tickets.
Traditional SaaS Visibility vs SecureWebAccess
Traditional SaaS Visibility
- Office gateway sees office traffic only
- Category blocks catch approved and unapproved apps alike
- Rules tied to network location
- Logs show blocks, not usage
- Separate rules for office and remote users
- Hardware filter at each site
SecureWebAccess
- Device agent sees traffic wherever the user works
- Named application lists allow or block specific apps
- Rules tied to users and groups
- Logs show user, device, host, app, action and process
- One central policy on every enrolled device
- On-device enforcement for agent-running devices
Use cases
Built for every SaaS scenario
Find out which apps people actually reach
Review the logged applications to get a list of the web applications users actually reach, grouped by user and device.
Approve one service, block the rest
Approve one file-sharing service and block the others for most staff, while a named group keeps access to a partner's platform.
Allow approved AI assistants only
Allow an approved AI assistant and block others for groups handling sensitive work.
Default-block everything off the reviewed list
Limit a finance or compliance group to a reviewed list of applications, with a default block for everything else.
Who Is This For
Worried about malicious websites too? See "Keep users safe from malicious websites, wherever they work"
- CISOs
- IT Governance Teams
- Compliance & Data Protection Teams
- IT Operations
- SaaS-Heavy Organisations
FAQs
Have a question about SaaS visibility and control?
What is SaaS application visibility?
It is knowing which cloud applications people in your organisation actually use, who uses them and from which devices. It is the first step before deciding which applications to approve or block.
Is SecureWebAccess a CASB? Not an API-mode CASB. SecureWebAccess discovers and filters web applications from the device. It does not connect to SaaS applications through their APIs or inspect data stored inside them.
How does SecureWebAccess find shadow IT? The agent observes web requests on the device and matches host names to application and category lists. Logs record the user, device, application and process, and can be exported to your SIEM for review.
