Netskope updated its secure access service edge (SASE) platform with features including a new cloud-delivered firewall and its own remote browser isolation (RBI) technology from its recent Randed acquisition.

Additionally, fresh off its $7.5 billion valuation, the cybersecurity unicorn added features to its zero trust network access (ZTNA) technology that connects corporate users, partners, and third-party suppliers to private resources using the Netskope client or browser access for private web applications instead of giving them access to the network, thus reducing risk.

And it also rolled out security posture management for software-as-a-service (SaaS) apps beginning with Office 365, Salesforce, and GitHub support.

In an exclusive interview, Netskope VP Sasi Murthy said the updates to Netskope Security Cloud will help the vendor deliver on the promise of easy, secure access for all users. “You can make explicit decisions now about that zero-trust access, whether it’s to a managed app, or whether it’s to the latest marketing app that some companies using as an unmanaged, shadow IT, or to specific services that you want to place firewall controls on,” she explained. “All of those capabilities now can be defined on the Netskope platform for users to access anything.”

The second part of the promise involves improving security posture management, “meaning: managing your attack surface with the right policy controls across everything,” Murthy said.

Netskope CEO Sanjay Beri likes to say that the security startup he founded in 2012 was SASE before the term SASE existed. Gartner first coined the phrase in 2019, and said it includes ZTNA, cloud access security broker (CASB), secure web gateway (SWG), cloud-based firewalls, along with networking and edge computing. This enables identity-based access to workloads running anywhere in the network based on real-time context, security, and compliance policies.

While Netskope got its start as one of the original CASBs, it had been building or acquiring these other SASE security functions, and it began deploying its edge-cloud security infrastructure right before Gartner gave this distributed security networking architecture a name.

Today’s SASE updates span five areas: cloud firewall, ZTNA, RBI, SaaS security posture management, and NewEdge, which is Netskope’s security private cloud. The new Netskope Cloud Firewall is arguably the most significant because until now, the Security Cloud platform didn’t have one.

Firewall-as-a-service is a key SASE piece, and in a March report Gartner forecasts that by 2024, 30% of enterprises will adopt cloud-delivered SWG, CASB, ZTNA, and branch-office firewall-as-a-service capabilities from the same vendor. That’s up from less than 5% in 2020. As of today, Netskope claims all of these cloud-delivered capabilities via its SASE platform.

“The addition of Cloud Firewall for all ports and protocols is a net-new offering and is natively built on our platform to provide explicit configuration for users to access basically all apps, web, or services with firewall-type policies,” Murthy said.

It provides network security for all outbound ports and protocols for direct-to-internet access using the Netskope client on managed devices or via GRE and IPsec tunnels for offices. Users get so-called “5-tuple policy controls” — these refer to five items (source and destination IP, source and destination port, and protocol) that each rule (tuple) in a firewall policy uses to either block our allow traffic. “So you’re explicitly defining, both on the source side and the destination side IP and ports what you’re going to allow, and the protocol,” Murthy explained.

And because Cloud Firewall is fully integrated into the Netskope Security Cloud, it provides centralized access control, which simplifies management for users and branch offices via one console, one policy engine, and one security platform, she added. “You’re using the same agent, you don’t deploy anything new, you’re just getting these additional controls exposed now on your deployment,” Murthy said.

The second piece of the update centers on RBI. Previously, Netskope integrated Ericom’s RBI into its secure web gateway to provide these capabilities. However, thanks to an under-the-radar acquisition of Madrid-based isolation and security startup Randed last year, Netskope now offers its own isolation technology integrated into its SASE platform.

RBI technology protects users from inadvertently downloading malicious code by running a web app in a sandbox — as opposed to downloading it onto a users’ endpoint — without any disruption to the user experience.

“So we are natively firing what we call our single-pass policy,” Murthy said. “So if we have data policies or threat policies, they get applied to everything, whether it’s web or email or SaaS. Native RBI replaces the OEM of Ericom.”

Netskope also added SaaS security posture management via another quiet acquisition (Kloudless) that it made in January. This new capability extends Netskope’s CASB to help identify and fix risky SaaS configurations, users, and connected applications. Originally, this feature supports Office 365, Salesforce, and GitHub.

By updating its ZTNA to limit access to the corporate network and instead allowing users to access apps via the Netskope client or browser isolation, Netskope helps organizations reduce their attack surface, Murthy explained. For example, an organization might want to give customers or third-party vendors access to some applications, but also set strict limits about whether they can upload information to or exfiltrate data from those apps.

“You’ve got very explicit access into a private application, but then the next step has to be: What is the degree of trust, or what is the degree of activities that we allow people to do within an application, and that isn’t just for private apps, that’s for any apps,” she said.

And finally, Netskope expanded its NewEdge service level agreements (SLAs). NewEdge, which the vendor claims is the world’s largest connected security private cloud, now boasts five-nines (99.999%) uptime and availability SLAs for its inline services including SWG, CASB, network packet analysis, and custom firmware. These expanded SLAs address traffic processing latency and transparency within all NewEdge data centers, Murthy said.