Cloud access security broker systems and methods for active user identification and load balancing

A system associated with a Cloud Access Security Broker (CASB) system, comprising:

• one or more processors and memory storing instructions that, when executed, cause the one or more processors to
• cause a scan by the CASB system of a plurality of users associated with a tenant in a Software-as-a-Service (SaaS) application where the scan includes any of malware identification in content in the SaaS application and confidential data identification in the content in the SaaS application;
• during the scan which is covering historical data in the SaaS application, receive notifications of the content being actively modified by any of the plurality of users via webhooks from the SaaS application, wherein the webhooks is configured to identify real-time modification of the content;
• and
• include the content being actively modified in the scan with the historical data.

A method comprising:

• causing a scan by Cloud Access Security Broker (CASB) system of a plurality of users associated with a tenant in a Software-as-a-Service (SaaS) application where the scan includes any of identifying malware in content in the SaaS application and identifying confidential data in the content in the SaaS application;
• during the scan which is covering historical data in the SaaS application, receiving notifications of the content being actively modified by any of the plurality of users via webhooks from the SaaS application, wherein the webhooks is configured to identify real-time modification of the context;
• and
• including the content being actively modified in the scan with the historical data.