You want customers to configure Real-time Protection policies.

Netskope Real-time Protection policy evaluation follows a specific order of precedence to ensure that the most appropriate and security-focused policies are applied first. According to Netskope’s policy documentation, the recommended policy order is Threat policies first, followed by Remote Browser Isolation (RBI) policies, then CASB policies, and finally Web policies. This ordering ensures that potentially malicious content is caught before CASB or web controls are evaluated, and that isolation policies are applied before content categorization rules. This layered order reflects the principle that security intent should take precedence over access decisions. Placing Threat policies last would allow users to interact with malicious content before being blocked, which is operationally unacceptable in a security architecture.