Forcepoint licensing is the set of terms under which Forcepoint licenses its security software. The portfolio covers data loss prevention (DLP), data security posture management (DSPM), web and email security, the Forcepoint ONE security service edge platform (secure web gateway, CASB, ZTNA and remote browser isolation), and the network security line of next-generation firewalls (NGFW), FlexEdge Secure SD-WAN and the Security Management Center (SMC).[4]
Forcepoint publishes separate end-user terms for its products: a Subscription Agreement, a Network Security EULA, a Solution Rider, a Technical Support Description, a Cloud/SaaS Service Level Agreement and a Mobile App Subscription Agreement.[1] Two of these carry the licence grant:
- The Subscription Agreement covers most products. Its counterparty is Forcepoint LLC (Austin, Texas), Forcepoint International Technology Limited (Cork) or an affiliate named in the Order.[2]
- The Network Security Products License Agreement covers NGFW and related products. Its counterparty is Forcepoint Quarry Solutions LLC or Forcepoint Quarry Solutions Limited.[3]
The Solution Rider is incorporated into both agreements. It adds product-specific consumption limits and lists the contents of bundles.[4]
The Subscription Agreement grants a Subscription, “a limited, non-exclusive, personal, nontransferable right to use the Products”. It runs for the Subscription Term “solely for Subscriber’s internal business purposes up to the Permitted Capacity”.[2] The Network Security EULA grants a License for the License Term, together with Maintenance and, where applicable, a Subscription.[3] Catalog proof: Subscriptions are for internal use up to the Permitted Capacity.
Editions
Forcepoint publishes no price list. The Solution Rider and product documentation show how each line is packaged and counted.
| Product line | How it is licensed | Deeper article |
|---|---|---|
| Forcepoint ONE (Web Security Edition, Cloud Security Edition, CASB Cloud App Security) | Subscription per User, with bandwidth caps[4] | Forcepoint ONE, DLP, web and email licensing |
| Forcepoint DLP (Suite, Endpoint, Network, Discover, Cloud Applications) | Per User or Device, as IP Protection or Compliance licence types[7] | same |
| Forcepoint DSPM | Per Connector, with scan and volume limits[4] | same |
| Web Security and URL Filtering (on-premises) | Subscribed clients, counted by IP address per day[8] | same |
| Cloud Email, Cloud Web | Per User, with email and bandwidth caps[4] | same |
| NGFW, Security Management Center | Licence per SMC server and Engine node; appliances per Unit[9] | NGFW and FlexEdge SD-WAN licensing |
| FlexEdge Secure SD-WAN | Bundles of 1 appliance Unit, 1 manager Node and 12 months of support[4] | same |
Metrics
Both agreements measure use against a Permitted Capacity. In the Subscription Agreement it is “the number of Devices, Nodes, Seats, Throughput, Users, or other license metrics as set forth in the Order or in the Solution Rider”.[2] The Network Security EULA adds Units.[3]
| Metric | Catalog row | Notes |
|---|---|---|
| User | User | Any person using the network with access to the Products: employees, temporary employees, customers, contractors and guests. For Cloud Services, a separate email address or account |
| Device or Seat | Device / Seat | Each physical or virtual computer or device authorized to use the Products |
| Node | Node | Any device that processes data. “each virtual machine or instance running the Product is a Node” |
| Hardware Unit | Hardware Unit | “a single instance of computer hardware purchased from Forcepoint” |
| Throughput | Throughput | Gigabytes per calendar month through the Cloud Services |
| Consumption caps | Average Bandwidth Use, Emails processed per User, Sandbox files, DSPM Connector | Set in the Solution Rider |
| Client IP address | Subscribed client (IP address) | On-premises Web Security and URL Filtering |
| NGFW licence | NGFW Engine node license | One per SMC server and Engine node |
Sources for the table: the Subscription Agreement and Network Security EULA definitions for the first five rows, the Solution Rider for the caps, and the product help for the last two rows.[2][3][4][8][9]
The User definition is broad. It includes customers, contractors and guests who use the network, not only employees.[2] The Solution Rider defines a narrower Light User. It is limited to students, temporary or seasonal workers, guest wifi users, retail workers and manufacturing line workers whose Internet or email use is not part of their work or exceeds “5% of any 8-hour day”.[4] Catalog proof: Light User subscriptions are restricted to defined populations.
Counting / floors
Commitment and overage (Subscription Agreement, 01/26). “The Permitted Capacity provided in the Order(s) represents the amounts that Subscriber has committed to for the Subscription Term.” If use exceeds it, “Subscriber must purchase additional Permitted Capacity sufficient to cover the excess use, including for the balance of the then-current Subscription Term”.[2] Orders are non-cancellable, with “no fee adjustments or refunds for any reason, including decreases in usage”.[2] Capacity can therefore go up during a term but not down. Catalog proof: Excess use must be bought for the rest of the term; Orders are non-cancellable with no refunds for lower usage.
Consumption caps (Solution Rider, 06/26). Several cloud services carry per-user limits. Forcepoint ONE and Cloud Web allow an average of 0.02 Mbps per unit of Permitted Capacity per month. Cloud Email triggers obligations at 10,000 and 30,000 emails per User per month. Sandbox analysis is limited to 50 files per User per month for web and 20 for email. RBI is limited to 3 GB per User per month. Above these limits the customer must buy more capacity, or Forcepoint may terminate the affected subscription on 30 days’ notice.[4] Catalog proof: Forcepoint ONE bandwidth is capped at 0.02 Mbps per unit of capacity; Cloud Email thresholds of 10,000 and 30,000 emails per User.
Verification. The customer must keep “records sufficient to track its compliance”. During the Subscription Term “and one year thereafter”, Forcepoint or its independent auditor may review records, facilities, systems and personnel. If fees are due, the customer reimburses the verification cost and pays at “then-current list price without any discounts or prior pricing terms”. Products may include “a license manager component to track usage”, which the customer must not disable.[2] Catalog proof: Verification during the term and one year after, at list price; License manager components must not be disabled.
Virtualization & partitioning
Forcepoint counts virtual machines like physical ones. Under both agreements, “each virtual machine or instance running the Product” is a Node, or a Device or Node in the Network Security EULA.[2][3] For NGFW, “Virtual NGFW Engines do not require their own licenses”. Each SMC server and each physical Engine node, including Master NGFW Engines, needs its own licence.[9] No processor, core or host-based rule appears in the agreements. Catalog proof: Each virtual machine running the Product is a Node; Each SMC server and NGFW Engine node needs a licence.
Cloud / BYOL
Cloud Services are subscriptions hosted by Forcepoint. Service levels are set by the Cloud Services SLA, which is incorporated by reference.[2] On-premises Products may be moved “for use on a different server within its location”. Copies are allowed only for backup and internal testing.[2] The NGFW documentation distinguishes AWS images: engines from the Bring Your Own License image need a licence in the SMC, while engines from the hourly image do not.[10] That detail is covered in Forcepoint NGFW and FlexEdge SD-WAN licensing.
Programs
- Evaluations. Evaluation subscriptions run “for a period of up to 30 days”. They may be used only to decide on a purchase and are provided as is.[2] Catalog proof: Evaluation and limited availability subscriptions.
- Technical Support. There are three programs: Essential, Enhanced and Enterprise Support. Network security hardware support requires a valid support enrolment.[5] Catalog proof: Forcepoint Technical Support (Essential, Enhanced, Enterprise).
- Renewal. Unless the Order says otherwise, fees after the Subscription Term are at “Forcepoint’s then-current list price”. A subscription renewed after it lapsed must include fees for the lapsed period.[2] Catalog proof: Post-term fees revert to list price unless the Order says otherwise; Late renewals pay for the lapsed period.
- Forcepoint Advantage (retired). The Data Advantage and Edge Advantage packages included “Organic Growth” capacity at no extra charge. Growth from mergers, acquisitions and third parties was excluded.[4] Catalog proof: Forcepoint Data Advantage and Edge Advantage (retired).
- Life cycle. Forcepoint gives 90 days’ notice of End of Sale for commercial software and appliances.[6] Catalog proof: Software End of Sale gets 90 days' notice.
Details of these programs are in Forcepoint Subscription Agreement, support and lifecycle.
Out of scope
This article does not cover the Mobile App Subscription Agreement, Forcepoint’s government products or cross-domain solutions, professional services, or the channel partner programme. Prices are set in the Order with Forcepoint or an authorized reseller and are not published.[2]