Forcepoint ONE, DLP, web and email licensing covers how Forcepoint licenses its data security and secure access products. These are the Forcepoint ONE security service edge (SSE) editions, Forcepoint DLP and DSPM, on-premises Web Security and URL Filtering, and the Cloud Web and Cloud Email services. All are sold as Subscriptions under the Subscription Agreement, which grants use “for the Subscription Term” and “solely for Subscriber’s internal business purposes up to the Permitted Capacity”.[2] The Solution Rider, incorporated into the agreement, adds per-product consumption limits and lists what each bundle contains.[1] Catalog proof: Subscriptions are for internal use up to the Permitted Capacity.
Editions
Forcepoint ONE
The Solution Rider lists Forcepoint ONE bundles. Each is licensed per User and includes Essential Support unless the quotation adds Enhanced or Enterprise Support.[1]
| Edition | SKU | Components (cloud, per User) |
|---|---|---|
| Web Security Edition | ONESWG | Web Security; CASB Cloud App Security (inline); RBI Essential |
| Web Security Edition | ONEWEB | Endpoint Web Protection; CASB Cloud App Security (inline); ZTNA protection for 1 app |
| Cloud Security Edition | ONESSE | Web Security; CASB inline; CASB API App scanning 3 App Pack; RBI Essential |
| Cloud Security Edition | ONECLOUD | Endpoint Web Protection; Full ZTNA Private App Security; CASB inline; CASB API 3 App Pack |
| CASB Cloud App Security | no part number given | CASB inline; CASB API App scanning 3 App Pack |
Source for the table: Solution Rider, Solution Bundles and Packaged Offerings.[1] The CASB API bundles for DLP are DLPCAIPCOP (CASB API App Scanning with DLP SSE Applications, for on-premises DLP) and DLPCAIPCLD (CASB API App Scanning with Forcepoint ONE Data Security for Cloud Apps and Web).[1] The Product Life Cycle Policy names further Forcepoint ONE offerings, including CSPM, SSPM, IaaS Scanning, the RBI add-on and Malware Protection. It treats FedRAMP editions as part of the same SaaS life cycle.[7]
Forcepoint DLP
“Starting in version 8.5.1, two core license types are available for Forcepoint DLP: IP Protection and Compliance.”[3]
- IP Protection covers DLP Suite, Cloud Applications, Endpoint, Network and Discover. It includes structured and unstructured data fingerprinting, machine learning classifiers and Incident Risk Ranking with the DLP Analytics Engine.
- Compliance omits those features. It is aimed at “regulatory compliance and data privacy use cases”.
Legacy TRITON AP-DATA and Websense Data licences map to IP Protection. Customers can move from Compliance to IP Protection by buying “IP Protection Upgrade” licences.[3] The Data Loss Protection Suite (IP Protection) package combines DLP Endpoint (per Device) with DLP Discover and DLP Network (per User).[1] Catalog proof: DLP IP Protection and Compliance license types.
Web Security, URL Filtering and email
On-premises Forcepoint Web Security and Forcepoint URL Filtering “are offered on a subscription basis”. The subscription type decides which features are available.[6] The retired Advanced Threat Protection Web and Email Security Editions bundled Web or Email Security, Advanced Malware Detection and 25 Users of Remote Browser Isolation - Selective.[1] Catalog proof: ATP Web Security Edition.
Metrics
The User is the main unit. It means “any person utilizing the network with access to the Products directly or indirectly”, whether employee, temporary employee, customer, contractor or guest. For Cloud Services it can also mean “a separate email address or account”.[2] Two counting allowances apply. “For the Cloud Services email solutions, up to five aliases may be considered one User.” Concurrent browser sessions in selective or targeted isolation mode may not exceed 10% of the Permitted Capacity.[2] Catalog proof: Up to five email aliases count as one User; Isolation browser sessions are capped at 10% of capacity.
User subscriptions convert into Devices inside bundles. In the DLP Suite package, “a Subscription for 1 User translates to a Subscription for 1 Device” for products normally licensed by Device. In the retired Forcepoint Advantage packages, one User translates to two Devices.[1] Catalog proof: Bundled User subscriptions convert to Devices.
DSPM uses the Connector, “a digital repository or system for storing, managing, or retrieving information that is scanned by the Product”.[1] On-premises Web Security uses the subscribed client, counted by IP address, as described below.
Counting / floors
Solution Rider caps (06/26). These caps turn a per-User subscription into one bounded by consumption:[1]
| Service | Monthly limit | If exceeded |
|---|---|---|
| Forcepoint ONE (security access policy enforcement) | Average Bandwidth Use of 0.02 Mbps per unit of capacity; 150% of the Global Average Bandwidth Use | Buy more Subscriptions; above 150%, a bandwidth reduction plan first |
| Cloud Web; CASB | 0.02 Mbps | Termination on 30 days’ notice unless capacity is increased |
| Cloud Email | 10,000 emails per User; 30,000 emails per User | Keep an accurate address list; above 30,000, termination unless capacity is increased |
| Advanced Malware Detection and Protection | 50 files per User (web); 20 (email) | Termination unless capacity is increased |
| Data Security OCR for Cloud DLP (ONEDSOCR, DSOCRCLD) | 420 images per User | Termination unless capacity is increased |
| Remote Browser Interface | 3 GB per User | Termination unless capacity is increased |
Catalog proof: Forcepoint ONE bandwidth is capped at 0.02 Mbps per unit of capacity; Cloud Web and CASB bandwidth above 0.02 Mbps requires more capacity; Cloud Email thresholds of 10,000 and 30,000 emails per User; Sandbox submissions are capped per User; RBI throughput is capped at 3 GB per User per month.
DSPM. For DSPM structured data, Connectors in each 12-month period may not exceed the Order quantity. “Customer may not disconnect a Connector and reconnect it to a different source for purposes of avoiding additional Connector purchases.” DSPM SaaS structured data allows 100 database scans per Connector per year and 25 TB (DSPMSS1) or 100 TB (DSPMSS3) of scanned data a year. Unstructured data, including the DDR add-on, is limited to an average of 30 GB per User per year.[1] Catalog proof: DSPM Connectors are capped and reconnecting counts as new; DSPM SaaS scan and volume limits.
Web Security client counting. The Web Security help explains how clients are counted: “Forcepoint Web Security tracks usage per unique client IP address over a rolling interval. The default interval is 24 hours.” Once the licensed seat count is reached, any additional client IP address is over-subscription. By default that traffic is allowed through without category-based policy and is logged as “exceeded”. An administrator setting can block it instead.[5] The FAQ notes that one machine can be counted more than once. This happens when it gets several IP addresses in a day under short DHCP leases, and “Laptop computers using wireless connections may be counted multiple times”. The FAQ gives a different account of enforcement: it says full Web Security protection continues after the licensed IP level is exceeded.[6] Both pages agree that persistent excess may lead to a request to raise the subscription. Catalog proof: Web Security counts unique client IPs per 24 hours.
Light Users. Light User subscriptions are limited to students, temporary or seasonal workers, guest wifi users, retail workers and manufacturing line workers. Their Internet or email use must not be part of their work function or exceed 5% of an 8-hour day.[1] Catalog proof: Light User subscriptions are restricted to defined populations.
Virtualization & partitioning
The Device definition covers “each computer (whether physical or virtual)”, and each virtual machine running a Product is a Node.[2] For DLP the key restriction is a deployment-level one. “Forcepoint DLP license types (IP Protection and Compliance) cannot be mixed within the same Forcepoint DLP Deployment.” The only exception is the DLP modules inside Forcepoint Email Security and Web Security, which in DLP 8.5.1 and later unlock the full IP Protection feature set.[3] Catalog proof: DLP license types cannot be mixed in one deployment; Each virtual machine running the Product is a Node.
Cloud / BYOL
DLP subscriptions are delivered as an XML subscription file uploaded in the Forcepoint Security Manager. The subscription page shows “the start and expiration dates (or ‘n/a’ if you have a perpetual subscription), the number of subscribed users, and the modules and services to which you subscribe”.[4] The help page therefore allows for perpetual DLP subscriptions, and lists a “Perpetual Forcepoint DLP Suite subscription combined with Forcepoint DLP Cloud Applications” among the licensing options.[3] DLP Cloud Applications, Web Security Cloud and Email Security Cloud licences carry start and termination dates.[3] A Dedicated IP subscription “may be used with only one activation key” for its Cloud Service. Each additional activation key needs its own Dedicated IP subscription.[1] Catalog proof: Dedicated IP is tied to one activation key.
Programs
- Forcepoint Advantage (retired). The Data Advantage tiers (ML1, ML2, EL1 to EL5) and Edge Advantage tiers (ML1, ML2, EL1) bundled DLP, CASB, web, email and NGFW products. They included “Organic Growth” capacity at no additional charge, excluding third-party use and “inorganic corporate growth activity, including mergers, acquisitions, joint ventures, or take-overs”. For 5-year Terms a Virtual Resident Engineer was included. Forcepoint lists these bundles as retired.[1] Catalog proof: Advantage Organic Growth excludes acquisitions and third parties; Data Advantage; Edge Advantage.
- SaaS life cycle. For Forcepoint ONE SaaS, Forcepoint gives 30 to 90 days’ notice of End of Sale. After End of Sale, customers may renew or add seats until End of Life, when subscriptions terminate unless a migration option is offered.[7]
- Restrictions. The Products may not be used “on a ‘service bureau’ basis”, and “Subscriber may not assign more than 20 administrators to administer certain Forcepoint products”.[2] Catalog proof: No hosting, resale or service bureau use.
Out of scope
This article does not cover network security licences (Forcepoint NGFW and FlexEdge SD-WAN licensing), verification and support terms (Forcepoint Subscription Agreement, support and lifecycle), Forcepoint’s insider threat, UEBA or cross-domain products, or prices, which are not published.[2]