Netskope licensing covers the Netskope One platform, a set of cloud-delivered security and networking services that includes the Secure Web Gateway and Next Gen Secure Web Gateway (NG SWG), Cloud Inline and API-based CASB, Cloud Firewall, Remote Browser Isolation, zero trust private access, data security posture management, SD-WAN, network on-ramps to the NewEdge data centers and a newer family of AI security services. The contract that governs all of them is the Netskope Subscription Services Agreement (SSA), which covers the cloud services and any related hardware, software, implementation and support.[1] Under the SSA a Subscription is permission to use the Services “as limited by the Subscription Period and Subscription Units purchased”, and the Subscription Units themselves are defined on a separate public page, the Subscription Service Charges Document, fixed as of the date of each Order.[1][2] Netskope also publishes per-product licensing terms in its technical documentation, which define the unit of measure, pooling, measurement method and overage remedy for individual services.[3][4] This article summarises the whole estate; the articles under See also cover each construct in detail.
Editions
Netskope does not publish a price list or a public edition matrix. Services are bought as SKUs on a quotation and, unless Netskope agrees otherwise, through an authorised reseller or cloud marketplace; the reseller sets prices and payment terms, while the Netskope agreement governs everything else.[1] The Service Charges Document groups the SKU families by how they are charged:[2]
| Service family | SKU prefixes named by Netskope | Charged per | Detail article |
|---|---|---|---|
| SWG, NG SWG, Cloud Inline, Firewall, RBI, ZTNA and related inline services | NK-P-SSEPA-, NK-P-SSE-, NK-P-NGSWG-STD/ENT/PRF/RBI, NK-P-CLDINL-, NK-CFW-, NK-DNS, NK-NPA-, NK-ZTNXTL7, NK-PDEM, NK-NAA-, NK-NG-, NK-EP, NK-EMAIL | User | Subscription units and true-up |
| Machine traffic and guest WiFi | NK-NG-SWG-MACH, NK-NG-SWG-C-MACH, NK-NG-SWG-WIFI- | GB per month | same |
| China Elite and China Premium | NK-NGSWG-CN-ELT, NK-NGSWG-CN-PRM | User plus 5 GB per month | same |
| CASB API and API Introspection | NK-P-CBAPI- | Seat (or User) and TB | CASB API, DSPM and posture licensing |
| DSPM, SSPM, IaaS storage scan, IaaS Protection, CSPM | NK-DSPM-, NK-SSPM-, NK-IAAS-SS-, NK-P-IAASPRT-PRF, NK-CSPM-ACT, NK-CSPM- | Data store, Seat, GB, Account, Resource | same |
The document lists these prefixes without expanding the suffixes, so the letters STD, ENT and PRF on NG SWG SKUs identify packages whose contents are set in the quotation rather than in a public document.[2] Private Access packages likewise differ in their allocation of Application Segments, which “is specified in the Netskope quotation”.[3] The inline SKU families are recorded in the catalog as Inline per-User services (SWG, NG SWG, Cloud Inline, Firewall, RBI, ZTNA), with separate rows for NG SWG Machine Traffic, NG SWG Guest WiFi, CASB API and API Introspection, DSPM data store and the other families.
Services added more recently have their own licensing terms on docs.netskope.com: Netskope One Private Access, Enterprise Browser, DNSaaS, High-Capacity Tunnels, NewEdge Express Connect, CASB API, AI Guardrails, AI Gateway, Agentic Broker, AI Command Center, AI Red Teaming and DataSec Command Center.[3][5][6][7] The Netskope One SD-WAN licensing terms are listed on the same index but sit behind a customer login; SD-WAN hardware is governed publicly by the Hardware Terms and the SD-WAN Life Cycle Policy.[8][9]
Metrics
The metrics recorded in the catalog are:
- User, the dominant metric: “each individual” authorised to use the customer’s systems whose use is monitored by or accessed through the Services, counted once regardless of devices.[2]
- Seat and TB of Retroactive Scan for CASB API; GB (data processed or scanned), Account (cloud), Resource and Data store (DSPM) for machine traffic, IaaS scanning, CSPM and DSPM.[2][4]
- China Elite / China Premium unit for the Mainland China services.[2]
- Light User and Application Segment for Private Access; Active User (Enterprise Browser) for Enterprise Browser; Device (DNSaaS) and Query (DNSaaS) for DNSaaS.[3][5][6]
- Tunnel (active-standby pair) and Port pair (NewEdge Express Connect) for dedicated network capacity into NewEdge.[10][11]
- Transaction (AI services), Gateway (AI Gateway instance), AI Asset, Probe and Event (DCC) for the AI and data security command-center services.[7][12][13][14][15]
The product terms reuse the same User definition as the Service Charges Document, so a person counted for NG SWG is the same kind of unit as a person counted for Private Access, DNSaaS or AI Guardrails, although each service is licensed and measured separately.[3][7]
Counting / floors
Users
An individual is one User “regardless of the number of devices the User uses”, a leaver can be replaced by another individual during the term, but a User subscription may not be shared between individuals (rule).[2] For the inline services Netskope validates unique Users “over a rolling 90 day period”; after notice of an excess the customer has 30 days to buy enough Users or stop service for the excess (rule).[2] The 90-day window is also used for Private Access, DNSaaS, AI Guardrails, Agentic Broker, DataSec Command Center and AI Command Center assets, whereas Enterprise Browser counts Active Users on any single day and CASB API counts unique Users or Seats observed daily.[3][5][4] Per-User subscriptions exclude guest WiFi, machine traffic, robotic process automation and other automated endpoints, which must use separately tunnelled, GB-based SKUs (rule).[2]
Capacity metrics
Machine traffic and WiFi GB units each carry a Capacity Limitation of 1 GB per month, reported by the customer every quarter and trued up when exceeded by more than 10% in any two months (rule).[2] Storage scanning, IaaS Protection and CSPM are trued up quarterly on measured consumption or on the average number of Accounts and Resources in use (rule).[2] Tunnel and Express Connect bandwidth overage is judged on peaks above 5% lasting more than 5 minutes twice in 12 months (rule).[10] The AI services use monthly transaction, probe or event allowances that do not roll over and, when exhausted, suspend or degrade the service until the next month (rule).[7]
Additions, true-up and refunds
Units added during a term are priced at the original per-unit fee, pro-rated and co-termed (rule).[2] The SSA commits fees for the Subscription Period and states that Netskope “does not provide credits or refunds for unused Subscription Units or reductions in usage” (rule).[1] Where usage exceeds purchased units, the parties cooperate to establish the facts and Netskope may invoice the overage directly, even for subscriptions bought through a reseller (rule).[1] Netskope may also suspend, limit or throttle the Services to stop surges beyond purchased units (rule).[1]
Audit
The SSA does not contain a conventional audit clause; instead it requires the customer to provide information and written confirmation of usage on request.[1] The Software EULA that governs the Netskope client grants a broader right to inspect the licensee’s records, “including inspecting the console and ensuring it is at or below the licensed user count”, with any underpayment payable promptly (rule).[16] The product licensing terms add that customers may be asked for system data, audit logs or written confirmation of counts.[4] Commentary: because most Netskope metrics are measured by Netskope inside the tenant, a compliance review is usually a comparison of Netskope’s own usage figures with the Order rather than a customer-run inventory; see Software license audit and True-up.
Virtualization & partitioning
Netskope services are not licensed by processor, core or host, so conventional virtualisation rules do not apply. The partitioning questions that arise are about tenants. User, Seat, TB and Application Segment entitlements for CASB API and Private Access are assigned at account level and can be shared across a customer’s tenants, but Light Users, High-Capacity Tunnels, AI Gateway, AI Red Teaming probes and AI Guardrails transactions are tied to one tenant (or one gateway) and cannot be pooled.[4][3][10][12] The self-hosted AI Gateway is counted per installed instance.[12]
Cloud / BYOL
Netskope is itself a cloud service; there is no bring-your-own-licence model onto public clouds. Subscriptions can be bought through cloud marketplaces, which the SSA treats as Resellers.[1] Separate environments exist for U.S. FedRAMP customers and for Mainland China, each sold separately with its own compliance conditions (FedRAMP Services, China Services).[1] Cloud workloads monitored by Netskope are licensed by Account (cloud), Resource or scanned GB (data processed or scanned).[2]
Programs
- Support: Basic Support is included with every purchase; Premium Support and Premium Plus Support are bought separately (rule).[17] See Subscription agreement, support and lifecycle.
- Evaluation Services: free proofs of concept are limited to 30 days of internal testing (rule).[1]
- Reseller and cloud marketplace purchases: purchases through resellers and marketplaces remain subject to the Netskope agreement, which prevails over the reseller contract.[1]
- Next Business Day Shipping for SD-WAN hardware replacement is sold separately.[8]
Netskope does not publish an enterprise agreement, credit pool or flexible consumption program comparable to those of some other security vendors; multi-year terms appear only as committed payments in an Order.[1]
Term and renewal
Subscriptions do not auto-renew. Unless Netskope accepts a new Order, the right to use the Services ends at the end of the Subscription Period and the service may be stopped without notice (rule).[1] The tenant License page, where enabled, lists each contract with its product code, quantity and dates, shows renewal banners from 30 days before expiry and keeps expired contracts visible for 90 days (rule).[18] After termination, Output (logs) is available for up to 90 days and then deleted (rule).[1]
Out of scope
This article does not cover pricing, the login-protected Netskope One SD-WAN licensing terms, the Netskope Data Processing Addendum, implementation services, or products sold under separate terms by companies Netskope has acquired, other than the Kadiska SKUs listed as end of sale.[19]