Netskope subscription units are the units of measure that the Netskope Subscription Services Agreement (SSA) uses to limit each customer’s right to use the Services. The SSA defines Subscription Units as “the units and measurements/metrics for determining Subscription entitlements and fees” provided by Netskope as of the Order date and fixed for the Subscription Period, and points to a public page for their content.[1] That page, the Netskope Subscription Service Charges Document (version of December 11, 2024), defines five units (Account, GB and TB, Resource, Seat and User) and sets out, SKU family by SKU family, how additional use is charged, a process it calls the true-up.[2] This article covers the units that apply to the inline security services, which are the largest part of most Netskope estates: User, GB (data processed or scanned) and the China Elite / China Premium unit. API, posture and data security units are covered in CASB API, DSPM and posture licensing.
Editions
The Service Charges Document groups Secure Web Gateway (SWG), Next Gen Secure Web Gateway (NG SWG), Cloud Inline, Firewall (CFW), Remote Browser Isolation (RBI) and Zero Trust Network Access (ZTNA) under a single heading and lists thirteen SKU prefixes for them, from NK-P-SSE- and NK-P-SSEPA- to NK-NPA-, NK-ZTNXTL7, NK-EP and NK-EMAIL; all are “charged on a User basis”.[2] The NG SWG prefix is followed by STD, ENT, PRF and RBI variants, but the document does not describe what each variant contains; package contents are defined in the quotation.[2] The catalog records the family as Inline per-User services (SWG, NG SWG, Cloud Inline, Firewall, RBI, ZTNA).
Two further families extend NG SWG. NG SWG Machine Traffic (NK-NG-SWG-MACH and NK-NG-SWG-C-MACH) and NG SWG Guest WiFi (NK-NG-SWG-WIFI-) cover traffic that is not generated by people, and are “charged on a GB basis”.[2] NG SWG China Elite and NG SWG China Premium provide service from Netskope data centers in Mainland China and are charged per User and per GB.[2]
Metrics
User
The Service Charges Document defines a User as each individual who “(a) is authorized by the customer to use the customer’s systems (including the customer’s network, cloud services and Internet connections), and (b) whose use of such systems is monitored by, or accessed by use of, the Services”.[2] Employees, contractors and other authorised individuals all qualify.[2] Three consequences follow from the wording (rule):[2]
- A User is a person, not a device: an individual is one User “regardless of the number of devices” used.
- A User licence is reassignable: an individual whose access is terminated may be replaced by another individual during the Subscription Period.
- A User licence is not shareable: it “may not be shared between individuals at any time”.
The same definition is repeated in the Private Access, DNSaaS, AI Guardrails, Agentic Broker and DataSec Command Center licensing terms, which makes the User the common denominator of the Netskope estate.[3][4]
What a User subscription does not cover
Per-User subscriptions “do not include guest WiFi traffic, machine traffic, nonstandard computing devices, storage scanning, robotic process automation or batch tools, or other forms of automated network endpoints having the ability to transmit data without human direction” (rule).[2] That traffic belongs on the Machine Traffic and WiFi SKUs, and the inline per-User services “require a separate tunnel” from them; in fact separate tunnels are required for each of machine traffic, guest WiFi traffic and User traffic.[2] Commentary: this is the Netskope equivalent of a rule that service accounts and bots cannot consume named-user licences. Traffic from servers, kiosks, scanners or RPA bots steered through a User tunnel is outside the User entitlement even if it authenticates.
GB
GB means the gigabytes of traffic processed by the Service, such as machine traffic and guest WiFi traffic (the same unit also measures scanned data for storage scan services).[2] For Machine Traffic and WiFi SKUs each GB unit purchased allows Netskope to process “up to a total of 1GB of data per month”, a ceiling the document calls the Capacity Limitation (rule).[2]
China units
Each China Elite or China Premium SKU unit includes one User and up to 5 GB of data processing per month.[2] The service is limited to traffic from authenticated Users (individuals, including employees and contractors) to Netskope data centers in Mainland China and excludes guest Wi-Fi and server traffic (rule).[2] China Services are also subject to the extra obligations in SSA s.3.6, including content controls and filings with local authorities (China Services).[1]
Counting / floors
Rolling 90-day validation of Users
“During the Service subscription period, Netskope will determine if actual Users exceed the quantity of Users purchased by validating unique Users over a rolling 90 day period” (rule).[2] The customer may have to provide information and written confirmation of the number of Users. Once notified that actual Users exceed the subscription, the customer must within 30 days either buy enough additional Users “or immediately cease Services for all Users exceeding the purchased quantity”.[2]
Commentary: a rolling 90-day unique count means that a person who used the service once in the last three months still counts, so leavers need to be removed promptly from steering and identity sync for the count to fall. The same window applies to Private Access Users, so a person counted in both services consumes one licence in each.[3]
Mid-term additions
Customers may add Users at any time. Additional Users are charged at the per-User fee quoted for the original order and are pro-rated to be coterminous with the original Subscription Period (rule).[2] There is no right to reduce quantities during a term: fees are committed and Netskope gives no credits or refunds for unused Subscription Units (rule).[1]
Machine traffic and WiFi true-up
GB-based SKUs rely on customer reporting. The customer must maintain and report the information needed to calculate monthly processing (“Usage Reports”) and submit them “quarterly, 2 weeks after the end of each quarter”.[2] If monthly usage exceeded the Capacity Limitation by more than 10% in any two months of the subscription, the customer must, within 45 days after the end of the quarter, extend the subscription and increase capacity “sufficient for the highest monthly usage”.[2] Unless Netskope quotes otherwise, the added capacity has a 12-month term that starts on the first day of the second month that exceeded the limit by more than 10%.[2]
The China units follow the same pattern: two months more than 10% over the capacity trigger a purchase of additional units within 45 days after quarter end, sized for the highest month.[2]
Worked example (commentary)
A customer holds 5,000 NG SWG Users and 2,000 Machine Traffic GB units. Over the last 90 days 5,240 distinct people have been seen, because contractors onboarded in one quarter and not all leavers have been de-provisioned. On notice, the customer has 30 days to buy 240 Users at the original unit price, co-termed to the existing end date, or to stop service for the excess.[2] If the machine-traffic tunnel processed 2,150 GB in July and 2,300 GB in August, July exceeds the 2,000 GB limit by 7.5% and August by 15%, so only one month is more than 10% over and no true-up is yet required; a second month above 2,200 GB would trigger a purchase sized to the highest month.[2]
Overage and invoicing
The true-up rules in the Service Charges Document are backed by the SSA. Under s.5.1 the customer must pay all fees “properly invoiced for Subscription Units added during the applicable Subscription Period”, and the parties cooperate in good faith to determine whether usage exceeds the purchased units.[1] If it does, Netskope may invoice “directly or through the applicable Reseller” and “will have the right to directly invoice Customer for overages, regardless of whether Customer purchased the Subscription from a Reseller” (rule).[1] Netskope may alternatively work with the customer to reduce usage.[1] Separately, SSA s.3.3 lets Netskope suspend, limit or throttle the Services to prevent abuse, “including surges or spikes in Customer’s usage beyond purchased Subscription Units” (rule).[1]
Because the Subscription Units are those in force at the Order date, a later version of the Service Charges Document does not change the metric in the middle of a term; updates apply to purchases and renewals after they are posted (rule).[1][2]
Virtualization & partitioning
Users are counted per individual, not per device, virtual machine or session, so virtual desktops or multiple laptops do not multiply the count.[2] Automated or non-human endpoints must be separated into their own tunnels and GB-based subscriptions rather than counted as Users.[2]
Cloud / BYOL
Not applicable: the inline services run in Netskope’s NewEdge data centers. Subscriptions bought through cloud marketplaces are Reseller purchases under the SSA, and the direct-invoicing right for overages applies to them as well.[1]
Programs
The inline services have no separate volume or consumption program in the public documents. Support levels, evaluations and the reseller channel are described in Subscription agreement, support and lifecycle.
Out of scope
Seat, TB, Account, Resource and data store units are covered in CASB API, DSPM and posture licensing; Private Access, DNSaaS and network capacity units in Private access and network licensing; and transaction-based AI services in AI security licensing.