Skyhigh Security licensing is the set of commercial terms under which Skyhigh Security sells its Security Service Edge (SSE) platform. SSE, as the company’s documentation describes it, unites critical security capabilities in a single solution for users, applications and devices.[8] The products it lists include Skyhigh Security Service Edge, Data Loss Prevention, CASB, Cloud Connector, Secure Web Gateway (on-premises and cloud), Skyhigh Client, Private Access, Cloud Firewall, Remote Browser Isolation and CNAPP.[8] The licensing material public on the vendor’s own domains is narrower than the product list: one packaging guide, a few product pages on seats and appliance keys, and a support policy.
Editions
The packaging guide states that Skyhigh’s SSE has three key SKUs, Essential, Advanced and Complete, “as well as three additional SKUs” for cloud security needs, and it tabulates six packages and a set of add-ons.[1]
| Package | Part code | What it adds |
|---|---|---|
| SWG On-Prem | WSG-S | DLP and on-premises Secure Web Gateway; threat protection (GAM) is an add-on |
| Cloud SWG | MVW | Cloud and hybrid SWG support, entitlement to virtual SWG appliances |
| Cloud SWG Advanced | MVW-ADV | Remote Browser Isolation for risky web |
| SSE Essential | UCE B | CASB Shadow IT; combines Web Protection, Cloud for Shadow IT and Mobile Cloud Service |
| SSE Advanced | UCE A | Endpoint DLP, Trellix SaaS ePO, unlimited sanctioned SaaS app licences |
| SSE Complete | UCE C | Skyhigh Private Access and Cloud Firewall |
Add-ons named in the table are Remote Browser Isolation Full Isolation (UCEFI), Private Access (MPA), Cloud Firewall (SSEFW), Optical Character Recognition (OCRUCE-S) and Advanced DLP (ADVDLP).[1] Skyhigh also says individual SKUs are still offered, to be quoted with the Account Manager.[1] The detail is in Skyhigh SSE packages, SKUs and CASB licences. Catalog proof: SSE packaging has three key SKUs plus add-on SKUs; Individual SKUs are still offered.
Metrics
Skyhigh’s public documents name four units that matter for counting.
| Unit | Wording | Catalog row |
|---|---|---|
| Pooled CASB sanctioned app licence | “Purchased per user” and “Used per user / per SaaS application” | Pooled CASB sanctioned SaaS app licence |
| Unlimited CASB sanctioned app licence | “Purchased per user” and “Used per user / for any SaaS application” | Unlimited CASB sanctioned SaaS apps licence |
| Full Isolation seat | Licences for applying Full Isolation to browser sessions are “referred to as seats” | Full Isolation seat |
| Web Gateway appliance licence | Licence key file imported when activating an appliance; replaced when the order changes | Web Gateway appliance licence |
The packaging guide does not state in so many words that SSE Essential, Advanced and Complete are priced per user. It does state that the CASB sanctioned app licences are purchased per user, and the examples count users against headcount.[1] A document titled Product Entitlement Definitions is listed among Skyhigh’s legal documents and was not reviewed.[2]
Counting / floors
No floors or minimums are published. What the documents do show is how counting works in practice:
- CASB. For pooled licences, the customer counts users per sanctioned application and buys the total, with more pooled licences “if the license count increases beyond” the purchased number. For unlimited, it buys one licence per user and “only” more “as their headcount increases or significantly decreases”.[1] Catalog proof: Pooled CASB apps are bought per user and per application; Unlimited CASB apps are bought per user for any SaaS application.
- Full Isolation. Seat availability is checked when a user starts a session. Over-usage “can actually go up to 115% of the normal scope”.[3] Catalog proof: Seat over-usage is tolerated up to 115%.
- Utilization visibility. The My Subscriptions page lists “your account’s license, utilization summary, and order history”, with a separate APIs utilization summary.[5] Catalog proof: My Subscriptions shows licences, utilization and order history.
Virtualization & partitioning
The packaging table lists an “Entitlement to Virtual SWG Appliances (KVM or SVP)” for all cloud and SSE packages, and the text says SSE Essential “does include licenses for Skyhigh Web Gateway software for virtual on-site deployments”.[1] The documents reviewed do not define core, socket or processor counts for virtual appliances. Appliance licensing and sizing are covered in Skyhigh Web Gateway appliance licences and browser isolation seats. Catalog proof: SSE Essential includes licences for virtual Web Gateway software.
Cloud / BYOL
Skyhigh’s SSE is a cloud service with an optional on-premises or hybrid element. Hybrid Mode “enables customers with on-premise Skyhigh Security Web Gateway physical appliances or Virtual Machines” and the cloud service to manage policy from either side.[1] The CASB connectors depend on licences the customer holds with the SaaS vendor. For example, CASB for OneDrive requires a Microsoft 365 E1 or E3 licence,[7] and Teams DLP depends on selected Microsoft 365 licences being purchased.[9] Those are third-party licence prerequisites, not Skyhigh licences. Catalog proof: CASB for OneDrive needs a Microsoft 365 E1 or E3 licence; Teams DLP depends on the customer’s Microsoft 365 licences.
Programs
| Programme | What the documents say | Catalog row |
|---|---|---|
| Service Provider pay-go | Pay-go pricing is part of the Service Provider Pricebook | Service Provider pay-go pricing |
| Partner price book | Price books are on the partner portal; a partner or Skyhigh login is required | Partner price book access |
| Care Plans | Support levels from No Service Level to Pinnacle | Care Plans (support levels) |
| Licensed or trial subscription | Order history shows term as licensed or trial | Licensed or trial subscription |
| Hybrid mode | On-premises and cloud web gateway together | Hybrid mode |
Support levels and Grant Numbers are covered in Skyhigh support, Care Plans and contract documents.
Out of scope
This article does not analyse the End User License Agreement, the Cloud Services Agreement, the Service Level Agreement schedules, the Technical Support and Maintenance Terms, the Product End of Life Support Policy or the Artificial Intelligence Use Addendum, which Skyhigh lists as separate documents.[2] It does not cover Trellix or McAfee endpoint products, which are covered in Trellix licensing, nor hardware warranty terms.