The Skyhigh Security SSE Packaging guide “will briefly explain how Skyhigh Security’s Security Service Edge (SSE) is licensed”, including “a breakdown of the SSE SKUs, and the components included in each SKU”.[1] It is the main public licensing document on Skyhigh’s own domains.
Editions
Three key SSE SKUs are named Essential, Advanced and Complete, with three additional SKUs for customer cloud security needs.[1] The packaging table covers six packages, which the SSE Packaging guide codes as follows: SWG On-Prem (WSG-S), Cloud SWG (MVW), Cloud SWG Advanced (MVW-ADV), SSE Essential (UCE B), SSE Advanced (UCE A) and SSE Complete (UCE C).[1]
| Component | WSG-S | MVW | MVW-ADV | UCE B | UCE A | UCE C |
|---|---|---|---|---|---|---|
| Data Protection (DLP) | included | included | included | included | included | included |
| Threat Protection (GAM) | add-on | included | included | included | included | included |
| Secure Web Gateway (on-prem) | included | included | included | included | included | included |
| SWG cloud and hybrid support | none | included | included | included | included | included |
| Remote Browser Isolation, Risky Web | none | none | included | included | included | included |
| Remote Browser Isolation (UCEFI) | none | add-on | add-on | add-on | add-on | add-on |
| CASB Shadow IT (C02) | none | none | none | included | included | included |
| CASB Unlimited SaaS Apps (C63) | none | none | none | none | included | included |
| Private Access, ZTNA (MPA) | none | add-on | add-on | add-on | add-on | included |
| Cloud Firewall (SSEFW) | none | add-on | add-on | add-on | add-on | included |
| OCR (OCRUCE-S) | none | add-on | add-on | add-on | add-on | add-on |
| Advanced DLP, EDM and IDM (ADVDLP) | none | add-on | add-on | add-on | add-on | add-on |
| Entitlement to virtual SWG appliances (KVM or SVP) | none | included | included | included | included | included |
The table above restates the Skyhigh packaging table.[1] Catalog SKUs: SWG On-Prem (WSG-S), Cloud SWG (MVW), Cloud SWG Advanced (MVW-ADV), SSE Essential (UCE B), SSE Advanced (UCE A), SSE Complete (UCE C). Add-on SKUs: Remote Browser Isolation Full Isolation (UCEFI), Private Access (MPA), Cloud Firewall (SSEFW), OCR (OCRUCE-S), Advanced DLP (ADVDLP), Threat Protection (GAM) for SWG On-Prem. Component SKUs: CASB Shadow IT (C02), CASB Unlimited SaaS Apps (C63).
What each SSE package contains
- SSE Essential (UCE B). “SSE Essentials provides these capabilities by providing a combination of the components in the Skyhigh Web Protection (WPS) SKU, Skyhigh Cloud for Shadow IT, and the Skyhigh Mobile Cloud Service (MMCS).”[1] Catalog proof: SSE Essential is a combination of WPS, Shadow IT and Mobile Cloud Service.
- SSE Advanced (UCE A). It “includes all the components of SSE Essentials and adds endpoint DLP, Trellix SaaS ePO, and unlimited Skyhigh Cloud licenses for sanctioned SaaS apps”.[1] Catalog proof: SSE Advanced adds endpoint DLP, Trellix SaaS ePO and unlimited sanctioned SaaS apps.
- SSE Complete (UCE C). It “includes all the components of SSE Advanced and adds Skyhigh Private Access” for zero trust access to private applications in the cloud or on premises.[1] Catalog proof: SSE Complete adds Private Access.
A practical point for estate management concerns Trellix ePO. SSE Essential “does not include a license for Trellix SaaS ePO, but it does include a license for Trellix on-prem ePO”. Customers on Essential therefore manage Skyhigh Client Proxy deployments with on-prem ePO, the Skyhigh Cloud console or a third-party tool.[1] Catalog proof: SSE Essential includes on-prem ePO but not Trellix SaaS ePO. Skyhigh also states that SSE Essentials includes licences for Skyhigh Web Gateway software for virtual on-site deployments.[1] Catalog proof: SSE Essential includes licences for virtual Web Gateway software.
Metrics
CASB is the one product family where the packaging guide spells out the counting unit. The FAQ distinguishes two licence types for sanctioned SaaS apps.[1]
| Pooled | Unlimited | |
|---|---|---|
| Purchase | Per user | Per user |
| Use | Per user, per SaaS application | Per user, any SaaS application |
| Skyhigh’s worked example | 1,000 users; Box 500, Salesforce 1,000, ServiceNow 50, Slack 450 users; buys 2,000 pooled SaaS app licences | 1,000 users with four sanctioned apps; buys 1,000 unlimited licences, covering every app including one added later |
| Buy more when | The total count rises beyond the pool | Headcount rises (or falls significantly) |
| Skyhigh’s suggested fit | The customer knows how many users use each sanctioned app | Numerous sanctioned apps, uncertain per-app user counts, or three or more apps with more expected |
Catalog rows: Pooled CASB sanctioned SaaS app licence, Unlimited CASB sanctioned SaaS apps licence. Catalog proof: Pooled CASB apps are bought per user and per application; Unlimited CASB apps are bought per user for any SaaS application; Unlimited suits three or more sanctioned apps or uncertain counts.
The packaging table lists the unlimited licence as C63 and places it in SSE Advanced and Complete, while the Shadow IT component C02 is included in all three SSE packages.[1] The guide does not say what Shadow IT is counted on. It also does not state a counting unit for the Web Gateway, DLP or Private Access components; those would be set in the Order Form and in Skyhigh’s Product Entitlement Definitions, which Skyhigh lists as a legal document.[6]
Counting / floors
Skyhigh publishes no minimum quantities. Three counting points follow from the guide:
- Pooled counts are per application. A user who uses three sanctioned apps consumes three pooled licences in the guide’s worked example, which is why the example buys 2,000 for 1,000 users.[1]
- Unlimited counts are headcount. The customer buys additional unlimited licences as headcount increases, and “significantly” decreases are also noted as a reason to change the quantity.[1]
- Customer-side licences are separate. CASB connectors depend on the customer’s own SaaS licences. OneDrive integration needs a Microsoft 365 E1 or E3 licence.[2] Teams DLP “requires selected Microsoft 365 licenses”, and if they are not purchased the APIs “do not send any messages on which DLP controls can be enforced”.[3] DLP in Airtable “is available only with the Enterprise Scale license”.[4] Catalog proof: CASB for OneDrive needs a Microsoft 365 E1 or E3 licence; Teams DLP depends on the customer’s Microsoft 365 licences; Airtable DLP needs the Enterprise Scale licence.
Skyhigh also recommends that customers with new CASB subscriptions (after November 2024) contact Support to integrate CASB with OneDrive.[2] Catalog proof: New CASB subscriptions after November 2024 integrate OneDrive through Support.
Virtualization & partitioning
The packaging table gives all cloud and SSE packages an “Entitlement to Virtual SWG Appliances (KVM or SVP)”.[1] The hybrid appliance guide adds that during deployment the customer can select Secure Web Gateway and Zero Trust Network Access, and that “based on the license entitlements, you will see the services that you can select”.[5] Catalog proof: Hybrid appliance services depend on licence entitlements. There is no per-core or per-socket metric in these documents.
Cloud / BYOL
Hybrid Mode lets a customer with on-premise Web Gateway appliances or virtual machines, together with the Skyhigh Web Security Gateway Service, manage policy from either place. Skyhigh describes it as a route to migrate to an all-cloud deployment or to support both.[1] Catalog proof: Hybrid mode lets policies be managed on premises or in the cloud. The documents describe no conversion of on-premises licences to cloud credit.
Programs
- Price books. Skyhigh points readers to “Pricebooks” that are accessible with a partner or Skyhigh Security login.[1] Catalog proof: Price books are behind a partner or Skyhigh login.
- Individual SKUs. Individual SKUs are still offered; the customer is told to work with the Account Manager.[1]
- Service Provider pay-go. “Pay-go pricing is part of the Service Provider Pricebook.”[1] Catalog proof: Service Providers can buy on a pay-go model.
Out of scope
This article does not set out prices, the Order Form, the End User License Agreement or the Cloud Services Agreement, which are not public in the documents reviewed. See Skyhigh Security licensing for the wider picture and Skyhigh Web Gateway appliance licences and browser isolation seats for the appliance and Full Isolation constructs.