Two parts of the Skyhigh estate are counted instead of simply being bought as a package. A Secure Web Gateway appliance is activated with a licence key that is tied to the order, and Full Isolation browser sessions draw on a limited pool of seats. Both are described in the Skyhigh documentation site.
Editions
Appliance licences come with the SWG On-Prem package (WSG-S), and the Cloud SWG and SSE packages carry an entitlement to virtual SWG appliances.[8] See Skyhigh SSE packages, SKUs and CASB licences. Remote Browser Isolation for risky web traffic is included from Cloud SWG Advanced upward, while Full Isolation is a separate add-on (UCEFI) on every cloud package.[8] Skyhigh describes the split this way: “Skyhigh also provides incremental Full Isolation licenses for those looking to deploy RBI in a traditional deployment”.[8] Catalog proof: Risky Web isolation is included but Full Isolation is a separate licence.
Metrics
Web Gateway appliance licence
The Web Gateway appliance licence is a licence key file. To activate Secure Web Gateway the administrator reviews “two online documents on licensing and data usage”, then imports the licence and activates the product.[2] In the wizard, the administrator opens the End User License Agreement and the Data Usage Statement and must tick a checkbox for each; the documentation states “You must agree to the content of the online documents if you want to activate the product”.[2] Activation triggers an initial download of the files used by the anti-malware and URL filtering engines.[2] Catalog proof: Activation requires accepting the EULA and Data Usage Statement.
If the key file has not arrived, a temporary key can be generated from the activation ID on a label on the appliance box, through the Skyhigh content security portal.[3] The documentation does not give a validity period for a temporary key. Catalog proof: Appliances can be activated with a temporary key.
Full Isolation seat
“The licenses that are available to users for applying the Full Isolation mode are referred to as seats.” When a user asks for a Full Isolation session, the web protection functions check that a seat is free for that user, and the availability of seats is tracked globally and distributed to local points of presence.[7] Catalog row: Full Isolation seat; proof: Full Isolation licences are seats checked at session start.
Counting / floors
Seat counting. The seat mechanics are unusual because a seat is not a named user.
- A seat is occupied while a user is active and freed “when a user is no longer active on a session”.[7] Catalog proof: Full Isolation seats are freed when users go inactive.
- Seat usage is recorded in three buckets of twelve hours. A user found in any bucket may continue; a user in none is admitted only if the overall seat limit has not been reached. “This approach ensures that a user who is active on a seat at least once a day has this seat permanently available”, and it can take up to twelve hours for a seat to be freed after a user stops.[7] Catalog proof: Seat usage is tracked in three 12-hour buckets.
- “Some over-usage is tolerated regarding seat usage, which means that it can actually go up to 115% of the normal scope.”[7] Catalog proof: Seat over-usage is tolerated up to 115%.
- Users on a VIP list have seats reserved. If the VIP list is longer than the available seats, or users are added while all seats are occupied, reservation cannot be complete, and reserved seats can block other users even while seats show as free.[7] Catalog proof: VIP users can have seats reserved.
In compliance terms, a concurrent-style seat model with a daily activity window sits between a named-user and a concurrent-user count: the buckets track which distinct users have been active in the last 36 hours. That reading is commentary on the documentation, not a quotation from a contract. For the general concepts, see Concurrent and device licensing.
Appliance counting. The quantity of appliance licences follows the order. “When something changes about the order that you issued to purchase one or more Web Gateway appliances from Skyhigh Security, your old license is replaced with a new one”, for example when more appliances are added to a cluster. The old licence is disabled, the new licence is created, and the administrator logs on, activates Web Gateway and imports the new licence. Skyhigh sends the new licence key to the contact on the customer account, so there can be a delay.[1] Catalog proof: A changed appliance order replaces the licence.
While the old licence is disabled and no new one is imported, “you can continue with operating Web Gateway”, but the web filters cannot retrieve updates from the update servers. Monitoring records an update-log entry, incidents and a red dashboard alert showing the appliance ID and, in a cluster, the node number.[1] Catalog proof: A disabled licence blocks web filter updates but not operation.
Virtualization & partitioning
Hardware models are named WBG-4500, WBG-5000 and WBG-5500 with a generation letter, C, D, E or F.[6] A virtual appliance on VMware needs ESXi, a 64-bit host CPU with virtualization extensions, and, for production, at least 16 GB RAM, 200 GB disk and 4 CPU cores, with 32 GB, 500 GB and 4 or more cores recommended.[4] Catalog proof: Production virtual appliances need at least 16 GB RAM and 4 cores.
The E-Series sizing guidance lists two virtual machine sizes, VM-8 and VM-16, with 8 and 16 CPU cores. For anti-malware and URL filtering it gives an employee count of 1,200 and 2,400 users respectively, and for URL filtering only 6,240 and 12,480.[5] These are capacity recommendations that Skyhigh says to confirm with a channel sales engineer, not licence limits. The documents reviewed define no processor or core-based licence metric for the virtual appliance, so a virtual deployment is governed by the entitlement in the Order Form.
Cloud / BYOL
Hybrid Mode combines on-premises Web Gateway appliances or virtual machines with the Skyhigh Web Security Gateway Service, so that policies can be managed from either.[8] For the hybrid appliance, “based on the license entitlements, you will see the services that you can select for deployment”, Secure Web Gateway and Zero Trust Network Access.[9] Cloud accounts are activated from a welcome email after purchase, and the user must read and accept the Skyhigh Security Cloud Services Agreement, which is shown again at sign-in.[10] Catalog proof: First sign-in requires accepting the Cloud Services Agreement; Hybrid appliance services depend on licence entitlements.
Programs
The Temporary licence key for appliances and Hybrid mode rows record the activation and deployment options above. The documents describe no trial or evaluation terms for appliances. See Skyhigh support, Care Plans and contract documents.
Out of scope
This article does not set out appliance prices, hardware warranty terms, end-of-life dates or the contents of the End User License Agreement and Data Usage Statement. Those are in documents that were not reviewed. See Skyhigh Security licensing.