Symantec enterprise security licensing covers Broadcom’s commercial terms for the Symantec enterprise security portfolio and for Carbon Black, which Broadcom sells alongside it. Each product is licensed under its own Specific Program Documentation (SPD) or technical documentation on a unit that suits the product. Symantec Endpoint Security is metered per managed device; Symantec Network Protection counts Users that include every 8 GB of traffic; the PGP encryption products use Device, Server or User licenses; and Carbon Black is licensed per Endpoint.[1][6][7][8] Broadcom also sells Symantec Portfolio License Agreements (PLAs) that grant access to a whole security segment for a baseline measured in Software Consumption Units.[9]
Symantec endpoint subscriptions are sold through partners. The SES licensing FAQ answers the question of buying directly from Broadcom with “No. You must purchase a subscription from a Broadcom partner.”[2]
Editions
| Product | Editions or components | Metric | Source |
|---|---|---|---|
| Symantec Endpoint Protection (SEP) | On-premises, managed by Symantec Endpoint Protection Manager (SEPM) | Seat per client | [5] |
| Symantec Endpoint Security | Enterprise (SESE); Complete (SESC); hybrid cloud and on-premises | Managed device | [1] |
| Symantec Network Protection | Cloud SWG, Edge SWG, Content Analysis, Management Center, Reporter, Malware Analysis, Secure Access Cloud, Web Isolation Cloud Service | User | [6] |
| PGP encryption | PGP Encryption Suite; PGP Gateway Email Encryption; PGP Command Line | User; Server; Server | [7] |
| Carbon Black | Carbon Black offerings with Sensor Software | Endpoint | [8] |
The SES editions differ in entitlement as well as features. The FAQ states that the SESC license covers “the on-premises SEP and the on-premises EDR”, while the SESE license covers “the on-premises SEP but not the on-premises EDR”. An on-premises SEP license alone does not entitle the customer to the SES cloud console.[2]
Metrics
Symantec Endpoint Security and Endpoint Protection
“Symantec Endpoint Security subscriptions are metered per managed device.” A device is “a single physical or virtual desktop, laptop computer, thin client, workstation, mobile device, server, or other virtual operating system environment, on which a single instance of the agent is installed or performs services.”[1] The on-premises SEP license is a seat count: “in a network with 50 endpoints, the license must provide for a minimum of 50 seats”. Instances of SEPM “do not require a license”.[4]
Network Protection
The Network Protection SPD lets Broadcom count as a User “(a) every employee of the Customer, (b) any agent, partner/contractor resource, or other non-employee … authorized by Customer to use and/or benefit from the use of the Service”, and (c) each 8 Gigabytes of Service activity or traffic. The first 8 GB consumed by a person already counted as a User is not counted again, and “A User may have up to four (4) devices.”[6] Where this SPD conflicts with the SPDs of the component products, the Network Protection SPD governs.
PGP encryption
The PGP SPD defines three license models. A Device is a computer, storage drive or connection point able to install, access or link the software. A Server is “a standalone computer system or virtual machine acting as a service or resource provider”. A User is an individual person and/or Device authorized to use or benefit from the software, or who actually uses it. PGP Encryption Suite is licensed by User, and Gateway Email Encryption and PGP Command Line by Server.[7]
Carbon Black
“Endpoint” means “the computer device(s) on which the Sensor Software is installed, including, but not limited to, laptops, desktops, tablets, point of sale devices, and servers.” Customers may use the software for the number of Endpoints in the Transaction Document.[8]
Counting / floors
SES seat assignment by policy
When a tenant holds only SESE or only SESC, every device with an applied policy counts against that subscription. When it holds both, “devices that have an applied SESC-only policy are counted under the SESC license”. The SESC-only policies are Application Control, Adaptive Protection, Detection and Response, Threat Defense for Active Directory and Trusted Updater. A device that cannot run an applied SESC policy is not counted as an SESC seat; for example, Adaptive Protection is not supported on Mac or Linux.[1] SES calculates seat usage every 24 hours. Devices from an on-premises SEPM domain that was enrolled and then unenrolled keep counting as used until they are purged from the cloud console.[2]
Telemetry and compliance
Broadcom collects SESE and SESC usage automatically, including the number of enrolled devices, subscriptions and seats purchased, and feature usage, “Whether you are licensed to use the product under PLA subscription or have a standard license”. “Broadcom checks the SESC/SESE license compliance every 24 hours.”[3]
Overdeployment and expiry
| License | Overdeployed | Expired |
|---|---|---|
| SEP trial | Allowed | LiveUpdate content disabled |
| SEP paid | Allowed, with notifications; clients stop submitting samples to Insight | Allowed, with alerts; clients stop submitting samples to Insight |
| SES trial | Protection not activated beyond 25 devices | Content and protection disabled |
| SES paid | Allowed | 30 days to renew before console access ends and the tenant is removed |
Source: SEP and SES overdeployment documentation, Last Updated March 2, 2026.[4]
The same page notes that “You are still out of compliance even if the behavior is allowed”, so the absence of technical enforcement does not mean a deployment is licensed.[4] For new SEP installations, “you have 60 days to purchase enough license seats to cover all of your deployed clients” after SEPM is installed.[5]
PGP rules
PGP Command Line may be installed on a number of non-production Servers equal to licensed Servers, “solely for redundancy, staging, and/or testing purposes”. Those licenses may be used only when the licensed Servers are not in use. Without a separate evaluation agreement, an evaluation of PGP Encryption Suite has full functionality for ninety days, after which most functionality is disabled and use is limited to non-commercial purposes.[7]
Virtualization & partitioning
Virtual machines are counted like physical ones. The SES device definition includes “other virtual operating system environment[s]”, and the PGP Server definition includes a virtual machine.[1][7] For non-persistent virtual desktops managed by SEP, “the management server counts the licenses of online non-persistent clients only”.[5]
Cloud / BYOL
Network Protection, Carbon Black Cloud and the SES cloud console are delivered as Broadcom-hosted services, so bring-your-own-license terms do not arise in the retrieved documents. SES subscriptions are provisioned automatically to a tenant, and trial licenses cannot be converted to paid licenses or the reverse.[2] When a Carbon Black subscription expires, the customer must “delete or uninstall all Broadcom Software and license keys (including, without limitation, all Sensor Software located on Customer’s Endpoints)”. Orders are non-cancellable and non-refundable unless the Transaction Document or Agreement says otherwise.[8]
Programs
The Symantec Identity Security PLA brief (February 28, 2020) describes a three-year agreement giving access to Symantec Advanced Authentication, Directory, Identity Governance and Administration, Privileged Access Management, SiteMinder and VIP. “Usage is measured by a Software Consumption Unit (SCU). For the Identity Security PLA, the SCU is the number of users.” Broadcom and the customer set a year-one baseline. Usage is measured through the year, and “At the end of year one, we reconcile your usage and that usage becomes your baseline for Year Two”; the process repeats for year three, with caps on annual increases. The brief describes usage above the baseline as “free”.[9] The same brief states that Symantec offers PLAs for Endpoint, Web & Email and Information Security, and a full Symantec PLA. The catalog records the agreement as the Symantec Identity Security Portfolio License Agreement. The Enterprise Software equivalent is described in Broadcom mainframe and CA enterprise software licensing.
Out of scope
- Consumer security products, which are outside the enterprise documents cited here.
- Symantec Data Loss Prevention, Email Security and Web Protection SPDs other than Network Protection: not retrieved.
- Carbon Black Cloud SaaS Listing and service-level terms.
- Current PLA terms for the Endpoint, Web & Email, Information Security and full Symantec PLAs: only the 2020 Identity Security brief was retrieved.
- Price lists: not published.