- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Symantec Edge SWG
Your proxy has guarded the web edge for years and its software line is ending. The upgrade should not mean writing policy from scratch — Symantec Edge SWG decrypts and inspects web traffic on Broadcom appliances, virtual appliances or your private cloud, licensed per user in the Web Protection Suite alongside Cloud SWG, and running SGOS 7.4, the long-term release.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Broadcom platform family
This page covers Symantec Edge SWG — the on-premises proxy, formerly ProxySG and Advanced Secure Gateway. The rest:
Quick facts
30-second orientation- Product
- On-premises proxy secure web gateway on Broadcom hardware, a virtual appliance or private cloud
- Maker
- Broadcom Inc., Palo Alto; CEO Hock Tan; sold by the Enterprise Security Group under Jason Rolleston
- Former name
- ProxySG and Advanced Secure Gateway; Broadcom bought Symantec’s enterprise business in November 2019
- Software
- SGOS 7.4, the Long-term Release since 8 July 2023; 7.3 support runs out around December 2026
- Price
- Not published; partners quote it, and no Broadcom product page carries a list price
- Licence
- Usually the per-user, per-year Web Protection Suite, which also covers Cloud SWG; hardware is extra
- Hardware
- S410 (2020) and S210 (2021) platforms; older SG-S and ASG-S models are under an end-of-life notice
- Hybrid
- Universal Policy Enforcement writes a policy once and sends it to every gateway, Cloud SWG included
- India
- The proxy and its logs sit in your own racks; Broadcom lists offices in Bangalore, Hyderabad and Pune
- In India via
- TechBag — SGOS 7.4 upgrade planning, licence shape, quote in INR with GST, a pilot on one site
Understand on-premises web proxies before you renew one
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is an on-premises web proxy?
A web proxy you host that ends each browsing session so it can be decrypted, judged and logged on your side.
A 7.3 proxy and a VPN home vs Symantec Edge SWG on 7.4 — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A 7.3 proxy and a VPN home | Symantec Edge SWG |
|---|---|---|
| Proxy software | SGOS 7.3, support ending about December 2026 | SGOS 7.4, the Long-term Release |
| How it is licensed | A licence tied to the appliance | Per-user subscription; hardware bought apart |
| Staff away from the office | A VPN back to the data-centre proxy | Cloud SWG on the same per-user licence |
| Rules for site and cloud | Two consoles, every change made twice | Universal Policy Enforcement, written once |
| Log history | Whatever fits on the appliance disk | 365 days through Hosted Reporting |
| What it is NOT | — | A roaming client, an API CASB, or a published price |
The cheapest test is one virtual appliance on SGOS 7.4 in front of a pilot group: decrypt, apply your current policy, and compare the logs.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Proxy
The SGOS proxy runs on Broadcom hardware, as a virtual appliance or in your private cloud, ending each web session so it can be decrypted, categorised and logged inside your network.
Analysis
Downloads go to Content Analysis for hash reputation, machine learning, several anti-virus engines and sandboxing, while Intelligence Services and WebFilter rate each destination.
Decryption
The proxy handles TLS itself; where volumes outgrow it, the SSL Visibility Appliance, sold under Encrypted Traffic Management, takes the decryption work off the gateway.
Hybrid
A policy is written once and pushed to every gateway, Cloud SWG included; roaming users reach the cloud side, and Hosted Reporting can hold on-site logs for 365 days.
An SGOS proxy on appliances, virtual appliances or private cloud — with one policy reaching Cloud SWG under the same licence.
Nine capabilities. Inspect, defend, govern.
Symantec Edge SWG opens and inspects web sessions on gateways you host, under one policy with Cloud SWG.
Hardware, virtual or private cloud
The same proxy runs on Broadcom’s high-performance appliances, as a virtual appliance, or inside private cloud infrastructure you own.
Encrypted sessions opened on site
The gateway terminates and inspects TLS inside your network, and the SSL Visibility Appliance can carry decryption once traffic grows heavy.
Cloud apps seen in line
Application visibility and control spots and governs cloud apps as their traffic passes; scanning data already stored in SaaS needs CloudSOC.
Files checked several ways
Hash reputation, machine learning, multiple anti-virus engines and a sandbox examine downloads; an add-on to the proxy, included in WPS.
Risky sites kept off the PC
Web Isolation is an add-on, and WPS includes isolation of risky sites, so a suspect page opens in a remote browser rather than on the endpoint.
Destinations rated first
Intelligence Services and WebFilter rate URLs and categories, so a request can be allowed, blocked or isolated before any content arrives.
Written once, sent everywhere
Universal Policy Enforcement defines a policy a single time and distributes it to all gateways, on site and in Cloud SWG, under one licence.
A year of logs in the cloud
Edge SWG can upload its logs to Cloud SWG’s Hosted Reporting service, which keeps them for 365 days with no size limit.
A software line with a date
SGOS 7.4 has been the Long-term Release since July 2023; 7.3 got its end-of-life notice in December 2024, with about two years to move.
Watch Symantec Edge SWG in action
Broadcom’s 2024 case for new Edge SWG hardware, a 2023 SGOS update and a 2022 overview of the Web Protection Suite. All from the official Symantec channel.
Why upgrade to the new Edge SWG hardware
Broadcom’s case for moving Edge SWG estates onto its newer appliance hardware.
SGOS / Edge SWG Update
A 2023 briefing on the SGOS software line that every Edge SWG gateway runs.
Symantec Web Protection
A 2022 look at the Web Protection Suite, the per-user licence spanning Edge SWG and Cloud SWG.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Plenty of estates still need web traffic inspected in their own racks. Edge SWG does it under the same licence as the cloud.
Here’s what genuinely sets it apart — and exactly where it stops.
The ProxySG estate, carried forward
Organisations that bought ProxySG or Advanced Secure Gateway already run this product under a newer name. Moving to SGOS 7.4, the Long-term Release since July 2023, keeps the proxy design, categories and rules they have built up, instead of rewriting web policy for another vendor’s gateway.
One licence for the building and the road
The Web Protection Suite is priced per user per year and covers Edge SWG and Cloud SWG alike, so a person is licensed once whether they browse from head office or a hotel. Universal Policy Enforcement writes the rules a single time and pushes them to the appliances and the cloud service together.
Inspection depth you can keep on site
TLS is opened on hardware in your own racks, and downloads can be handed to Content Analysis for hash reputation, machine learning, several anti-virus engines and a sandbox. Risky sites can be isolated, threat intelligence rates each destination, and heavy decryption loads can move to the SSL Visibility Appliance.
Where it stops
Broadcom publishes no price, and appliances are bought on top of the per-user licence. On its own the gateway does not follow laptops off the network; that is Cloud SWG’s job. API scanning of SaaS needs CloudSOC, and estates still on SGOS 7.3 have an upgrade due before support ends around December 2026.
The numbers behind the platform
What your Symantec Edge SWG rollout looks like
Inventory SGOS and hardware
List each gateway’s SGOS release and appliance model; anything on 7.3 or an SG-S or ASG-S 200–500 box needs a dated plan.
Choose the licence shape
Decide between WPS and the on-site gateway alone, and price appliances, Content Analysis and SSL offload as separate lines.
Pilot SGOS 7.4 on one site
Bring one appliance or virtual appliance up on 7.4, push the interception CA to pilot devices, and record every bypass.
Upgrade the remaining gateways
Move the rest to 7.4 well before 7.3 support ends around December 2026, testing policy and certificates at each step.
Join the cloud and the logs
Point roaming staff at Cloud SWG under one policy, and keep logs for at least 180 days for CERT-In in your SIEM.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We ran ProxySG for over a decade. Edge SWG on 7.4 kept our policy layer intact, so the upgrade was hardware, not redesign.”
“One per-user licence now covers branches on the appliances and the sales team on Cloud SWG. Renewal is a single line item.”
“Content Analysis flagged a macro-laden invoice that our endpoint tool had missed. Several engines on the proxy earn their keep.”
“The inspection team wanted proxy logs on our own servers in Pune. Having Edge SWG in our data centre made that a short meeting.”
“The 7.3 end-of-life notice forced our hand. Start the 7.4 move early; certificate and policy testing took us longer than planned.”
“Getting a price took two partners and a month. Hardware and the suite arrived on separate lines, so budget for both of them.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the secure web gateway market — tap any vendor to see why it sits where it does.
TechBag On-Prem Web Proxy Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Per-user WPS plus appliances; quote only.
Off-Site Reach × Inspection Depth
The grid nobody publishes — how far a gateway’s policy reaches beyond your own racks vs how much it can do with the traffic it opens.
On site, with Cloud SWG on one policy; Content Analysis, isolation, SSL offload.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Symantec Edge SWG vs the web gateway field
Against Skyhigh SWG On-Prem, Fortinet FortiProxy, Forcepoint Web Security, Kaspersky Web Traffic Security and Zscaler Internet Access — on deployment, TLS, remote users, policy, price, add-ons, lifecycle and India.
| Dimension | Symantec Edge SWG | Skyhigh Secure Web Gateway On-Prem | Fortinet FortiProxy | Forcepoint Web Security | Kaspersky Web Traffic Security | Zscaler Internet Access |
|---|---|---|---|---|---|---|
| What it is | ProxySG, now Symantec | Ex-McAfee gateway | Fortinet’s proxy | Cloud SWG with DLP | Self-hosted gateway | Cloud-only proxy |
| Deployment | Box, VM, private cloud | Appliance or VM | Three boxes or a VM | Cloud, agent, old line | VM image or package | Nothing on site |
| TLS inspection | Full, plus SSL offload | Full, RSA to 4096-bit | Full, hardware-assisted | Full HTTPS | Full, four SSL modes | Full, in the cloud |
| Off-network users | Through Cloud SWG | Needs a cloud licence | No roaming agent | SmartEdge agent | No roaming agent | Client Connector |
| One policy with cloud | Universal Policy | On 12.2, not yet 13.0 | FortiSASE is apart | Cloud and SmartEdge | No cloud service | Cloud is the policy |
| Cloud app control | Inline; API via CloudSOC | Inline; CASB apart | Inline CASB only | Inline; API is extra | No CASB | Inline and API |
| Threat protection | Content Analysis | DLP in; sandbox extra | AV, IPS, sandbox in | Inline DLP built in | Malware and phishing | Sandbox, DLP, RBI |
| Pricing model | Per user + hardware | Per user, via partners | Device + 500-user lots | Per user, yearly | Per user, in bands | Per user, by edition |
| Published entry price | Quote; UK MSRP £56.25 | Not published | Not published | $55/user/yr listed | Not published | ~$6–12/user/month |
| Included vs add-on | Suite in; boxes extra | Anti-malware extra | DLP, isolation extra | RBI, IP, API extra | In Total Security | Editions add depth |
| Hardware and scale | Sized by appliance | Five E and F models | 6,000 to 60,000 users | Cloud capacity | 20-node clusters | 500B+ a day |
| Lifecycle and patching | 7.4 LTR; 7.3 ends 2026 | 12.2.25; portal CVEs | Run 7.6.6 or later | Cloud; 8.5.7 on-prem | Supported to 2027 | Nothing to patch |
| India and logs | Your racks; Delhi PoP | Your site; India logs | Your site, your logs | India edge; US logs | Your servers | Four Indian cities |
| Best fit | ProxySG renewals | McAfee-era estates | Fortinet networks | DLP-led, 500+ users | Kaspersky shops | No proxy hardware |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Symantec Edge SWG if…
- ✓You run ProxySG or Advanced Secure Gateway today and want a supported SGOS 7.4 path without rebuilding web policy
- ✓Decrypted web traffic must be inspected on hardware or virtual appliances inside your own Indian data centre
- ✓You want office and remote staff on one per-user licence, with Cloud SWG taking the roaming side
Compare alternatives if…
- ✓You want a published price to budget from — Forcepoint lists $55 per user a year on AWS Marketplace
- ✓Most staff work away from any office — Zscaler Internet Access has no appliance to run at all
- ✓Your network is built on Fortinet — FortiProxy uses the FortiGuard ratings your firewalls already rely on
Do not expect…
- ✓A Broadcom list price, or appliance hardware inside the per-user suite
- ✓Laptops covered off the network without Cloud SWG, or API scanning of SaaS without CloudSOC
- ✓SGOS 7.3 support beyond about December 2026 — the move to 7.4 is not optional
Symantec Edge SWG is one of 44 secure web & DNS products TechBag carries. The Secure Web & DNS guide narrows them to a shortlist and shows the reasoning. →
What does a split web edge cost you?
Drag the sliders (users behind the proxy; IT-hour cost). Estimates model admin and helpdesk time spent maintaining separate rules for office and remote users, cleaning up web-borne malware and working through blocked-site requests at an assumed 1.5 hours per user a year, with 70% of it removed by one inspecting proxy sharing its policy with the cloud. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote only. Broadcom publishes no list price and sells through partners in its Catalyst programme; Westcon-Comstor distributes across APAC, India included. Most buyers take Edge SWG inside the Web Protection Suite, a per-user, per-year licence that also covers Cloud SWG and includes Content Analysis, sandboxing, risky-site isolation and threat intelligence; appliance hardware is bought separately. A UK G-Cloud reseller lists the suite at £56.25 per user a year (MSRP, not a Broadcom price). TechBag maps your SGOS versions and appliances first, then quotes in INR with GST.
Web Protection Suite
Best for sites plus remote staff
- Per user, per year; Cloud SWG included
- Content Analysis, sandbox and isolation in
- Appliance hardware quoted separately
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Edge SWG appliances
Best for inspection kept on site
- S210 or S410 hardware, or a virtual appliance
- SGOS 7.4, the long-term release
- SSL Visibility offload sold apart
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Is every gateway on SGOS 7.4? Support for 7.3 ends around December 2026, two years after Broadcom’s notice.
Do you still run SG-S or ASG-S 200, 400 or 500 hardware? Those models fall under Broadcom’s end-of-life notice.
Is the quote for WPS, covering Edge SWG and Cloud SWG per user, or the on-site gateway only? Hardware is priced apart.
Are Content Analysis, Web Isolation, Intelligence Services and SSL Visibility named lines, or included through WPS?
How are laptops covered off the network: Cloud SWG via the SES agent, or a VPN? The WSS Agent is end-of-line.
Who owns the interception CA, which apps pin certificates, and will decryption volume call for SSL Visibility hardware?
Where do logs go: your SIEM, or Hosted Reporting for 365 days? Ask where Hosted Reporting stores them before you agree.
Which Catalyst partner is quoting? Westcon-Comstor distributes Symantec across APAC, with India added in 2024.
Questions buyers ask
Ready to evaluate Symantec Edge SWG?
Map each gateway’s SGOS release and appliance against Broadcom’s end-of-life notice first, or let a TechBag advisor scope a 7.4 pilot on one site.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.