- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Skyhigh Security
Security service edge for cloud and on-premises gateways under one policy— Skyhigh Security’s SSE suites, secure web gateway, CASB, ZTNA and cloud security, and how each one is licensed. This hub covers seven Skyhigh products.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Seven intel pages. SSE, secure web gateway, CASB, ZTNA, firewall and isolation.
Skyhigh’s line, product by product — every linked card is a full intel page, from the SSE suites and the cloud and on-premises web gateway to CASB, Private Access, firewall and isolation.
Skyhigh Security Service Edge
Web, cloud-app and private access in one policy.
Essential, Advanced and Complete suites; Advanced adds unlimited sanctioned SaaS, and Complete adds Private Access and Cloud Firewall.
Skyhigh Secure Web Gateway
A cloud proxy with SSL inspection and DLP.
Inline emulation sandboxing, DNS-layer controls and Secure Browser Controls, plus risky-web isolation on SWG Advanced; FedRAMP High.
Skyhigh Secure Web Gateway On-Prem
Formerly McAfee Web Gateway, run on your own kit.
Hardware appliances or VMs on main release 12.2.25; version 13.0 is in limited availability and cannot yet sync policy to the cloud.
Skyhigh CASB
Finds shadow IT and governs sanctioned SaaS.
A 40,000+ cloud service registry, API integration for 40 apps and forward or reverse proxy, licensed per user as pooled or unlimited.
Skyhigh Private Access
Per-app access to private apps, no network VPN.
A connector VM beside each app dials out to Skyhigh’s PoPs; posture checks, built-in DLP and isolated access for unmanaged devices.
Skyhigh Cloud Firewall
Inspects non-web traffic in the cloud.
Client Proxy sends non-web traffic over a WireGuard tunnel for deep packet inspection; sites connect over IPsec; licensed separately.
Skyhigh Remote Browser Isolation
Renders risky sites away from the endpoint.
Risky-web mode is included from Cloud SWG Advanced upward; Full Isolation is a paid add-on counted in seats, with VIP seats reservable.
Skyhigh DSPM
Platform & engineData security posture management that discovers and classifies data across SaaS, IaaS, PaaS, web, email and private apps, positioned inside Skyhigh SSE and launched in 2025. Skyhigh documents no separate SKU or licensing for it, so TechBag does not page it on its own yet
Secure Browser Controls
Platform & engineA ruleset imported into the secure web gateway that governs uploads, downloads, clipboard, printing and the context menu in any browser. Skyhigh’s docs call it a set of rules within SSE, so it is covered on the Secure Web Gateway and SSE pages
Skyhigh AI
Platform & engineA solution, not a product: user behaviour analytics, machine-learning classifiers, shadow-AI discovery and DLP for over 1,900 generative AI apps, plus API-mode DLP for Microsoft 365 Copilot and ChatGPT Enterprise. Covered on the SSE and CASB pages
Advanced DLP (EDM and IDM) and OCR
Platform & engineCapability add-ons on top of the DLP that ships in every Skyhigh SKU: exact and indexed data matching, and text recognition inside images. They are explained on the SSE, Secure Web Gateway and CASB pages
Skyhigh Security sells across 5 of the products TechBag carries in network security & SASE. The Network Security & SASE guide shows how the category splits and which part is yours. →
Why “one policy, cloud and on site” is the whole story
Many SSE services run only in the vendor’s cloud. Skyhigh also sells the gateway that once ran as McAfee Web Gateway on your own appliances, and its policy engine writes a rule once and enforces it in both places. For estates that cannot move every user to the cloud at once, that hybrid path is the reason to shortlist it.
Skyhigh Security Cloud
One tenant runs web, CASB, Private Access and firewall policy; log storage can be pinned to India among eight selectable locations.
MOWGLI policy engine
The unified policy engine behind Hybrid Mesh SSE, pushing the same rules to the SSE cloud and to on-premises enforcement points.
Secure Service Gateway
Appliances or VMs that keep a local policy cache through internet brownouts and reach cloud DLP and isolation through a hybrid gateway.
Client Proxy and Mobile Client
Client Proxy steers Windows and macOS traffic and posture; Mobile Client covers Android and iOS through Intune or Workspace ONE.
Start with the job — web, SaaS apps or private apps — then decide between a suite and single SKUs.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
Visionary, SSE Magic Quadrant 2024
the second year running as a Visionary, by Skyhigh’s own account on its CASB page
Niche Player, SSE Magic Quadrant 2025
a step down from Visionary; Cloudflare, iboss, Versa and Broadcom were Niche Players that year too
Named in the SSE Magic Quadrant 2026
published 29 July 2026; Skyhigh says only that it was named, and TechBag could not verify a quadrant
First of eight, Advanced SSE use case, 2026
a 4.2/5 score in the 2026 Critical Capabilities for SSE, with 4.12/5 for private application access
Top score for Protect Data, 2024
the highest score in the Protect Data use case of the 2024 Critical Capabilities for SSE
Launched by STG
as the SSE business carved out of McAfee Enterprise, while sibling company Trellix took the XDR business
High authorisation for Cloud SWG
the cloud web gateway holds FedRAMP High, and Skyhigh also cites Australia’s IRAP assessment
Client Proxy flaws fixed in 4.9.0
CVE-2024-0311, 0312 and 0313, all Medium; Client Proxy 4.8.x reached end of life on 1 May 2026
The company in six figures
See the platform, hear the pitch
Why Choose Skyhigh Security?
A July 2025 pitch for Skyhigh’s data-first SSE; a brand film, not a product demo.
Skyhigh Security Overview
A May 2024 overview of the company and its platform, recorded before the 2025 Niche Player placement.
2026 Cybersecurity Predictions | Thyaga Vasudevan | Cyber 60
A February 2026 talk in which Skyhigh’s EVP of Product looks at the year ahead for data and AI security.
Where Skyhigh Security sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Skyhigh Security Across Its Solution Areas
Each dot is a Skyhigh Security solution area: competitive position vs category momentum.
Ranked first of eight in the Advanced SSE use case of the 2026 Critical Capabilities, though the 2025 Magic Quadrant placed Skyhigh as a Niche Player.
On-Prem Gateway Coverage × Cloud SSE Breadth
How far each vendor runs web security on your own appliances or VMs vs how much of SSE it delivers from its cloud.
One policy engine across its own appliances, VMs and the SSE cloud, with log storage selectable in India; every SKU is quoted through partners.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Skyhigh Security?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What problem is forcing the decision?
2. Where must it run?
3. Who will own it?
Seven products, one policy
SSE suites bundle the pieces; the web gateway, CASB, Private Access, firewall and isolation can also be bought one by one.
Read →Cloud gateway or on-prem?
Cloud SWG runs in Skyhigh’s PoPs; the on-prem line runs on your appliances or VMs. Hybrid mode manages both from a single policy.
Read →Names that changed
Skyhigh began in 2022 as McAfee Enterprise’s SSE business; older quotes and appliances may carry the former name McAfee Web Gateway.
Read →Suite or single SKU?
Essential adds Shadow IT CASB to the gateway, Advanced adds unlimited sanctioned SaaS, and Complete adds Private Access and Cloud Firewall.
Read →Logs, India and CERT-In
Choose India as the log-storage location, then plan for retention: 100 days by default, so CERT-In’s 180 needs the add-on or an export.
Read →Where Skyhigh SSE fits
The Network Security & SASE category’s SASE & SSE guide compares cloud-delivered security platforms, the market in which Skyhigh’s SSE suites compete.
Read →The acronym decoder
Every term on these pages, in one place- SSE
- Security service edge: web gateway, CASB and zero trust access delivered as one cloud service.
- SWG
- Secure web gateway: a proxy that decrypts and inspects web traffic against policy.
- CASB
- Cloud access security broker: visibility and control over the SaaS apps people use.
- ZTNA
- Zero trust network access: per-application access in place of a network-wide VPN.
- FWaaS
- Firewall-as-a-service: firewall inspection of non-web traffic, run in the cloud.
- RBI
- Remote browser isolation: pages render remotely and only safe output reaches the user.
- CSPM
- Cloud security posture management: finding misconfigurations in cloud accounts.
- Shadow IT
- Cloud services staff use without IT approval; CASB Shadow IT discovers them.
- Hybrid Mesh SSE
- Skyhigh’s design that lets cloud and on-site gateways enforce one shared policy.
- GAM
- Gateway Anti-Malware: Skyhigh’s machine-learning emulation sandbox in the gateway.
- Skyhigh Client Proxy
- The Windows and macOS agent that steers traffic and sends device posture.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Decide suite or single SKUs
Skyhigh still sells individual SKUs. Compare a suite against the web gateway or CASB alone before you pay for parts you will not deploy.
Count users, then isolation seats
Everything is quoted per user per year, except Full Isolation, which is counted in seats; risky-web isolation needs no seats at all.
Map the add-ons to the suite
Private Access and Cloud Firewall are add-ons below SSE Complete; Advanced DLP, OCR and longer log retention are add-ons on every suite.
Set log location and retention
Pick India as the log-storage location, then size retention: 100 days by default, 365 with the add-on, which covers CERT-In’s 180.
Patch the agents and appliances
Move Client Proxy off 4.8.x, which reached end of life on 1 May 2026, and keep on-premises gateways on the 12.2.x main release.
Get it priced in rupees
Skyhigh publishes no price and sells only through partners. TechBag scopes the suite, users and seats and quotes the total in INR with GST.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| Security Service Edge | Per user per year · Essential, Advanced or Complete suite · Complete adds Private Access and Cloud Firewall | Quote through partners | One SSE vendor |
| Secure Web Gateway | Per user per year · Cloud SWG or Cloud SWG Advanced, which adds risky-web isolation | Quote through partners | Cloud web security |
| SWG On-Prem | Appliance or VM licence (WSG-S) · DLP included, threat protection an add-on | Quote through partners | On-site web proxy |
| CASB | Per user · Shadow IT, or sanctioned apps as Pooled (per app) or Unlimited | Quote through partners | SaaS visibility and control |
| Private Access | Add-on to Cloud SWG and lower suites · included in SSE Complete | Quote through partners | VPN replacement |
| Cloud Firewall | Licensed separately · included in SSE Complete | Quote through partners | Non-web traffic |
| Remote Browser Isolation | Risky-web mode included from Cloud SWG Advanced · Full Isolation per seat | Quote per seat | Risky and unknown sites |
Every Skyhigh SKU is quote-only and sold through partners: per user per year for the suites and single products, per seat for Full Isolation. TechBag gets the quote itemised in INR with GST.
Five pitfalls that cost buyers quarters
Trusting a Marketplace listing
Skyhigh’s AWS Marketplace listing carries a placeholder price for private offers and an analyst claim that is wrong. Use a partner quote.
Assuming Cloud SWG includes CASB
Cloud SWG controls apps through its registry, but Shadow IT CASB starts at SSE Essential and API-mode CASB needs the CASB licence.
Upgrading straight to 13.0
On-premises SWG 13.0 is in limited availability and cannot yet sync policy to the cloud. Hybrid estates should stay on 12.2.x for now.
Stopping at 100 days of logs
Web-access logs are kept 100 days by default. CERT-In expects 180, so budget the retention add-on or export the logs to your SIEM.
Reading DPDP readiness as a guarantee
“Compliance-ready for India’s DPDPA” is Skyhigh’s own claim. Confirm the log location, retention and processing terms in the contract.
The evaluation kit
Each intel page carries an 8-question vendor checklist and a value calculator:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Four trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**TechBag’s illustrative estimate, not a quoted analyst figure. The takeaway: buyers are moving from standalone web gateways to SSE platforms and zero trust access — which is why Skyhigh sells suites alongside its gateways.
Hybrid gateways, one policy
Skyhigh documented its Hybrid Mesh design in August 2026: one policy engine for cloud and on-site gateways, with a local cache for brownouts.
What it means for you
Ask any SSE vendor how its on-site and cloud policy stay in step.
Data security inside SSE
Skyhigh launched integrated DSPM in 2025 and ranked first of eight in Gartner’s Advanced SSE use case in 2026.
What it means for you
Judge SSE on data controls, not only on web filtering.
Generative AI as a data channel
Skyhigh applies inline DLP to over 1,900 AI apps and API-mode DLP to Microsoft 365 Copilot and ChatGPT Enterprise.
What it means for you
List the AI apps in use before you write a DLP policy.
Shifting SSE analyst placements
Gartner placed Skyhigh as a Visionary in 2024 and a Niche Player in 2025; it says only that it was named in the 2026 report.
What it means for you
Weigh use-case scores and the roadmap, not just the quadrant.
Questions buyers ask about Skyhigh Security
Ready to shortlist Skyhigh Security?
Open any of the seven intel pages for the deep dive, or let a TechBag advisor build the case with you — the users and seats to license, the suite or single SKUs, quotes, trials, GST invoicing and lifecycle support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.