Symantec · ProxySG

The ProxySG renewal lever most enterprises miss.

It is not the appliance refresh. It is not the bandwidth tier. It is the migration optionality the contract gives the buyer at renewal, which Broadcom has good reason not to draw attention to.

By The Negotiation Desk · Symantec · Archetype: The Lever

Published 19 May 2024

The ProxySG renewal motion has a lever that is invisible to most buyers because the seller does not raise it. The lever is the buyer's optionality to migrate web security workloads to a cloud delivered service at the moment of renewal, with the in force ProxySG contract acting as the credit basis for the move. Broadcom would rather the buyer treat the renewal as a hardware refresh decision. The renewal is a portfolio decision, and the buyer who frames it that way changes the entire shape of the conversation. This article walks the lever, the contract mechanics that support it, and the numbers we have measured on live deals.

Most ProxySG estates installed between 2018 and 2022 are on or near the end of their supported hardware life. The seller's renewal motion presents the choice as a hardware refresh, with a discounted appliance plus an extended support contract, or a like for like renewal at the existing tier. Neither of those framings reflects the actual choice the buyer has. The actual choice is whether to refresh on premises, migrate to Cloud SWG under the existing Symantec relationship, or migrate off Symantec entirely. Each of those choices has a different price, a different exit cost, and a different long term position. The lever is making the seller compete with two of those choices, not just the third one.

What the contract usually says

The ProxySG contract typically includes a migration provision that allows the buyer to convert unused entitlement value into Cloud SWG entitlement at renewal, sometimes at a defined rate, sometimes at a negotiated rate. The provision is rarely highlighted by the seller because invoking it shifts the conversation from a hardware refresh to a portfolio migration, which is a different commercial motion. The provision is also rarely highlighted because it gives the buyer a credible exit from the on premises product without writing off the prior investment.

Where the provision is not in the contract, it can be added at renewal as a condition of signature. The seller will resist this language if it is presented as the first ask, because the seller's commercial model anchors to the on premises footprint. The seller will accept this language when it is presented as a condition of any renewal at the buyer's preferred terms, because the alternative is the buyer issuing a request for proposal to other web security providers.

Why the lever moves the price

The lever moves the price for two reasons. The first is that it shifts the buyer's position from captive to mobile. A captive buyer renewing on premises hardware has a small set of choices, all of which the seller controls. A mobile buyer choosing between three commercial paths has a larger set of choices, only one of which the seller controls. The seller prices captive renewals differently than mobile renewals. The Desk has seen the same product, the same scope, and the same buyer move 17 to 28 percent in quoted value depending on which framing was on the table at the opening meeting.

"We did not move a single appliance. We told the seller we were testing the Cloud SWG path and the third party alternative path in parallel. The quote on the hardware refresh dropped by 24 percent in nine days."Practice Lead, The Desk

The second reason is that the cloud migration provision creates a credit basis the buyer can deploy in two directions. The credit basis can be used to fund a Cloud SWG migration that keeps the spend with Symantec, or it can be used as a depreciation argument against the on premises renewal price. Either deployment reduces the renewal value the seller can defend. The seller's preference is that the buyer never knows the credit basis exists.

The three deployment patterns we see

The lever has produced three deployment patterns on live deals. The first is the partial migration. The buyer migrates a subset of the estate to Cloud SWG, typically remote and roaming users, while renewing the on premises footprint for the data centre dependent traffic. The credit basis funds the migration. The renewal prices against the reduced on premises footprint. The seller closes the renewal under the Symantec banner.

The second is the full migration. The buyer migrates the entire estate to Cloud SWG at renewal, retires the on premises footprint, and uses the credit basis to fund the migration cost. The renewal value moves to the cloud product but the total spend with Symantec rises by less than the seller's opening on premises renewal would have produced. The seller closes the renewal but at a different shape.

The third is the credible exit. The buyer signals the intent to issue a request for proposal to other web security providers, with the on premises ProxySG estate as a depreciation argument. The seller responds by pricing the on premises renewal more sharply than the standard motion would produce. The buyer renews on premises but at a price that reflects the credibility of the alternative path. The Desk has seen credible exit framings produce 22 to 41 percent reductions on opening quotes, without the buyer ever issuing the request for proposal.

What the seller does in response

The seller's first response is usually to deny that the migration provision exists in the contract. The buyer's first counter is to produce the contract language. Where the language is ambiguous, the buyer's second counter is to cite the seller's published Cloud SWG migration guidance, which references a credit framework. Where neither is present, the buyer's third counter is to make the provision a condition of any renewal at the buyer's preferred terms. The Desk has not yet seen this third counter fail, because the seller's commercial alternative is a renewal that does not close.

The numbers we have measured

The Desk has run this motion on ProxySG renewals ranging from a $1.4M annual contract to a $9M annual contract in the last 18 months. The pattern across them is consistent. The on premises renewal opens at a quoted uplift of 18 to 34 percent against the in force price. When the lever is on the table at the opening meeting, the close ranges from flat to 15 percent below the in force price, depending on which deployment pattern the buyer chooses. When the lever is not on the table, the close ranges from a 9 percent uplift to a 22 percent uplift.

Typical opening uplift on ProxySG renewal quote18% to 34%

Close with lever on the tableflat to 15% below in force

Close without lever on the table9% to 22% above in force

Effective swing the lever creates25% to 50% of contract value

What we have seen on live deals

A Fortune 200 manufacturer brought us a ProxySG renewal in late 2025. Opening quote priced a hardware refresh at $5.8M total contract value over three years. The Desk identified the migration provision in the prior contract amendment. The buyer signalled a partial migration of remote users to Cloud SWG, funded by the credit basis, and a sharply scoped on premises renewal for the data centre traffic. The close on the on premises renewal was $2.6M over three years, with a Cloud SWG migration funded entirely by the credit basis. Total Symantec spend over the term landed at $4.1M, against an opening of $5.8M.

A regional bank in EMEA brought a smaller ProxySG renewal in the first quarter of 2026. Opening quote $1.9M for a hardware refresh. The credible exit framing was the deployment used. The buyer did not migrate, did not issue a request for proposal, and did not announce an intention to do either, but signalled that both were being evaluated in parallel with the renewal. The closing quote was $1.3M, a 32 percent reduction from the opening, without the buyer leaving the Symantec footprint.

The takeaway

The ProxySG renewal is not a hardware refresh decision. It is a portfolio decision. The lever is the migration optionality the contract gives the buyer at renewal, which the seller has good reason not to draw attention to.
Three deployment patterns produce outcomes. Partial migration, full migration, and credible exit. Each one shifts the buyer's position from captive to mobile and prices the renewal accordingly.
The seller will resist the lever if it is the first ask. The seller will accept the lever when it is a condition of any renewal at the buyer's preferred terms. The buyer's job is to make the framing the floor of the conversation, not the ceiling.