Three signs your Symantec ProxySG renewal is overpriced.

Every ProxySG renewal quote we have read in 2026 contained at least one line item that did not match the buyer's live secure web gateway estate. Two of three carried more than one. The shape of the inflation is familiar. The seller prices what was bought in the prior commit, with an uplift band against list. The buyer pays for traffic profile, appliance count, or feature set that no longer reflects what is actually deployed. The Desk reads every ProxySG renewal in this order. Unit count first, feature set second, uplift anchor third. Total price is the last line on the page, not the first.

The three tells below sit inside the quote document. None of them require a third party tool. None of them require an audit conversation. They require a buyer side read against the current console and the prior signed contract. That is the work. The renewal becomes negotiable the moment the buyer can produce the live numbers and hold them against the quoted numbers in writing.

ProxySG sits at an awkward seam in the Symantec portfolio. The on premise appliance line has narrowed since 2022. Cloud SWG has absorbed motions that used to run on the box. The Email Security overlap has tightened. None of these moves are visible to the buyer at quote time unless the buyer reads against the live config. The seller's record updates only when something is bought, terminated, or true upped. Between those events, the record drifts.

This is the structural reason every ProxySG renewal in our last twelve month sample carried at least one inflated line item. It is not adversarial. It is a feature of how Broadcom maintains the entitlement record under Symantec. The fix is mechanical. Read each line of the quote against the live estate. The arithmetic does the rest.

Tell one: the appliance or pooled user count overshoots the live estate

The first tell is the unit count. ProxySG is priced either by physical or virtual appliance, by pooled user, or by managed seat depending on the contract era. The unit count on the renewal quote almost always anchors to the prior commit rather than to the live count. Buyers who shut down sites, virtualised appliances, migrated traffic to Cloud SWG, or removed retired estates rarely update the seller. The seller has no reason to ask.

We see overshoot bands ranging from 8 to 32 percent against the live count, with a median near 16 percent in the 2026 sample. On a $2.6M ProxySG renewal that translates to roughly $415,000 of price for capacity that is no longer in production. The seller cannot see the production state. Only the buyer can produce the current appliance manifest or pool population. Only the buyer can hold the quote against it.

Tell two: the feature SKU set has not been re read since the prior renewal

The second tell sits in the feature SKU set. ProxySG packages have reshaped under Broadcom. Modules that were sold separately have been bundled. Bundles have been split. Buyers who roll the prior SKU list forward without re reading end up paying twice for overlapping protection, or paying for modules they stopped operating in 2023. The most common pattern we see is duplicate coverage between an in force ProxySG feature SKU and a Cloud SWG SKU on the same user population.

The fix is mechanical. Pull the current ProxySG configuration. Match each module on the quote against an active configuration item. Flag every duplicate, every superseded SKU, and every module the buyer has stopped operating. The seller's first answer will be that the SKUs are not separable. The second answer, when the buyer holds and produces evidence, is meaningfully different.

"The quote priced fourteen appliances. The console showed nine in production and two in lab. The feature SKU set still carried a malware analysis module that had been removed eighteen months earlier."ProxySG Lead, The Desk

Tell three: the uplift is anchored to a list that nobody negotiated

The third tell is the uplift line. ProxySG renewals in 2026 carry an uplift over the in force unit price. The uplift is usually quoted as a percentage against list, sometimes as a roll forward against a published bundle price. The published list was not the basis of the prior contract. It was not the basis of the prior unit price. It is the seller's most flexible anchor, and pricing the renewal against it builds in a recovery the buyer never agreed to in the first place.

We have seen uplift bands quoted at 18 to 38 percent against list that, when reanchored to the prior negotiated unit price, collapse to single digit growth or to flat. The reanchoring is not a discount conversation. It is a question of which number the renewal should be priced against. The buyer is not asking for a concession. The buyer is asking for the price to reflect the contract that was actually signed.

How the three tells compound

The three tells rarely appear alone. In a typical ProxySG renewal we see two of three, and in roughly one of every four renewals we see all three. The unit count overshoots the live estate. The feature SKU set carries one or two superseded modules. The uplift is anchored to list rather than to the prior negotiated price. Each tell on its own is a 6 to 14 percent question. Together they move a renewal by 22 to 38 percent on quoted value, before any structural levers come into play.

The reason this matters is sequence. If the entitlement read happens first, every later conversation is framed against a corrected baseline. If the entitlement read happens last, the renewal closes against the seller's number, the corrections become an after the fact dispute, and the buyer ends the cycle worse positioned than they started it.

What we have seen on live deals

A Fortune 500 retailer brought a $3.1M ProxySG renewal to the Desk in early 2026. The quote priced 22 appliances across 11 sites. The current production state was 14 appliances across 8 sites, with the rest decommissioned or virtualised during a network refresh in 2024. Two feature SKUs on the quote had been retired in the prior amendment. The uplift was 31 percent against list and 6 percent against the prior unit price. The entitlement correction alone removed $940,000 from the quote. The structural conversation that followed produced another 14 percent. The renewal closed at $1.7M against a $3.1M opening.

A regional bank in EMEA brought a smaller ProxySG renewal in the same quarter. Same pattern. Appliance count overshot by 19 percent. One legacy SKU still being carried. Uplift anchored to list. The correction alone produced a 23 percent reduction before any restructure. Different size, different sector, the same three tells.

The reading order on the quote

When a ProxySG renewal quote arrives, the Desk reads it in a specific order. First the appliance or pooled user count, against the buyer's most recent console manifest. Second the feature SKU mix, against the active configuration. Third the uplift, against the prior negotiated unit price rather than against list. Only after those three reads is the total price line worth opening. The reverse order, where total price is read first and line items second, is how ProxySG renewals close at quoted value rather than at corrected value.

The takeaway

• The ProxySG quote prices the seller's entitlement record, not the live estate. The two drift in every renewal we have reviewed, and the drift lands on the buyer when nobody reads the quote against the current configuration.
• Three tells matter most. Unit count against the live console. Feature SKU mix against the active configuration. Uplift against the prior negotiated unit price rather than against list. Each is a 6 to 14 percent question on its own.
• The entitlement read goes first in the buyer side motion. It is the cheapest piece of work, the cleanest argument, and the one the seller has the least ground to push back on. It also reshapes every conversation that follows.