VCF renewals ▲ 31.4% YoY· Symantec EDR true ups ▲ 18%· Carbon Black avg quote uplift +22%· Mainframe MIPS capacity squeezes ▲· Audit notices ▲ 47% QoQ· Our last 10 deals avg −41% on quote· VCF renewals ▲ 31.4% YoY· Symantec EDR true ups ▲ 18%· Carbon Black avg quote uplift +22%· Mainframe MIPS capacity squeezes ▲· Audit notices ▲ 47% QoQ· Our last 10 deals avg −41% on quote
Wednesday · 27 May · MMXXVIIssue II
Independent · Buyer SideLive
Cloud SWG and Email
Cloud Secure Web Gateway · Email Security.cloud · ATP integration The migration economics nobody mapped before the renewal arrived. Not affiliated with Broadcom Inc.
The Lead · Product Brief · Cloud SWG and Email

The Cloud SWG quote arrives priced as a migration. The migration is the negotiation.

One live Cloud SWG renewal and one Email Security cycle this quarter. Concession band 25 to 45 percent. The vendor alternatives that change the math before the conversation starts.
By The Negotiation Desk · 2 live · trailing avg −34% on quote

Cloud SWG arrives at the renewal table with a quote that is not really a renewal. It is a forced migration off ProxySG hardware, priced on the Cloud SWG list and bundled with an Email Security.cloud uplift. The buyer who does not have an independent migration cost map for Zscaler, Netskope and the email alternatives has nothing to push back with. The seller knows this. The desk's job is to produce the map first, then read the quote against it.

Email Security.cloud has a separate problem. ATP integration is being priced as an inclusion in some quotes and as a separate SKU in others. The version that lands on any given buyer's desk tends to track the rep's quota position, not the contract structure. Two buyers on the same product can receive quotes that differ by a wide band on identical seat counts. The fix is a current SKU map and a comparison against the alternative ATP posture.

"The Cloud SWG number arrived as if Zscaler did not exist. It did, and the email side moved more than the gateway once we said so."VP Infrastructure · Insurance group

The third moving piece is the migration window itself. ProxySG hardware is on a published end of life schedule. The Cloud SWG conversion can be priced as a hard cut, as a parallel run, or as a phased migration with the legacy hardware in extended support. Each of those has a different total cost. The default quote almost always assumes the most expensive of the three. Renegotiating the window is often the single largest line item on the deal.

The desk reads the contract against the deployment, builds the alternative vendor cost comparison, and rewrites the renewal to match the buyer's actual migration timeline, not the seller's preferred one.

§ 02

Outcomes on gateway and email

Verified · Net of fees · Signed contract delta
Typical reduction
−34%
Average across trailing Cloud SWG and Email renewals.
▲ range 25 to 45%
Largest delta
$7.4M
Three year savings on a multi region Cloud SWG and Email combined cycle.
▲ Q3 2025 case
Migration window
+14mo
Avg extension on ProxySG hardware support negotiated alongside conversion.
▲ vs default quote
Renewals delivered
20+
Combined Cloud SWG and Email contract cycles closed by the practice.
▲ Q2 cumulative
§ 04

What we negotiate

Cloud SWG and Email · The clauses that decide the line
#Contract elementWhat we changeTypical liftDifficulty
01
Migration window
ProxySG support extension against Cloud SWG conversion timing.
Default quote assumes hard cut. Phased and parallel are negotiable.
−12 to −24%Medium→
02
ATP inclusion
Whether ATP is bundled with Email Security.cloud or quoted separately.
The inclusion path is the silent reduction on most current Email quotes.
−8 to −18%Medium→
03
Vendor comparison anchor
Independent migration cost map against Zscaler, Netskope and the email alternatives.
The seller's quote prices the absence of the comparison.
−10 to −22%Medium→
04
Multi region structure
Region by region pricing on combined gateway and email deployment.
Multi region quotes routinely apply the same tier to regions that should not carry it.
−6 to −14%Low→
§ 05

Field notes · Gateway

Quarterly intelligence from live Cloud SWG and Email desks
Symantec · ExitQ2 · 11 min read

What Cloud SWG migration economics look like against Zscaler

The migration map is the negotiation. Here is the full cost comparison the desk builds before any Cloud SWG renewal call, and the three line items the default quote almost always overprices.

Read essay →
Symantec · LeverQ2 · 8 min read

The ProxySG renewal lever most enterprises miss

ProxySG renewals look like forced migrations to Cloud SWG. The migration is real. The forced part is negotiable. Here is what the desk does in the renewal window before the migration conversation begins.

Read essay →
Symantec · AuditQ2 · 9 min read

What to do when a Symantec audit notice arrives

Audit notices arrive sixty to ninety days before renewals more often than not. The first seven days set the posture for the whole defense. Here is the desk's standard sequence.

Read essay →
Adjacent product · Endpoint and EDR desk →   DLP and ProxySG desk →
Correspondence Invited

Write before the quote becomes a position.

Two analyst calls. No pitch. We tell you what we would do, what the leverage actually is, and whether we are the right firm. If we are not, we will say so.
Who we work for. Buyer side only. No reseller relationship with Broadcom. No partnership of any kind. We do not earn anything from products sold or renewed. Only from outcomes delivered against the contract.