Blue Coat and ProxySG End of Life: Migration Planning
- ProxySG end of life is set per SGOS version and per appliance model, not as one date.
- SGOS 6.7 reached end of life on December 31, 2023, and no longer receives fixes.
- SGOS 7.3 gets no new features after 2024, and its upgrade window runs through December 2026.
- SGOS 7.4 removes the Java Management Console and VPM, forcing a policy-workflow change even for upgraders.
- Teams still on SGOS 7.3 should choose between upgrading and modernizing and start this quarter.
Blue Coat ProxySG is now Broadcom’s Symantec Edge Secure Web Gateway (Edge SWG), running the SGOS operating system. Its end of life is defined per software version and per hardware model. SGOS 6.7 has been end of life since the end of 2023. For SGOS 7.3, Broadcom’s limited-support window runs through December 2026, after which customers are expected to be on SGOS 7.4. Because SGOS 7.4 removes the legacy Java console and policy manager, both staying and leaving require a change to how policy is managed.
SGOS lifecycle at a glance
Three SGOS releases matter now: 6.7 is retired, 7.3 is in limited support through December 2026, and 7.4 is the current long-term release.
| SGOS version | Role | Lifecycle status (per Broadcom) |
|---|---|---|
| 6.7 | Retired | End of life since December 31, 2023 |
| 7.3 | Previous long-term release | End-of-life announcement date December 31, 2024. No new features after that date. Limited support for critical and high security vulnerabilities; if a fix is delivered in 7.4, Broadcom may recommend upgrading. Customers have two years from the announcement to upgrade to 7.4. |
| 7.4 | Current long-term release | Generally available since July 8, 2023. Java Management Console and Java VPM removed; managed through the Admin Console (SGAC) and Web VPM. |
Source: Broadcom, End of life and product lifecycle for Edge SWG (ProxySG) and Advanced Secure Gateway and Documentation for End of Life ProxySG. Broadcom notes that maintenance releases between December 2024 and the end of December 2026 may include approved exceptions for minor enhancements and security updates, and advises customers to check with their Broadcom team.
Related components
- Hardware. End-of-maintenance and end-of-life dates are model-specific. Broadcom’s lifecycle article covers SG-S200, SG-S400, and SG-S500 appliances, ASG-S200, ASG-S400, and ASG-S500, SSP-S210 and SSP-S410 platforms, and SG-VA virtual appliances. Confirm your model’s dates in the lifecycle PDF attached to that article.
- Management tools. Broadcom states that the Java-based Management Console is not available in SGOS 7.4 and later, and that the Java VPM is also removed. Earlier versions still include them but no longer receive updates (Broadcom).
- On-premises Web Isolation. All versions reached end of life on January 1, 2024. Broadcom now offers browser isolation only as a cloud service (Broadcom).
How to check your ProxySG version and end-of-life status
Check end-of-life status by recording each appliance’s SGOS version and model and comparing both against Broadcom’s lifecycle article.
- Find your SGOS version. It appears on the Management Console or Admin Console dashboard, or run show version from the CLI.
- Record each appliance model. Note the model for every physical and virtual appliance, for example SSP-S410, SG-S500, or SG-VA.
- Check the lifecycle PDF. Cross-reference each version and model against Broadcom’s product lifecycle article to find end-of-maintenance and end-of-life dates.
- List dependent components. Include Management Center, content analysis and sandboxing, ICAP-connected DLP, reporting, and any on-premises isolation.
What end of life means for a secure web gateway
End of life removes new features, then fixes, then support from the device that inspects all of your web traffic.
- No new features. SGOS 7.3 stopped receiving new features at the end of 2024.
- Narrowing fixes. Limited support focuses on critical and high vulnerabilities, and fixes may require moving to 7.4.
- No support path after the window closes. Unsupported software on the device that inspects all of your web traffic is a significant exposure.
- Audit and insurance questions. Running unsupported gateway infrastructure is difficult to defend in compliance audits and cyber insurance reviews.
The catch in “just upgrade”
Upgrading to SGOS 7.4 keeps you supported but removes the Java console and VPM, so it still forces a policy-workflow change.
The obvious response to SGOS 7.3 end of life is to upgrade to 7.4. It is not a like-for-like step. SGOS 7.4 removes the Java-based Management Console and Java VPM that many teams have used for years, and Broadcom directs administrators to the Edge SWG Admin Console and Web VPM instead.
The practical consequence is that staying on Blue Coat still means adopting a new console, retraining administrators, and revalidating policy. Once that work is unavoidable, the real decision is whether to do it on the current platform or on a gateway built for hybrid deployment, integrated data protection, and AI-era traffic.
Your two options
You can upgrade in place to SGOS 7.4 or modernize onto a new gateway, and both require policy work.
Upgrade in place. Move to SGOS 7.4 and refresh any end-of-life hardware. This keeps you supported, but it still requires the console and VPM transition, and it does not address licensing, support, or roadmap concerns. You will face the same decision at the next lifecycle milestone.
Modernize. Replace ProxySG with a gateway that keeps an on-premises footprint where you need it and extends to the cloud when ready. See Blue Coat Alternatives and ProxySG Replacement for evaluation criteria.
A migration plan for Q4 2026
With the SGOS 7.3 window closing at the end of December 2026, a realistic Q4 plan reaches a parallel deployment in about ten weeks:
Weeks 1 to 2: Decide. Confirm versions and models, list dependencies, and decide between upgrading in place and modernizing. If modernizing, confirm whether your current 7.3 deployment needs a bridging upgrade or support arrangement while the new gateway is deployed.
Weeks 3 to 6: Assess and design. Inventory CPL and VPM policy, authentication realms (SAML, Kerberos/IWA), TLS inspection exceptions, ICAP and DLP integrations, and upstream and downstream proxy chaining. Map data sovereignty zones and OT environments that require local inspection.
Weeks 6 to 10: Deploy in parallel. Stand up the new gateway alongside ProxySG. Import and validate policy baselines. Route a pilot group and compare behavior.
Weeks 10 onward: Cut over in phases. Move users and sites in waves after policy acceptance and a tested rollback plan, then decommission ProxySG once traffic has fully shifted and the agreed rollback period has ended.
Larger estates typically run parallel deployment and adoption over six to twelve months. The priority before year end is to get off unsupported software, whether by upgrading or by moving production traffic to the replacement.
What a Blue Coat to Skyhigh migration involves
A Blue Coat to Skyhigh migration is a guided, six-phase process that carries CPL policy forward and validates it with parallel traffic.
Policy does not move between proxy engines as a blind file conversion. Skyhigh re-expresses existing CPL in its unified policy console through a validated import process: rules are imported, reviewed, and tested against parallel traffic before cutover. It is also the best opportunity you will have to retire years of unused rules.
- Assessment and discovery. Inventory appliances, SGOS versions, traffic volume, user counts, authentication realms, ICAP and DLP integrations, and proxy chaining. Export current CPL and VPM policy as the source of truth.
- Policy import and validation. Carry forward rules, categories, and exceptions into Skyhigh’s policy engine, pruning rules that no longer apply.
- Deployment and traffic steering. Deploy Skyhigh SWG on premises, hybrid, or in the cloud, and steer traffic with explicit proxy or PAC files, the Skyhigh Client, agentless Secure Browser Controls, or IPsec and GRE tunnels.
- Pilot and parallel run. Validate policy parity and rehearse rollback with a test group while ProxySG continues serving production.
- Phased cutover. Migrate users and sites in waves, monitoring for blocked traffic and false positives.
- Decommission. Retire ProxySG once traffic has fully shifted.
See Secure Web Gateway Migration: Cutover and Rollback Checklist.
Common migration concerns
Five areas need explicit mapping in any ProxySG migration: authentication, TLS interception, traffic steering, ICAP and DLP, and coexistence.
- Authentication. Map existing realms (SAML, Kerberos/IWA, or client-proxy identity) so user- and group-based policy behaves the same.
- TLS interception. Reissue and distribute the inspection certificate authority, and port decryption and trust exceptions.
- Traffic steering. Choose per site: explicit proxy or PAC for managed networks, browser controls for SaaS and AI tool access, the Skyhigh Client for roaming users, and tunnels for branches.
- ICAP and DLP. Data protection is applied through the Skyhigh cloud under the same policy, so an ICAP chain is replaced by cloud-applied inspection rather than by a local engine. Confirm that this path meets your residency requirements during assessment. Third-party DLP handoffs are mapped during assessment.
- Coexistence. A parallel run keeps ProxySG serving production while Skyhigh policy is validated.
What you keep, and what you gain
You keep your deployment model and policy investment, and gain inline threat inspection, integrated data protection, and a path to full SSE.
You keep your deployment model. Skyhigh SWG runs on premises, hybrid, or in the cloud, so an on-premises ProxySG estate can become an on-premises Skyhigh gateway estate, with data protection and isolation applied from the Skyhigh cloud, and move further toward the cloud on your schedule. You keep your policy investment, carried forward and validated.
On the gateway you gain Gateway Anti-Malware with real-time inline inspection, local Zero Trust Access, agentless Secure Browser Controls with WebSocket-aware inspection, and application visibility. Through the Skyhigh cloud, under the same policy, you gain data protection across web, SaaS, private apps, endpoints, and AI tools, remote browser isolation, emulation sandboxing, and UEBA, applied to traffic the gateway forwards. A single console converges SWG, CASB, ZTNA, and DSPM through Skyhigh Hybrid SSE Mesh.
The Blue Coat Modernization Program applies remaining Broadcom investment toward the transition, so the budget that would have funded another appliance refresh funds the move instead.
Sources
- Broadcom. End of life and product lifecycle for Edge SWG (ProxySG) and Advanced Secure Gateway (KB 151102). https://knowledge.broadcom.com/external/article/151102/end-of-life-and-product-lifecycle-for-pr.html
- Broadcom. Documentation for End of Life ProxySG. https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/edge-swg/legacy/documentation-for-end-of-life-proxysg.html
- Broadcom. Switch to the Edge SWG (ProxySG) Admin Console (SGAC) (KB 251426). https://knowledge.broadcom.com/external/article/251426/switch-to-the-edge-swg-proxysg-admin-con.html
- Broadcom. Web Isolation On-premises EOL FAQ (KB 215429). https://knowledge.broadcom.com/external/article/215429/web-isolation-onpremises-eol-faq.html
- Broadcom. Recommended stable SGOS releases for Edge SWG (ProxySG) and ASG (KB 169724). https://knowledge.broadcom.com/external/article/169724/recommended-stable-releases-for-proxysg.html
- Skyhigh Security. “Modernizing Your Symantec Edge Secure Web Gateway With Skyhigh Hybrid SSE Mesh” (July 15, 2026). https://www.skyhighsecurity.com/industry-perspectives/modernizing-your-symantec-edge-secure-web-gateway-with-skyhigh-hybrid-sse-mesh.html
- Skyhigh Security. Modernize Symantec Edge SWG (Blue Coat). https://www.skyhighsecurity.com/bluecoat-modernize.html