Skyhigh Hybrid SSE Mesh: Architecture and Deployment
- Skyhigh Hybrid SSE Mesh unifies on-premises SWG appliances and cloud security under one console and policy engine.
- The data plane can stay on premises, with TLS decryption and inspection running on customer infrastructure.
- Local ZTNA on customer gateways extends zero trust to internal users, resources, and AI agents.
- Cloud CASB, DSPM, DLP, and remote browser isolation extend from the same console at your pace.
- Policy is pushed as code to physical, virtual, and cloud enforcement points to prevent drift.
Skyhigh Hybrid SSE Mesh is Skyhigh Security’s hybrid Security Service Edge architecture. It lets organizations run SSE enforcement on premises, in the cloud, or across both, with one policy engine and one console governing every enforcement point. It is designed for organizations whose compliance, sovereignty, resilience, or performance requirements rule out routing all traffic through a vendor’s cloud.
This article is part of the Hybrid Cloud Security guide.
What is hybrid SSE?
Hybrid SSE is a Security Service Edge deployment that enforces one policy both in the cloud and on premises, instead of routing all traffic through a vendor’s cloud.
Security Service Edge (SSE) secures access to the web, cloud services, and private applications. Gartner defines SSE as primarily cloud-delivered, while noting that it may include on-premises or agent-based components.
Hybrid SSE takes that second part seriously. Instead of treating on-premises enforcement as a legacy holdover, hybrid SSE places enforcement where each traffic flow originates: cloud points of presence for remote users reaching SaaS, and on-premises or branch gateways for traffic that starts and ends inside the network. Gartner’s 2026 SSE market research observes that vendors increasingly provide virtual or hardware appliances that extend the SSE data plane on premises, enabling local traffic processing and resilience against unplanned cloud downtime, as cited in Skyhigh Security’s August 2026 announcement.
The hard part of hybrid SSE is not deploying appliances. It is keeping on-premises and cloud enforcement governed by the same policy, so that a user, a data type, or an application is treated the same way regardless of which enforcement point handles the traffic.
How Skyhigh Hybrid SSE Mesh works
Skyhigh Hybrid SSE Mesh has three layers: a unified control plane, a distributed data plane, and cloud-delivered services that extend from the same console.
Unified control plane
A single console and policy engine governs SWG, CASB, DLP, RBI, ZTNA, Secure Browser Controls, DSPM, and AI controls. Skyhigh describes a policy-as-code architecture that pushes policy automatically across physical appliances, virtual systems, and cloud nodes, without manual reconciliation between environments (Skyhigh Security). Skyhigh’s March 2026 platform update added location-agnostic unified policy management, a programmable and extensible policy framework, and consolidated monitoring and reporting across the platform (Skyhigh Security).
Distributed data plane
Enforcement runs where traffic flows:
- On-premises and branch SWG appliances inspect web traffic locally, including TLS decryption. Skyhigh’s March 2026 release introduced a containerized appliance architecture designed for scalability, along with dynamic traffic routing.
- Local ZTNA runs on the organization’s own on-premises and branch gateways rather than through a vendor-managed cloud node, so zero trust enforcement reaches internal systems and traffic that never leaves the building.
- Cloud SWG protects remote and roaming users without backhauling their traffic to a data center.
Cloud-delivered extensions
From the same console, organizations can add cloud CASB, DSPM, DLP, and remote browser isolation. Skyhigh’s cloud registry evaluates cloud services on 56 attributes across six risk pillars (data, identity, hosting, business, legal, and cyber risk), so policy can distinguish between services that share a URL category but differ on data residency, encryption, or legal terms.
Supported deployment options
Skyhigh Hybrid SSE Mesh can run on premises, in a hybrid model, or in the cloud, and organizations can move between models over time.
| Deployment model | Where inspection runs | Typical fit |
|---|---|---|
| On premises | Customer data centers and branches | Sovereignty-bound web traffic and sites requiring local enforcement; validate all dependencies for restricted-connectivity environments |
| Hybrid | On premises for local traffic, cloud for remote users and SaaS | Most regulated enterprises and Blue Coat modernization projects |
| Cloud | Skyhigh cloud points of presence | Remote-first organizations with no local inspection requirement |
Organizations can start in one model and move between them. Skyhigh’s hybrid SWG supports syncing on-premises policies to the cloud, either migrating them fully or keeping them distinct while sharing synchronized lists (Skyhigh Security).
For environments that cannot depend on external connectivity, local web gateway and Zero Trust Access enforcement continues on the Secure Service Gateway. Services applied through the Skyhigh cloud, including data protection, remote browser isolation, AI security controls, CASB, and data security posture management, are not available while a site is disconnected, so scope those requirements during design. For U.S. federal agencies and defense industrial base organizations, the platform holds FedRAMP High authorization.
Inspection and policy handling
Inspection runs where the traffic flows, with local TLS decryption for on-premises traffic and one policy engine governing threat, data, and browser controls.
Local TLS inspection. SSL/TLS decryption and inspection run on the organization’s own infrastructure. Decrypted payloads do not have to cross third-party or jurisdictional boundaries, which simplifies sovereignty and privacy reviews. This also aligns with NSA guidance to perform TLS inspection once, within the enterprise network (NSA).
Egress control. Dedicated egress IP and source IP anchoring let organizations route cloud-inspected internet traffic through public IP addresses assigned to them, supporting source-IP restrictions, IP reputation, and jurisdiction requirements.
Private application exposure. Document the inbound and outbound connectivity required by gateways, connectors, and management interfaces, and confirm the selected topology with Skyhigh.
Threat detection. Gateway anti-malware addresses threats at the first hop on the Secure Service Gateway. Emulation-based sandboxing, user and entity behavior analytics (UEBA), and remote browser isolation are applied through the Skyhigh cloud on traffic the gateway forwards.
Unified data protection. One DLP policy engine applies across web, SaaS, AI tools, private apps, and endpoints, so the same classification governs a web upload, a SaaS share, and a generative AI prompt. DLP policy is authored once and applied in the Skyhigh cloud, including for traffic forwarded from on-premises enforcement points.
Secure Browser Controls. Agentless browser security at the local network edge applies inline controls to uploads, downloads, copy and paste, session activity, and AI interactions on any standard browser, without deploying an enterprise browser or extensions. WebSocket-aware inspection extends to AI agent and messaging traffic.
Use cases
Hybrid SSE Mesh fits organizations that need local control for regulated data, operational technology, AI agents, or legacy gateway replacement.
Regulated financial services. Institutions subject to DORA, FCA, or MAS requirements can keep decrypted personal data inside their own infrastructure while still adopting cloud CASB and DLP. See Data Sovereignty in Hybrid Cloud Security.
Government and defense. FedRAMP High authorization addresses environments with strict authorization requirements, and local enforcement on the Secure Service Gateway addresses sites with constrained connectivity.
Healthcare. Patient data can stay within the physical perimeter while clinicians use cloud applications under the same policy.
Manufacturing and critical infrastructure. Local web and private application enforcement can complement customer-managed segmentation between corporate IT and OT/SCADA networks. Confirm which controls are supplied by Skyhigh and which require third-party components.
AI agents inside the network. Autonomous agents can inherit user-level access, chain APIs, and move data over persistent WebSocket connections that originate inside the network. Local ZTNA and WebSocket-aware inspection place enforcement where that traffic actually occurs.
Secure web gateway modernization. Organizations replacing Symantec Edge SWG (formerly Blue Coat ProxySG) can deploy Skyhigh appliances alongside existing gateways, validate policy, and retire legacy hardware on their own schedule. See Blue Coat Alternatives and ProxySG Replacement.
Deployment path
Skyhigh deploys Hybrid SSE Mesh in four phases that run alongside existing infrastructure, so policy is validated before any cutover:
- Assess and plan. Inventory existing policies, map data sovereignty zones and OT/SCADA environments, and baseline TLS inspection performance.
- Deploy in parallel. Stand up Skyhigh SWG appliances next to the current gateways, import and validate policy baselines, and run parallel traffic without disrupting production.
- Adopt unified capabilities. Enable local ZTNA and Secure Browser Controls, extend with cloud CASB, DSPM, and DLP, and retire legacy appliances when ready.
- Rationalize and optimize. Adjust consumption, retire unused entitlements, and continuously refine policy as code.
According to Skyhigh, most organizations run phases two and three in parallel over six to twelve months. Capabilities are licensed per entitlement, so new functions such as local ZTNA or Secure Browser Controls can be activated when they are needed.
Why organizations choose Skyhigh Hybrid SSE Mesh
Organizations choose Skyhigh Hybrid SSE Mesh because on-premises and cloud enforcement run as one system, backed by independent analyst recognition.
Skyhigh Security was ranked first in the Advanced SSE Use Case in the 2026 Gartner® Critical Capabilities for Security Service Edge. More than 3,000 organizations use Skyhigh, including 80 percent of top global banks and 25 percent of the Fortune 500.
The practical differentiator is architectural: on-premises and cloud enforcement are not separate products with separate policies. They are one system.
Next step: Request a hybrid architecture assessment or see Secure Web Gateway for Hybrid.
Sources
- Skyhigh Security. “Modernizing Your Symantec Edge Secure Web Gateway With Skyhigh Hybrid SSE Mesh” (July 15, 2026). https://www.skyhighsecurity.com/industry-perspectives/modernizing-your-symantec-edge-secure-web-gateway-with-skyhigh-hybrid-sse-mesh.html
- Skyhigh Security. “Skyhigh Security Announces New Solutions to Strengthen Disruptive Universal SSE Platform” (March 24, 2026). https://www.skyhighsecurity.com/about/newsroom/newswire/skyhigh-security-announces-new-solutions-to-strengthen-disruptive-universal-sse-platform.html
- Skyhigh Security. “Skyhigh Security Ranked #1 in Advanced SSE Use Case in 2026 Gartner Critical Capabilities for Security Service Edge” (August 5, 2026). https://www.globenewswire.com/news-release/2026/08/05/3339504/0/en/skyhigh-security-ranked-1-in-advanced-sse-use-case-in-2026-gartner-critical-capabilities-for-security-service-edge.html
- Skyhigh Security. “Adopting Hybrid Just Got Easier With Skyhigh SSE Platform” (October 3, 2024). https://www.skyhighsecurity.com/cloud-security/adopting-hybrid-just-got-easier-with-skyhigh-sse-platform.html
- Skyhigh Security. Modernize Symantec Edge SWG (Blue Coat). https://www.skyhighsecurity.com/bluecoat-modernize.html
- Skyhigh Security. Secure Web Gateway for Hybrid. https://www.skyhighsecurity.com/products/secure-web-gateway-for-hybrid.html
- Gartner. Security Service Edge (SSE), Information Technology Glossary. https://www.gartner.com/en/information-technology/glossary/security-service-edge-sse
- NSA. Managing Risk from Transport Layer Security Inspection (November 2019). https://media.defense.gov/2019/Nov/18/2002212783/-1/-1/0/MANAGING%20RISK%20FROM%20TLS%20INSPECTION_20191106.PDF
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications.