Blue Coat / ProxySG End of Life: Dates and Migration Guide

Blue Coat ProxySG is now Broadcom Edge SWG, running the SGOS operating system, and its end-of-life is per-version and per-model. SGOS 6.7 has been end of life since December 2023, and Broadcom announced SGOS 7.3 end of life on December 31, 2024, giving customers two years from that date to reach SGOS 7.4. SGOS 7.4 is the current long-term release — but upgrading to it removes the legacy Java Management Console and Visual Policy Manager, so staying on Blue Coat still forces a console and policy-workflow change. Migrating to a modern Secure Web Gateway such as Skyhigh Security is a guided policy re-implementation, not an automated import.

If you run Broadcom (formerly Symantec/Blue Coat) ProxySG, Advanced Secure Gateway (ASG), or Edge SWG, end-of-life (EOL) isn’t one event — it’s a rolling set of dates across your SGOS version and each appliance model, and the “just upgrade” path has a catch most teams don’t expect.

SGOS lifecycle at a glance

Three SGOS releases matter right now: 6.7 is retired, 7.3 is the previous long-term release heading to end of life, and 7.4 is current.

ASG shares the same lifecycle as ProxySG — Broadcom’s end-of-life announcement covered both product lines. Each SGOS release moves through End of Maintenance and then End of Support / End of Life, and hardware EOL is model-specific, rolling across the SSP appliance series and older SG-S units. Always confirm your exact version and model against Broadcom’s product lifecycle article and recommended-release guidance.

How to check your ProxySG version and EOL status

Read the SGOS version off the console, note the appliance model, then cross-reference both against Broadcom’s lifecycle documentation.

1. In the appliance console, note your SGOS version — shown on the Management Console (or new Admin Console) dashboard, or from the CLI with show version.
2. Note your appliance model (for example an SSP-series appliance such as the SSP-S210 or SSP-S410, or an older SG-S unit).
3. Cross-reference both against Broadcom’s End of Life documentation and product lifecycle article to find your End of Maintenance and End of Life dates.

What end-of-life actually costs you

After end of life you lose security patches, defect fixes, and any support path — on the device inspecting all of your web traffic.

• No security patches — critical and high-severity vulnerabilities stop being fixed on EOL software. A real exposure for an internet-facing proxy inspecting all your web traffic.
• No defect fixes — after End of Maintenance, the OS is no longer developed, repaired, or tested.
• No support path — after EOL, support is unavailable and the product is obsolete.
• Compliance, sovereignty, and insurance drift — running unsupported, unpatched gateway infrastructure is hard to defend in audits and cyber-insurance reviews.

The catch in “just upgrade”

SGOS 7.4 removes the Java Management Console and Visual Policy Manager, so upgrading in place still forces you onto a new console and a reworked policy workflow.

The obvious answer to SGOS 7.3 end-of-life is to upgrade to 7.4 — but that’s not a clean like-for-like step. SGOS 7.4 removes the legacy Java-based Management Console and the Java Visual Policy Manager (VPM), the tools many teams have used to manage policy for years, and directs administrators to Broadcom’s new Admin Console (SGAC). You can read Broadcom’s own guidance on switching to the Admin Console. The practical consequence: staying on Blue Coat still means adopting a new console and rebuilding your policy-management workflow. Once you’re re-learning the console and reworking policy either way, the real question becomes whether to do that work on a platform Broadcom has deprioritized — or on a modern SWG.

Your two options

You can upgrade in place and face the same decision next cycle, or modernize onto a platform built for current web and cloud realities.

• Upgrade in place — move to SGOS 7.4 and refresh EOL hardware. Keeps you supported, but forces the Admin Console / VPM change above, and doesn’t address roadmap, support, or licensing concerns. You’ll face this same decision again next cycle.
• Modernize, not just migrate — replace ProxySG with a gateway built for current web and cloud realities, ideally one that keeps an on-prem footprint while opening a cloud path. The rest of this guide walks through that honestly.

What a Blue Coat to Skyhigh migration actually involves

There is no automated converter between proxy policy engines — every SWG migration is a guided re-implementation that uses your existing policy as the blueprint.

Worth being straight about: there is no automated converter that turns ProxySG CPL/VPM policy into another vendor’s engine. Any SWG migration is a guided re-implementation, not a file import. Skyhigh’s step-by-step policy-tree migration uses your existing policy as the blueprint — and it’s the cleanest opportunity you’ll get to retire years of stale rules. The phases:

1. Assessment & discovery. Inventory the estate — appliances, SGOS versions, traffic volume, user counts, authentication realms, ICAP/DLP integrations, and upstream/downstream proxy chaining. Export and document current CPL/VPM policy as the source of truth.
2. Policy design & re-implementation. Rebuild equivalent rules, categories, and exceptions in Skyhigh SWG‘s policy engine from the documented policy — guided and services-backed — pruning rules that no longer earn their place.
3. Deployment & traffic steering. Stand up Skyhigh SWG in your chosen mode (on-prem appliance, hybrid, or cloud) and steer traffic using the Skyhigh Client, explicit proxy, PAC files, or IPsec/GRE tunnels — then re-establish authentication and ICAP/DLP integrations.
4. Pilot / parallel run. Route a test group, or run alongside ProxySG, to validate policy parity and surface gaps before production cutover.
5. Phased cutover. Migrate users and sites in waves — not big-bang — watching for blocked-traffic and false-positive issues at each stage.
6. Decommission. Retire ProxySG once traffic is fully shifted and the EOL/maintenance liability is gone.

Common migration concerns

Authentication, TLS interception, traffic steering, ICAP/DLP handoffs, and coexistence are the five areas that need explicit mapping.

• Authentication — map existing realms (SAML, Kerberos/IWA, or Client-Proxy identity) to Skyhigh so user- and group-based policy behaves the same.
• TLS/SSL interception — re-issue and distribute the inspection CA, and port your decryption and trust exceptions.
• Traffic steering — choose per-site: explicit proxy or PAC for managed networks, agentless Secure Browser Controls for browser-based SaaS and AI tool access on any standard browser, the Skyhigh Client for roaming users, IPsec/GRE tunnels for branch offices.
• ICAP and DLP — Skyhigh’s integrated DLP absorbs functions that previously required a separate ICAP-connected box, reducing the number of point products and integration touchpoints to maintain. For organizations running third-party DLP over ICAP, the migration assessment maps each handoff to the equivalent Skyhigh integrated control.
• Coexistence — a parallel run keeps ProxySG serving production while you validate Skyhigh policy, so cutover is staged rather than all-at-once.

What you keep — and what you gain

You keep your deployment model and your policy investment; you gain the inline inspection and integrated data protection ProxySG never built in.

You keep the deployment model that fits you: Skyhigh SWG runs on-prem (on MLOS 3 appliances), hybrid, or cloud, so an on-prem ProxySG becomes an on-prem Skyhigh footprint, moved cloud-ward on your schedule. You gain what ProxySG lacks built in: Gateway Anti-Malware with real-time inline inspection and inline emulation-based sandboxing for zero-day threats, integrated Remote Browser Isolation at no extra cost, UEBA behavioral analysis, integrated web DLP, agentless Secure Browser Controls with inline AI prompt inspection and WebSocket-aware coverage at the local network edge, AI Security Platform: Unified Data Protection Across Every Channel, and a single console converging SWG, CASB, ZTNA, and DSPM — ranked #1 in the Advanced SSE Use Case in the 2026 Gartner® Critical Capabilities for Security Service Edge, trusted by more than 3,000 organizations including 80 percent of the largest global banks and nearly half of the Fortune 100, with 99.999% uptime protecting 20+ million users, and a clear path to full SSE.

The Blue Coat Modernization Program applies your remaining Symantec Edge SWG investment toward the modernization — so the refresh budget that would have funded another appliance cycle funds the move to a modern platform instead. Still weighing vendors? See what to require in a Blue Coat alternative.

Request a modernization demo to see your migration path mapped to your environment.