Improved Reliability From Symantec SSE

Evidence and data. Interviewees shared that prior to adopting Symantec SSE, they dealt with occasional outages that could cost their organizations hundreds of thousands or even millions of dollars. Although their legacy infrastructure relied on fixed or centralized servers, Symantec SSE is cloud-delivered and automatically routes traffic through the fastest available path. After adopting Symantec SSE, the interviewees observed improved network performance, and the availability continued to increase as they onboarded more users. Better uptime resulted in improved profit retention, easier compliance processes, and improved internal productivity. Interviewees described how Symantec SSE enhanced reliability:

• The amount of unplanned downtime that each customer encountered in their legacy environment varied, but each reported that adopting Symantec SSE reduced the number of outages. The product owner at a financial services firm stated: “We are fined a certain amount for downtime, so you might be fined a quarter of a million pounds if you’re down for an hour, or you might be fined £10 million if you’re down for 2 hours. … [With Symantec SSE], it’s around an 80% to 90% reduction in downtime and outages.” The interviewee went on to share that their current uptime is well within the 99.999% SLA that Broadcom provided them with.

• Interviewees noted that Symantec SSE’s partnership with GCP significantly reduced downtime by providing higher bandwidth and more resilient, simplified, secure application and resource access, minimizing performance bottlenecks and infrastructure complexities that could lead to outages. The gateway security analyst at an insurance organization stated that: “I feel Broadcom has a key advantage as its point of presence because it utilizes Google for its backbone infrastructure. Its presence across the globe gives it a real competitive advantage and is a key benefit for us as a business due to the nature of our investors and having people dotted around the globe.” The same interviewee went on to say that: “We’ve seen a huge reduction in major incidents and a reduction in service impact for our business. There’s been an 80% to 90% reduction in network support tickets.”

• The cybersecurity operations lead at a manufacturing firm agreed that Broadcom’s GCP partnership was vital to improving reliability at their firm: “We have a lot of offices around the globe. Because Broadcom uses GCP as the main environment, there is improved performance, improved time of connectivity, and of course less downtime. … Because of GCP, we see a very good improvement in the performance of surfing, accessing the portal, and traffic. It’s easily 20% to 30% less downtime.”

• In addition to the financial benefits of improving reliability, interviewees also shared that the reduction in outages and service disruptions for their internal applications improved employee productivity and user experience. The product owner at a financial services firm reported, “Our [employee experience] scores have improved significantly over the past 12 to 18 months, and without a shadow of a doubt, it’s driven in part by the improvement in reliability.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Symantec SSE supports 65% of the composite’s staff in Year 1, with 90% and 100% onboarded by Years 2 and 3, respectively.

• Prior to adopting Symantec SSE, the composite organization experiences customer-impacting downtime or severe performance degradation. After deploying Symantec SSE, the composite reduces these unplanned service disruptions, with uptime improving as it onboards more employees onto Symantec SSE. By Year 3, the composite reduces downtime by 14 hours annually.

• The composite operates in a highly competitive and highly regulated industry in which any downtime can lead to fines and customer loss. On average, each hour of downtime costs the composite organization $400,000, inclusive of direct revenue loss and regulatory penalties.

• In addition to better protecting profits, the composite also improves employee productivity by reducing unplanned downtime. Unplanned downtime in the prior environment impacts 25% of the composite’s 40,000 employees.

• These employees have a fully burdened hourly rate of $44 on average.

• Forrester assumes a 25% productivity recapture since not all time savings are redeployed productively and because employees could potentially maintain some level of productivity during outages in the prior environment.

Risks. The financial impact of the improved reliability will vary depending on:

• The total users Symantec SSE supports.

• The annual hours of unplanned downtime that an organization encountered in its prior environment.

• The expected hourly cost of downtime for an organization.

• End users’ fully burdened hourly wages.

• The likelihood that prior downtime events impacted end users, and the degree to which an outage affected their productivity.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10% for the time value of money) of $12.7 million.

Avoided Breach Costs From Improved Security Posture

Evidence and data. Interviewees shared that adopting Symantec SSE enabled them to improve their security posture significantly by consolidating cloud-centric security capabilities such as Cloud-SWG, CASB, and DLP into a unified platform. Furthermore, interviewees noted that leveraging the Symantec Global Intelligence Network provided real-time threat intelligence, URL filtering, and malware protection, ensuring comprehensive defense against emerging threats. Interviewees described several areas of security improvement with Symantec SSE:

• Cloud-SWG and RBI. Interviewees shared that Symantec SSE’s Cloud-SWG capabilities enforced granular access policies, deep content inspection, and RBI to improve security. Interviewees particularly praised Symantec Web Isolation capabilities, which execute all web sessions in a remote, isolated environment, thereby preventing malicious data or malware from reaching and compromising devices. The cybersecurity operations lead at a manufacturing firm described the impact of Web Isolation: “We also have [RBI], so all risky and uncategorized sites are forwarded there. … So when you open a site, it’s not your PC accessing the site, it’s a remote computer accessing the site and transferring data and images to your computer, so the attacker cannot access your endpoint. … No doubt, implementing RBI and CASB has improved our security posture.”
  The head of global security at an IT consulting organization described the value of Cloud-SWG with RBI: “We have policies where we block all websites that are categorized as seven and above in severity. We have also implemented RBI, which has significantly brought down any malware coming through our web channel. … Uncategorized traffic is significantly less than it was, so we’ve seen very good improvements in that.”
  The product owner at a financial services firm also praised Symantec Cloud-SWG capabilities, particularly calling out RBI as a standout feature: “The feedback that we have received on RBI is incredible. It’s incredible the difference in terms of providing the isolation function in a virtually invisible manner to our colleagues. … We rolled out isolation because it integrated seamlessly with Cloud-SWG, and the experience has been literally night and day.”
  The gateway security analyst at an insurance organization stated simply, “Web Isolation has saved us quite a few times.”
  Interviewees also noted the benefits of Cloud-SWG’s endpoint agent features, which redirect web traffic from client devices to the nearest Cloud-SWG data center, ensuring consistent application of security policies regardless of user location. The gateway security analyst at the insurance organization stated: “The endpoint agent for Cloud-SWG is genuinely a really good tool. You can get a packet capture from the agent that gives you the ability to identify where traffic is being routed, and that’s particularly important as you have the ability to call on the agent directly to get a clear view on where the traffic’s pointing to, and then it provides you a treatment plan to resolve the issue.”

• CASB and application visibility. Interviewees also reported that Symantec SSE’s CASB features provided their organizations with visibility and control over cloud application use, including sanctioned and unsanctioned apps, enabling them to enforce consistent security policies, prevent data loss, and protect against threats. The product owner at a financial services firm stated: “We use CASB to create lists of applications that the bank doesn’t want people to have access to. It’s definitely helped us reduce the number of unsanctioned web applications that users can access.”
  The cybersecurity operations lead at a manufacturing firm described the value of CASB: “We have CASB on Symantec SSE, so we investigate each application, and we can check for shadow IT from our users. We score each web application, and if we see that the score is very low, we block the application. It improves our security posture because we are blocking risky apps.”
  The head of security operations at an insurance organization also praised CASB: “We have really increased our protection against unauthorized application usage because CASB has given us that visibility. … CASB has been a game changer for us and it’s very competitive with what’s in the market because of what it can do. It has a great catalog of apps, and it recognizes the threat intel of those apps.”
  DLP. Interviewees reported strong protection from Symantec SSE’s DLP functionality, which enabled their organizations to protect sensitive data across endpoints, networks, cloud applications, and storage, preventing accidental exposure and malicious exfiltration. The head of global security at an IT consulting organization stated: “If I compare Symantec DLP with the other SSE players, the Symantec DLP solution is way ahead. It’s enterprise-built, whereas those [competitors] will need at least one to two years to reach the level where Symantec is in DLP.”

• Firewalls. Some interviewees reported that they had deployed Symantec SSE’s cloud firewall features to define policies based on users, groups, and locations. The cybersecurity operations lead at a manufacturing firm described the benefit: “Last year we also implemented cloud firewalls from Symantec SSE, and we blocked all traffic from unknown ports to the internet, and this add-on of course helped us in our security.”

• Threat intelligence capabilities backed by the Symantec Global Intelligence Network. In addition to the other features mentioned, interviewees reported that Symantec SSE’s threat intelligence features leveraged the Symantec Global Intelligence Network to provide real-time insights into emerging threats, protecting against malware, phishing, and zero-day attacks by updating security policies continuously. The head of security operations at an insurance organization described the power of the threat intelligence capabilities: “The fact that the intelligence network behind Symantec SSE is really good means that the feature set is reliable. From a security perspective, we tend to find that if there’s a rogue internet site, it’s already detected as suspicious and therefore blocked. … Its Global Intelligence Network is second to none. The web categorization that Symantec provides is superior to any other product.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization expects $4.6 million in cumulative breach costs per year and has a 68% likelihood of experiencing a breach every year. Furthermore, 58% of those breaches originate either from external attacks or attacks targeting employees’ home or remote networks. Forrester estimates that Symantec SSE can address 70% of these breaches.²

• Symantec SSE supports 65% of the composite’s staff in Year 1, with 90% and 100% onboarded by Years 2 and 3, respectively.

• With Symantec SSE, the composite reduces the likelihood of a severe data breach caused by an external attack or attacks targeting employees’ home or remote networks by 75%.

Risks. The following factors may impact this benefit:

• The number of users Symantec SSE supports.

• An organization’s security posture and maturity prior to deploying Symantec SSE.

• The likelihood and associated costs of security breaches each year.

• The specific Symantec SSE features deployed.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.7 million.

Network Infrastructure Cost Savings

Evidence and data. Interviewees reported that migrating to Symantec SSE enabled them to retire some of their legacy on-prem proxies and associated security appliances. In addition to the hardware cost savings, the interviewees reported that Symantec SSE was easier to manage and maintain than their legacy infrastructure, which allowed them to redeploy platform manager FTEs to other tasks. Interviewees described the factors driving the legacy cost savings:

• On-premises proxies and hardware infrastructure. Interviewees stated that as more of their workforce migrated to Symantec SSE, they could consolidate multiple security solutions, such as on-premises proxies, VPNs, and hardware firewalls, into a single, cloud-based platform. The head of security operations at an insurance organization reported: “We had lots of on-prem infrastructure running, 16 proxies and other things like that. The cost of hosting all those was substantial, hundreds of thousands of pounds per year. We saw that obviously we would save all that money from using the cloud infrastructure instead.”

• Legacy FTEs dedicated to infrastructure maintenance. Interviewees also shared that they found Symantec SSE easier to manage than legacy infrastructure because it is a cloud-delivered service, which eliminated the need for them to manage, patch, and upgrade physical appliances. The head of global security at an IT consulting organization described the change: “Earlier, we had a trifurcation of management teams, as we had one team for proxies, one team for DLP, and one team for CASB. With Symantec SSE, we have one team that manages the whole platform. We cut down this staff by almost 50%. We did not let people go; we just assigned them to different roles and they moved to different teams.”
  The same interviewee went on to describe the impact of the infrastructure management time savings: “Now the team has more bandwidth to focus on finetuning policies and rules rather than managing the infrastructure. We want our team to focus only on the security part, and not the IT part.”
  The cybersecurity operations lead at a manufacturing firm also reported that moving infrastructure from on-premises to a cloud-based solution led to operational efficiencies: “After migrating to the cloud solution, we no longer have to deal with the on-prem appliances. Because it’s a SaaS platform, we are not dealing with the infrastructure issues. It definitely saves a lot of time for our infrastructure team to not have to deal with all our hundreds of appliances that we had before migrating.”
  The gateway security analyst at an insurance organization shared that policy management was significantly simpler to manage with Symantec SSE compared to their legacy on-premises approach: “We’ve been able to pull stuff into our scripts to provide data and streamline policy review processes. If it wasn’t for some of that work, we could require more headcount internally.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• In Year 1 of deploying Symantec SSE, the composite organization retires legacy infrastructure worth $2.3 million. As it migrates more of its traffic to the cloud, the cost savings increase to $3.2 million in Year 2 and $3.6 million in Year 3.

• The composite organization has a team of eight FTEs dedicated to managing the organization’s legacy hardware. Over the course of the three-year analysis, the composite gradually deploys these employees to other tasks, saving labor costs.

• Employees dedicated to managing infrastructure have an average fully burdened annual salary of $135,000 per year.

• Forrester assumes an 80% productivity recapture since not all of these time savings are redeployed productively.

Risks. Legacy network infrastructure cost savings will vary depending on:

• The cost of network infrastructure in the previous environment.

• The internal labor dedicated to maintaining legacy infrastructure.

• The speed at which organizations retire legacy infrastructure and migrate to Symantec SSE.

• Network and security operations FTE salaries.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $8.4 million.

Security Operations Time Savings

Evidence and data. Interviewees shared that Symantec SSE reduced their attack surface by centralizing and securing all web and cloud application access, effectively making internal resources invisible to external threats. This proactive attack surface reduction meant fewer incidents for security operations teams to investigate and remediate, leading to time savings on responding to alerts.

• The head of global security at an IT consulting organization described how the reduced attack surface translated directly to employee time savings: “[With Symantec SSE], we have cut down the total number of security alerts by 50% to 75%. Because there are less alerts to handle, a smaller team can manage the alerts.”

• The head of security operations at an insurance organization agreed that Symantec SSE conferred security time savings, adding that: “The fact that the Global Intelligence Network is so good improves our security. A member of our staff might click a link in a phishing email, and nine times out of 10, if not more, that link is not usable because of the protection that SSE gives us. It prevents that incident from getting any further. … If these protections weren’t there, then instantly there would be significantly more management work.”

• The cybersecurity operations lead at a manufacturing firm described the avoided security tickets from the improved policy enforcement and Web Isolation capabilities embedded in Symantec SSE: “[Symantec SSE] works perfectly. No issues. We blocked all suspicious, malicious, and risky sites. [Previously], we had a lot of [security] tickets from our users, but after implementing Web Isolation, there are almost zero tickets related to [users clicking on risky websites].”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization has a team of 28 security operations FTEs who dedicate much of their time to security alert response.

• With Symantec SSE’s centralized management and policy enforcement, the number of security alerts shrinks, leading to time savings of 12% for security operations staff in Year 1. As the composite migrates more of its workforce to Symantec SSE, these time savings reach 15% in Year 3.

• Security operations staff have an average fully burdened annual salary of $135,000.

• Forrester assumes an 80% productivity recapture since not all time savings are redeployed productively.

Risks. The security operations time savings will vary depending on:

• The number of security alerts an organization has in its legacy environment.

• The specific Symantec SSE security features or capabilities adopted.

• The average fully burdened annual salary of security operations FTEs.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $919,000.

Improved End-User Productivity

Evidence and data. Interviewees shared that Symantec SSE significantly enhanced user experience and reduced latency. The performance improvement led to productivity boosts, particularly for geographically dispersed teams. Interviewees attributed the improved performance and end-user experience to the increased capacity provided by Symantec SSE’s global cloud infrastructure and to its dedicated egress points.

• Improved capacity. Interviewees shared that Symantec SSE’s integration with GCP allowed their organizations to reduce latency by routing traffic over high-capacity private pathways instead of the public internet. The head of security operations at an insurance company stated: “[Symantec SSE] feels like an all-you-can-eat type capability. Previously, one of the big issues we had was fixed capacity, but now we can be less sensitive for our users in terms of usage.”
  The same interviewee went on to say: “There’s a huge benefit around capacity. We would forever have major incidents where our proxies would be maxing out on CPU and memory and we would effectively just grind the business to a halt. Since we moved to Cloud-SWG, we don’t have anything like that.”

• Dedicated egress capabilities. The gateway security analyst at an insurance organization described the value of Symantec SSE’s dedicated egress capabilities, which allow customers to route traffic through dedicated IP addresses and regional egress points, ensuring more direct connections: “Previously, if we had someone based in Ireland who was traveling to Dubai, they would have to backhaul all that traffic to their on-prem proxy in their local data center to then break out. Whereas now they can just hit the data center that’s nearest to Dubai and they’re going to log in a lot quicker.”
  The cybersecurity operations lead at a manufacturing firm also spoke to the benefits of the dedicated egress features: “Before, if a user wanted to access some internet site, their traffic was forwarded from some office to the data center, and from the data center to the appliance, and from the appliance to the internet. It was very high latency, and of course user experience was very poor. But after migrating all our offices to the Symantec SSE offering, we have no claims regarding latency or internet accessing, nothing. We’re in a very good situation now.”
  The head of global security at an IT consulting organization reported a significant reduction in latency: “Latency is much better compared to what it was earlier. Our metrics say it is fine, and we have not heard any complaints from users. … We saw a 25% to 30% improvement in latency in Asia Pacific.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Prior to adopting Symantec SSE, the composite organization’s employees dealt with high latency due to fixed capacity and shared egress. Users supported by Symantec SSE avoid 1.5 minutes of wait time per day (6.5 hours per year).

• In Year 1, Symantec SSE supports 26,000 of the composite’s employees. This increases to 36,000 in Year 2 before reaching all 40,000 employees in Year 3.

• On average, these users have a fully burdened hourly rate of $44.

• Forrester applies a productivity recapture of 25%.

Risks. The end-user productivity lift will vary depending on:

• The level of latency and performance degradation in the prior environment.

• The number of users supported by Symantec SSE.

• End-user FTE salaries.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $5.1 million.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Potential cybersecurity insurance cost avoidance. Interviewees reported that as threats have become increasingly prevalent and complex, cybersecurity insurance premiums have climbed rapidly. However, some interviewees shared that using Symantec SSE has helped them either avoid insurance premium hikes or reduce their premiums. The head of global security at an IT consulting firm reported a drop in premiums, which they partially attributed to Symantec SSE: “[Using Symantec SSE] has significantly brought down our cyber insurance cost. Our peers were seeing increases in the costs, whereas there was a very significant reduction in our insurance costs due to the different security controls we have implemented.”
  The head of security operations at an insurance organization agreed that using Symantec SSE was helpful in the application process: “When we’ve done the attestation for cybersecurity insurance, the fact that we have a strong toolset and a strong policy and it’s a market-leading product set has certainly helped.”

• Improved user experience. Interviewees shared that prior to adopting Symantec SSE, latency was a significant source of frustration for their employee base. By improving performance, the interviewees could reduce the number of IT support tickets submitted for latency-related issues and ultimately improve user experience.
  Interviewees also reported that their previous solutions unnecessarily blocked certain safe websites or applications, which prevented employees from accessing work-related information and forced them to open IT tickets for web browsing issues. With Symantec SSE’s Web Isolation features, interviewees’ organizations could quickly and easily identify which sites were benign, leading to a more seamless browsing experience. The cybersecurity operations lead at a manufacturing firm stated: “User experience has drastically improved after implementing isolation, because previously all uncategorized and risky sites were blocked. We used to open tickets to service desks to request to open this site because it’s needed for the business. After implementing Web Isolation, all types of these tickets are gone because we are allowing the traffic onto some remote computer. For user experience, this is a very, very good improvement. There have been 30% less tickets regarding web browsing issues.”

• High-quality support from Broadcom. Interviewees shared that they worked with Broadcom’s support team to optimize their SSE deployment, including investigating any incidents, adding new features, and training new employees. The product owner at a financial services firm praised the quality and consistency of the Broadcom support team: “The support that we get from Broadcom is excellent. Other vendors, even those bigger than Broadcom, their support is not as good today, tomorrow, yesterday, as Broadcom’s is. … The support when we have an outage is absolutely vital. We will often know internally that the problem has nothing to do with Broadcom, and they will, at the drop of a hat, join our call. That, for a financial institute, is essential.”

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Symantec SSE and later realize additional uses and business opportunities, including:

• Additional security improvements from adding Symantec SSE’s ZTNA feature. Some interviewees reported that they were piloting and planning to adopt Symantec SSE’s ZTNA capabilities, which implement a “never trust, always verify” model for every user and device accessing applications. The interviewees who spoke to this use case expect that ZTNA’s identity- and context-aware access control will minimize the attack surface by only granting access to specific applications, rather than the entire network. The head of global security at an IT consulting firm stated, “We are in the pilot rollout of ZTNA, so the first set of 5,000 users will be completed by [next month].”

• Exploring mobile protection. Some interviewees also reported that they were exploring mobile security solutions from Broadcom to sync their Symantec SSE-set security policies to mobile devices, ensuring that employees accessing corporate resources are protected from mobile-specific threats. The gateway security analyst at an insurance organization stated: “We’re running a pilot at the moment around Symantec Endpoint Protection for mobile. [Our goal] is to gain more security controls around mobile and try to provide a more consolidated, unified policy across endpoint devices as a whole. Right now, we’re just focused on blocking the bad stuff, but in the future, we may be in a position where someone can do something on their laptop and also on their phone, and if they can’t do it on their laptop, they also can’t do it on their phone. We’d be bringing the endpoints together into a centrally managed policy.”

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).