Skyhigh Security follows the data

Consider a perfectly ordinary security problem. An employee opens a company application, downloads a document, then pastes part of it into an AI tool. The employee is real. The login is legitimate. The document may contain information the business cannot afford to share. Which of those three actions should security have stopped? Skyhigh Security has built its business around the awkwardness of that question.

The company sells Security Service Edge, or SSE: software that brings several access and security controls together. Its particular emphasis is data use. Knowing who entered an application helps. Understanding whether a customer record should leave it requires another decision. That distinction becomes useful whenever work crosses the tidy boundaries drawn on an IT diagram.

A file can get past the front door

Think about the difference between a building pass and the rules inside a laboratory. A pass gets you through reception. It does not authorize you to carry every sample home. Skyhigh’s data-loss prevention technology supplies some of those internal rules, classifying information and applying policies when people handle it. This is the company’s central proposition, translated from security vocabulary into office behavior.

“Protecting how the data is used”

Gee Rittenhouse, Skyhigh’s launch announcement, 2022

The practical audience is the administrator who must let colleagues work while preventing avoidable disclosures. Financial institutions, healthcare organizations and government agencies are obvious fits; Skyhigh markets to those sectors. The company’s website says more than 3,000 enterprises use its products. That count describes reach, rather than proof that any particular deployment will catch every leak.

Four letters, one practical job

The portfolio reads like an alphabet somebody dropped: CASB, SWG, ZTNA, DLP. Each has a recognizable job. The Cloud Access Security Broker helps teams discover and govern cloud applications. The Secure Web Gateway inspects web traffic for threats and sensitive content. Private Access provides Zero Trust access to private applications. Data Loss Prevention supplies rules about the content moving through those connections.

Skyhigh combines these functions under shared management. Its classification capabilities include matching against known records or documents and reading text in images with optical character recognition. A security team can therefore look beyond a filename. The intended advantage is consistency: fewer separate places to translate the same business rule. Whether that advantage survives deployment depends on the applications and traffic paths involved.

The cloud meets the branch office

Sicredi supplies a concrete example. In Skyhigh’s published case study, the Brazilian financial institution faced rising branch-bandwidth demand that strained central infrastructure. Expanding that infrastructure would have required what its IT infrastructure and security manager, Gustavo Junges, described as unsustainable investment. The first pressure point was capacity and cost.

Sicredi chose a hybrid SSE architecture, combining cloud and on-premises protection, shared management and browser isolation. Local infrastructure in Brazil also mattered to its selection. The case study reports that, during a cloud-provider outage affecting Salesforce connectivity, Sicredi rerouted traffic locally in minutes. These are vendor-published customer accounts, but they make the buying decision unusually tangible: topology can matter as much as a feature list.

Skyhigh’s October 2026 marketing makes the economic argument explicit: local office and private-AI traffic need not take a cloud inspection detour. It models potential operating-cost savings of up to 50%, with qualifications about traffic, deployment and commercial assumptions. Treat that as a proposal to calculate. An organization with mostly remote users and internet-bound traffic has different arithmetic.

A new name with an older memory

The current name arrived in March 2022. The lineage reaches back to Skyhigh Networks, founded in 2011 by Rajiv Gupta, Sekhar Sarukkai and Kaushik Narayan. McAfee announced its acquisition in 2017. STG later acquired McAfee’s Enterprise business, and its SSE portfolio became Skyhigh Security. The much-cited $4 billion transaction covered the broader Enterprise business; it was not a standalone valuation for Skyhigh.

Today the company competes in an SSE market that includes Netskope, Zscaler and Palo Alto Networks. Its pitch emphasizes data protection and hybrid enforcement. Enterprise licenses, cloud subscriptions and a partner channel support that business. Trellix integration connects data classifications and incidents with existing management tools. The commercial appeal is partly the chance to preserve useful infrastructure while changing where protection happens.

The prompt is another doorway

AI makes the original question harder to ignore. A prompt can contain the same sensitive material as a file attachment. Skyhigh offers governance for AI applications, including Microsoft Copilot and ChatGPT Enterprise. Its integrated Data Security Posture Management capabilities add discovery and risk visibility to the enforcement story: find the exposed information, understand it, then decide what to do.

In March 2026, Skyhigh announced FedRAMP High authorization for DSPM. For public-sector buyers, that is a relevant procurement milestone. It does not remove the customer’s work of configuring policies, permissions and workflows. The product has to meet an organization that understands its own information.

Make the demo earn its keep

A useful evaluation begins with three real workflows: a legitimate upload, an accidental disclosure and access from an unmanaged device. Ask the team to show what gets classified, what gets blocked and what the employee sees. Count false positives. Include configuration, migration and ongoing administration in the cost comparison. Try the awkward applications before the easy ones.

Give the pilot a small, labeled set of documents that resembles daily work: a customer record, a public brochure, a screenshot containing sensitive text. Keep the expected decision beside each item. Then repeat the workflow through the web, a supported cloud app and a private application. This makes policy consistency observable. A demonstration that catches the customer record but blocks the brochure has exposed an operational cost, even before anyone discusses the subscription.

The approach needs visibility into the relevant traffic or a supported integration. A disconnected repository, an uninspected route or a badly defined data policy can undermine it. What a reader can copy is the order of operations: identify the information, trace its journey, then choose where to enforce the rule. Start with the file. Follow it out of the room.