Broadcom renamed Symantec Cloud SWG to "Web Security" inside CBX, but its 2026 release notes added no GenAI tenant control and no prompt inspection. The gateway now guarding your web traffic cannot tell corporate AI from personal AI or read a prompt, because Broadcom's AI work lives in DLP, not the SWG. dope.security runs that AI governance natively in the same on-device agent as the gateway.

What changed: Cloud SWG is now "Web Security" inside CBX

Through 2026, Broadcom repackaged Symantec Cloud SWG inside CBX, its Carbon Black and Symantec bundle, and the release notes from July through September renamed it "Web Security" for CBX and Cloud SWG Express customers. The same notes flagged file-type policy changes that force a review: octet-stream content is no longer treated as executable, and "Unknown Type" moved into File Control. If you run Cloud SWG, you are already going to open the console and re-check policy. That makes this a good moment to ask what the rename actually added.

The short answer: a new name and a policy chore, not new AI governance. This is the fourth owner for a product that started as Blue Coat, became ProxySG, then WSS, then Cloud SWG. Each turn added packaging. None of it changed the architecture, which is still a cloud proxy that backhauls traffic. For the migration-off view, see replacing a legacy cloud proxy.

The rename did not add AI governance

Here is the part that matters for any security team with an AI problem, which is all of them. Broadcom's Cloud SWG release notes from July through September 2026 contain no new GenAI tenant control and no prompt inspection. The capability picture is blunt: discovery is partial, tenant control is a gap, semantic prompt DLP is a gap, and there is no tenant-aware way in Cloud SWG to tell a corporate AI account from a personal one on the same service. So the single most valuable AI control, allowing corporate ChatGPT while blocking personal ChatGPT on the same domain, is not something the renamed gateway can do.

That is not a scare line, it is what the documentation shows by its absence. The gateway inspects web traffic, but it does not carry the tenant-aware, prompt-reading controls that AI governance needs. dope.security does exactly that split, on the device, with Cloud Application Control, so people keep the sanctioned tool and lose the personal side door.

Broadcom's AI work is in DLP, not the SWG

Broadcom is doing AI work. It just is not in the web gateway. The newer effort, Symantec DLP paired with a Google Agent Gateway announced April 22, 2026, is early access and scoped to Google Cloud agents, not end-user web traffic. So if you buy Web Security expecting it to govern how your employees use ChatGPT, Claude, Gemini, and Copilot in a browser or a desktop app, that control is in a different product line, aimed at a different problem. The result is the familiar legacy pattern: the capability exists somewhere in the portfolio, as another SKU, for a narrower case, and assembling it is the buyer's job.

dope.security takes the opposite shape. AI governance is not a separate product. Discovery, account-level control, and Dopamine DLP that reads prompts and uploads by meaning all run in the same on-device agent as the SWG. One deployment, one console, one policy push. See it on the dope.swg product page.

The backhaul latency Broadcom's own KBs document

Cloud SWG is a cloud proxy, which means every request detours to a Broadcom point of presence and back before it reaches the internet. Broadcom's own knowledge base articles on latency and timeouts document the symptom, and customers report battery and RAM drain from the agent on top of it. The rename to Web Security did not move inspection off the detour. It is the same round-trip it has always been.

Measure the detour. A legacy cloud proxy sends every request to a data center and back; dope.security inspects on the device and flies direct, so there is no round-trip to pay for. Compare your real latency against a cloud-proxy path on the fly direct secure web gateway, or see it in a live demo.

The takeaway: a gateway that routes every request through a data center cannot be faster than one that inspects where the request starts.

That detour is the reason teams feel an immediate difference when they move. Outreach Health replaced a legacy SWG with dope.security, secured 99% of devices within a week, and cut web-access tickets 70% in 90 days, because policy follows the user on the device instead of waiting on a PoP.

Broadcom Web Security versus dope.security

Broadcom's gateway is a mature product with real heritage. The comparison is about what the renamed Cloud SWG can and cannot do in the AI era, and where it leaves you.

Where Broadcom's gateway still fits

If you need classic web proxy and URL filtering and you are deep in the Symantec DLP ecosystem, Cloud SWG does the traditional job, and the CBX bundle keeps it alongside Carbon Black. For an organization that is not trying to govern AI from the gateway, that may be enough for now.

Where dope.security covers the AI gap

dope.security is the lead pick because it closes the exact gap the rename left open, natively.

You are already being asked to touch policy

The file-type policy changes in the 2026 release notes, the deprecation of PAC redirection, and the renewal pattern, reported at two to four times for mid-market and higher for small business as perpetual licenses went away, all add up to work you did not choose. When a vendor is already making you re-open the console and re-justify the spend, it is a reasonable moment to put a modern on-device gateway next to it and compare. Our breakdown of cloud proxy versus on-device SWG and the honest Symantec WSS alternatives guide both help scope it.

What to test before you renew

Run one proof. On Cloud SWG, try to allow corporate ChatGPT and block personal ChatGPT on the same domain, and try to block a sensitive file from being pasted or uploaded into an AI tool. If the gateway cannot do it without reaching into a separate DLP product, you have found the gap. Then run the same test on dope.security, where it is one policy in one agent. For the architecture comparison, see endpoint-based SWG versus cloud-proxy SWG, and start a free production trial to measure it on your own fleet.

Frequently Asked Questions

Is Symantec Cloud SWG the same as Broadcom "Web Security"?

Yes. Through 2026 Broadcom repackaged Symantec Cloud SWG inside CBX and renamed it "Web Security" for CBX and Cloud SWG Express customers in the July to September release notes. It is the same cloud-proxy lineage that ran as Blue Coat, ProxySG, and WSS before it.

Does Broadcom Web Security govern how employees use ChatGPT or Claude?

The Cloud SWG release notes added no GenAI tenant control and no prompt inspection, and there is no tenant-aware corporate-versus-personal AI control in the gateway. Broadcom's AI work is in a separate Symantec DLP and Google Agent Gateway effort scoped to Google Cloud agents. dope.security governs AI use in the browser and desktop apps natively in the SWG agent.

Why did my Cloud SWG policy need a review in 2026?

The 2026 release notes changed file-type handling: octet-stream content is no longer treated as executable, and "Unknown Type" moved into File Control. Those changes force a policy review. Since you are in the console anyway, it is a practical moment to compare against an on-device gateway.

Is Broadcom Web Security slower than on-device inspection?

Cloud SWG is a cloud proxy, so every request detours to a point of presence and back, and Broadcom's own knowledge base documents latency and timeout issues. dope.security inspects on the device and flies direct, with no round-trip, which is where the speed difference comes from.

What about renewals and pricing?

Customers report Cloud SWG renewals at roughly two to four times for mid-market and higher for small business after perpetual licenses were eliminated. dope.security publishes pricing and offers a free production trial, so you can measure value before committing.

How disruptive is moving off Cloud SWG to dope.security?

dope.security deploys as a sub-100 MB agent through Intune or Jamf with policy on every endpoint in under a minute. Outreach Health secured 99% of devices within a week and cut web-access tickets 70% in 90 days after replacing a legacy SWG.

The bottom line: the rename to Web Security gave Cloud SWG a new label and a policy chore, not AI governance. The control that separates corporate AI from personal and reads the prompt lives on the device, in the same agent as the gateway, which is where dope.security puts it.