According to SEP EULA all instances of the software needs to be licensed - both on physical machines and virtualized:
17.3
Symantec Endpoint Protection - Virtual Instances
.17.3.A - Instances
Notwithstanding anything to the contrary contained in this License Agreement, each running instance
(physical and/or virtual) of the Licensed Software must be licensed. You create an “instance” of software
by executing the software’s setup or install procedure. You also create an “instance”of software by duplicating an existing instance.
References to the Licensed Software include “instances” of the Licensed Software. You “run an instance” of software by loading it into memory and executing one or more of its instructions. Once running, an instance is considered to be running (whether or not its instructions continue to execute) until it is removed from memory
http://www.symantec.com/content/en/us/enterprise/eulas/GLB_Ent_SEP_SEP%20SBE_SNAC_EULA_13Feb2013%28final%29.pdf
Have a look here as well:
https://www-secure.symantec.com/connect/articles/sep-121-and-license-concept