Hi,
Yes, Symantec Protection Engine for Cloud Services, or SPE, is the best migration path from Symantec Scan Engine, or SSE.
SPE interfaces with applications on the customer network.
ICAP interface is compatible betwwn SSE and SPE, so no modification is needed for ICAP client applications.
You could just replace the SSE running server with the new SPE running server, in place.
Hope this helps,
Haro