Cisco Duo - Advantage Edition

Cisco Duo  serves as an MFA platform with various primary use cases. The first use case is remote access VPN MFA, which protects VPN access for users. Integration with Windows RDP and device admin management use cases are also configured frequently. When administrators need to access network devices, switches, firewalls, routers, and remote desktop environments, these systems are protected with MFA.

Cisco Duo  is mainly an MFA platform, though Cisco positions it as much more. Once a customer has Cisco Duo, we can go into details and use all of the security assessment policies that they have, or a new solution that was recently integrated is the Identity Intelligence platform, which is a kind of ITDR  focusing on identity threats monitoring and posturing. However, it all starts with the MFA.

The product is really amazing, and I think it is one of the best documentation sets I have ever seen. The development platform has improved much. However, it is really hard to position against Microsoft because a lot of customers have Microsoft or Entra ID. Microsoft sells it for free, so they have similar MFA use cases and conditional access policies, and about 90% of customers have it for free. Cisco Duo shines in environments where there are multiple identity providers being used. However, that may only be relevant for really big customers. For smaller customers or medium enterprise customers that mainly rely on Microsoft IDP , Entra, and Active Directory, we have troubles because they prefer Microsoft since it comes for free and is also a great tool.

The licensing model for Cisco Duo is really amazing because it is based on the number of users. When you buy Cisco Duo, you pay for the number of users and it does not matter how many applications you want to protect. It can be any number of web applications, any number of devices, anything. This allows us to make great deployments.

When the customer is satisfied with Cisco Duo, they can become addicted to it in a good sense because we can cover pretty much everything. I love the fact that it tries to play the role of integrating multiple identities. I think that is where they are going, and I think that makes sense.

Whenever a customer has multiple IDPs, for example, they have some LDAP servers, Active Directory, or RADIUS servers, Cisco Duo integrates it all. This is a lot harder with Microsoft or with other platforms. In general, the whole UI experience for an admin and also for users is very straightforward. They have integrated recently an AI assistant that is good. It can be better, but it helps you to configure things and to troubleshoot things. I really like the whole user experience of Cisco Duo, including the configuration experience, documentation, and support is great.

Cisco Identity Intelligence, which is part of Cisco Duo, is a great feature that performs a lot of security checks on all accounts, including machine accounts and agentic users. Depending on those checks, administrators get notifications and based on those notifications, they can act.

This is kind of a SOC CDC story. The admins managing Cisco Duo are not responsible for processing those monitoring or detections. Identity Intelligence is a great, amazing, and fantastic source of information that is absolutely relevant for the use cases that SOC CDC colleagues do for investigations that they run. They heavily rely on this and really consider it very much. They also integrate Microsoft similarly. For our managed service customers where we do SIM, CM, SOC, and CDC services kind of managed detection response, they use it a lot, so I think Identity Intelligence is a great tool.

When it comes to agentic things, we are quite at the beginning of the whole cycle. We do not see yet that big organizations really deploy those agentic agents. Of course, there are service accounts and those service accounts have been monitored, which is again a great tool. However, they are really afraid to create some AI tools that are just talking to each other because nobody has an overview about that. The organization security policy does not allow it for many customers, so it is not really a topic that we see right now. However, I think it will come at some point.

Visibility is great, and you get all the possible logs and all the possible security posture results in Cisco Duo. First of all, administrators and organizations get a lot more visibility and understanding of what is happening in their network and which identities they have.

With Cisco Identity Intelligence, you get a great overview of all possible accounts, including service accounts and user accounts. A lot of people start with the cleanup of those accounts because a lot of them are dormant, probably have been compromised, or have permissions that they do not need to have.

Cisco also has a partnership with BloodHound Enterprise , which is a great tool to discover attack paths on the active directory, which is an identity access management relevant topic. This has helped a lot. However, I must admit that we should do a better job in there because unfortunately, many customers managing Cisco Duo are firewall or network admins, and they are not really security oriented. Sometimes this teamwork is missing between those firewalling Cisco Duo management teams and the security SOC at the customer where they can really exchange information. Unfortunately, this conversation sometimes is missing, and sometimes it is just political decisions. It is really hard to affect how people work between themselves and between different teams. However, we are trying, and I think Cisco Duo has all the capabilities to improve and answer those needs. It can help a lot already to many, but it can help more. We are trying to do good work there, but people are people and unfortunately, some people do not really work the best with each other.

About 80% or a lot of phishing attacks go through email. Whenever users receive emails, those are phishing emails, and Cisco Duo does not really protect email. That is a solution that protects access to applications.

The whole email part is not covered, and I think when it comes to phishing, a lot of phishing attacks use the email vector. However, if we mean phishing attacks where attackers try to hijack MFA, Cisco Duo has done a lot of work there. For example, there are lots of features similar to conditional access in Microsoft. These include behavioral analytics, risk-based assessment, and configuration of things such as only trusted devices can be used to enter applications.

If somebody is using correct credentials to enter a website but the device is not that trusted and there is no certificate from Cisco Duo, it will be denied.

There is a great feature that is normally active by default called Bluetooth proximity. The phone, which is normally a second factor, and a laptop have to be located very close to each other. Bluetooth proximity helps against these phishing attacks, and it actually works on most devices. On Linux machines and more custom things, it is a bit harder, and there is no full support in there.

My company also uses Cisco Duo internally. We are Cisco partners, so we use a lot of Cisco products. We have all of the fancy features, like Cisco Duo Passport , which is a great tool when you authenticate once and then have single sign-on across all possible applications, across different browsers, and across different platforms. We use a lot of this, including Bluetooth proximity, and a lot of security features are configured in the background as well.

I have been using Cisco Duo for more than five years.

There are no performance issues. Cisco Duo provides 99.99% availability guarantee, which is very good.

Cisco Duo is not MSP ready by default. We had some requests from customers that wanted to make it global. For example, there was a customer located in different countries that wanted to have different admin panels, different dashboards, and completely fully isolated tenants between the countries. They wanted Austria to authenticate only in the Austrian tenant, Germany and so on. That is not possible by default. Cisco has to integrate it in the background and split it between AWS  regions, but we have no overview at all of what they do. It would be great if they were fully MSP ready. That is a scalability issue, but it is possible, though not perfect.

Depending on the customer, if we have implemented Cisco Duo correctly or if my organization heavily relies on Cisco Duo, it cannot be gone in a minute because we rely on that. If we cannot have Cisco Duo anymore for some reason, we would need to migrate to another solution, and that would take a lot of effort.

There are solutions that can cover use cases of Cisco Duo, such as maybe Okta, though maybe not all of the use cases. Most of them can be covered, and the other use cases may be covered somehow elsewhere, but somewhat differently. That would be a big, massive effort to migrate from Cisco Duo.

Cisco Duo cannot be easily replaced. If you configure it correctly and it is a primary authentication source, then you federate with an IDP , for example, and you need to federate other things. The federation itself is a real, global, major change. That is a complete traffic outage of the whole company. That is really hard if you go this way of relying on Cisco Duo as a primary authentication source. Not every company does it. For some of them, it is a lot easier to replace Cisco Duo, depending on how many applications they secure. However, for some customers, that is practically possible, but it is a massive effort.

I think the setup for Cisco Duo is very straightforward. You have to understand the whole topic a bit, like what is possible and what is achievable. Cisco Duo is not only MFA; it is a real identity access management platform with a lot of security features in there.

It takes some time to explain all of those capabilities, but the setup itself is very straightforward. However, in most cases, this topic does not land on the side of Windows or Active Directory admins that already know a lot about identities. Most of the time, the MFA topic lands on the firewall team because they start by securing remote access VPN and securing access to devices like switches. They do not know that much about identity, so it takes some time to explain how it works. I would say it is just more of a positioning thing, but the setup itself is very easy. If it lands on a person that knows about identities because they worked with identities before, that is very self-explanatory.

It is hard to calculate, but one of the features that has really affected operational costs is the fact that Cisco Duo can be integrated pretty well with any SIEM  solution, also Splunk, which belongs to Cisco.

SOC CDC teams that are doing security investigations rely on identities. Normally, it is relatively hard for them to get all of the possible identity logs. Sometimes it is just an IP address or the hostname. They get those logs from other systems or from the firewall. Cisco Duo adds this layer of identities. I know that SOC CDC colleagues spend a lot less time finding those identities and therefore reduce the whole operational cost. They would need less time finding out the identities and they can focus on other things. However, it is really hard to calculate because you need to take each individual customer, how many investigations that customer has, and how many it was without Cisco Duo and with Cisco Duo.

I think it did improve a lot of things. From the configuration perspective, they have added an AI assistant recently, like some months ago. I think that is also great. That helps some people that are starting to work with Cisco Duo to do those configurations faster.

The UI itself has developed a lot. There are a lot of explanations when you click on a button and when you see a feature, it explains it very well. That also helps to minimize the cost of configuration because some customers do not need to contact partners or somebody else more experienced. They can do a lot of things themselves, and I think they can do everything themselves. It is just that you have to read a bit, but it is not hard at all. Cisco is doing a great job in there.

Cisco Duo is trying to be cloud only with SaaS deployment. It would be great if they did it on-premises. Here  in Europe, there are plenty of customers that would benefit greatly from Cisco Duo, but they do not want it because it is SaaS only. I am not saying that they should do the whole on-prem version, but they could maybe do a data plane on site, and the control plane could reside in the cloud as SaaS. However, the data plane could reside on-prem, and for many customers, that would be already enough to consider it. Sometimes it is really a security policy. They hear cloud and they say no.

Another thing that I am really looking forward to happening is integration with the Cisco Secure Firewall . That is in terms of identity intelligence, and those kinds of risks that are dynamically assessed by Cisco Identity Intelligence, which is part of Cisco Duo, could be shared with the secure firewall. However, the identities themselves and the mappings of which users are coming from where could be used, and that would also be fantastic. They do something similar with Secure Access. Cisco Duo integrates with Secure Access. However, there is room for improvement in there. I just do not know if they go that direction. I know a lot of people at Cisco because I work a lot with them. I know that they discuss it, and they want to integrate Cisco Duo more and more with Secure Access. I do not know if they plan for Secure Firewall. I hope they plan. It would be great to see more integrations in that area.

Cisco Duo is only a SaaS solution. There is nothing else.

Cisco Duo is still kind of an island in Cisco. It is another team and kind of another company in a company. I would say they are really good, and I have really great experience with those people. They are always helpful. In general, for customer experience, they are always trying to reach out to ask for feedback, and I see that they consider those feedbacks. I would rate them as a nine. Not a ten because it is hard to be everything ten.

Cisco Identity Intelligence, which is part of Cisco Duo, is a great feature that does a lot of security checks on all accounts, including machine accounts and agentic users. Depending on those checks, administrators get notifications, and based on those notifications, they can act.

I would rate Cisco Duo a nine because they can improve in some cases like everybody. However, I think it is a really good tool. They are trying now to really promote it. You get it kind of almost for free with some products. With Secure Access, you get it, and sometimes with a great discount. However, the whole story of Microsoft is really hard to compete with in general. If it was Okta, I am sure that Okta is also struggling to compete with Microsoft because they just come in, and everybody realizes that they give the authenticator capabilities for free. That is a hard conversation to have. The overall review rating for Cisco Duo is nine out of ten.

I use Cisco Duo  for device management and logging in. We also use it for applications and single sign-on, and we have Duo Central for logging into our applications.

My favorite feature about Cisco Duo  is the tiles, which we use for logging into all of our applications. We have a single point of management for all of our applications that we use to log into.

Cisco Duo has improved our operational efficiency and reduced costs in areas including authentication, IT support, and security operations. It performs its job for everything we're using it for. I would say it saved us from many incoming risks regarding fake devices. Our applications are secure, and anything that didn't offer security, we were able to secure, which was great.

Cisco Duo could improve in the area of applications. The generic option is what we've had to use for 90% of our needs. They don't have many pre-existing applications, so we have to do everything ourselves.

The product is great, but it is somewhat overpriced and overcomplicated. There are things they could improve; it feels somewhat archaic compared to other products.

I have been using this solution for about two years.

Regarding the stability of Cisco Duo, I experienced lagging, crashing, and downtime a few times, but they did send out warnings. They came back up within a reasonable amount of time, so I would say they are really good about that.

For scalability, Cisco Duo is quite good. I don't run into any problems with it, and they are pretty good about that.

I have never contacted technical support for Cisco Duo.

We were concerned about credential-based attacks before we decided to implement Cisco Duo. We have our own solution that goes through Mail Assure.

The initial deployment of Cisco Duo was difficult because setting up the original single sign-on was challenging.

It took me several hours across several days to deploy Cisco Duo for the first time because I kept giving up on the single sign-on. It was frustrating.

One person can deploy Cisco Duo.

Cisco Duo's visibility into identity-based risk has been really good. We conducted a practice scenario with something similar to spamming, where you get one request and then another one immediately. You assume it's legitimate, but it's not, and you pass it anyways. You could have been lazy about it.

Regarding the pricing of Cisco Duo, we are actually leaving because of that. It's something that we are not going to continue with due to the cost.

NinjaOne  is our choice because it has everything all together in one package. It's at a more favorable price point, and it is easier to manage everything.

I didn't have anything from Cisco Duo regarding phishing attacks that I remember. I don't receive emails from them or any warnings that I recall. I don't remember them reaching out to us about that at all.

We do offer Cisco products as part of our package as an MSFP, but we no longer have an official partnership.

My overall review rating for Cisco Duo is 6.