Cisco Duo - Advantage Edition

For primary purposes, I am using Cisco Duo  as an office gateway and Wi-Fi solution.

My experience with Cisco Duo 's strong security authentication system has benefited my organization; it is quite simple. It helps to manage potential threats because there are many things; if you have connected any network equipment and someone has used any third-party equipment, it will alert immediately, detecting many things which are bypassing the network equipment very well.

There is much that is helpful in having a complete passwordless environment with Cisco Duo; previously, we had a lot of password handling and saving, with people forgetting passwords, but now we do not face those problems anymore.

To improve Cisco Duo, we have some third-party hardware, and for integrations with that, we need more user-friendly integrations since third-party integration can present a lot of compatibility issues with legacy products.

In terms of deployment, Cisco Duo requires some improvement.

I have been working with Cisco Duo for the past two to three years.

Stability is one thing, and it is very stable.

We do not have any scalability issues because we only have an alerting system; we do not have any AI integrations at this time.

It takes two months to deploy the product because we have many different locations, almost 15 countries.

I would rate the technical support of Cisco as seven.

For security, we use only Cisco at this time.

Deployment of Cisco Duo was, at the beginning, a little bit tricky with the designing and all the considerations, then after that, it is very convenient to handle.

For a non-prepared, non-technical user, it could be tricky and quite complex. The implementation part is not simple as it requires many things to be taken care of before it is a stable solution.

For the part of the deployment, we hired a third-party vendor who implemented and trained us, and now we are handling that.

It is beneficial in terms of finance to use Cisco Duo with some return on investment and cost reductions in the long run.

It is a little bit expensive, but with security, we cannot compromise on it.

I have not thought of some alternatives or of switching to some other products.

I do make use of advanced identity threat detection and response features.

I am not much of a user, but we have a team to handle those things, which are the advantages of Cisco Duo.

In the past one year, we have not upgraded to any new features.

I am not much aware about Cisco Identity Intelligence, but my team looks at those things; I have very little information on that.

My overall rating for this product is seven.

Cisco Duo  serves as an MFA platform with various primary use cases. The first use case is remote access VPN MFA, which protects VPN access for users. Integration with Windows RDP and device admin management use cases are also configured frequently. When administrators need to access network devices, switches, firewalls, routers, and remote desktop environments, these systems are protected with MFA.

Cisco Duo  is mainly an MFA platform, though Cisco positions it as much more. Once a customer has Cisco Duo, we can go into details and use all of the security assessment policies that they have, or a new solution that was recently integrated is the Identity Intelligence platform, which is a kind of ITDR  focusing on identity threats monitoring and posturing. However, it all starts with the MFA.

The product is really amazing, and I think it is one of the best documentation sets I have ever seen. The development platform has improved much. However, it is really hard to position against Microsoft because a lot of customers have Microsoft or Entra ID. Microsoft sells it for free, so they have similar MFA use cases and conditional access policies, and about 90% of customers have it for free. Cisco Duo shines in environments where there are multiple identity providers being used. However, that may only be relevant for really big customers. For smaller customers or medium enterprise customers that mainly rely on Microsoft IDP , Entra, and Active Directory, we have troubles because they prefer Microsoft since it comes for free and is also a great tool.

The licensing model for Cisco Duo is really amazing because it is based on the number of users. When you buy Cisco Duo, you pay for the number of users and it does not matter how many applications you want to protect. It can be any number of web applications, any number of devices, anything. This allows us to make great deployments.

When the customer is satisfied with Cisco Duo, they can become addicted to it in a good sense because we can cover pretty much everything. I love the fact that it tries to play the role of integrating multiple identities. I think that is where they are going, and I think that makes sense.

Whenever a customer has multiple IDPs, for example, they have some LDAP servers, Active Directory, or RADIUS servers, Cisco Duo integrates it all. This is a lot harder with Microsoft or with other platforms. In general, the whole UI experience for an admin and also for users is very straightforward. They have integrated recently an AI assistant that is good. It can be better, but it helps you to configure things and to troubleshoot things. I really like the whole user experience of Cisco Duo, including the configuration experience, documentation, and support is great.

Cisco Identity Intelligence, which is part of Cisco Duo, is a great feature that performs a lot of security checks on all accounts, including machine accounts and agentic users. Depending on those checks, administrators get notifications and based on those notifications, they can act.

This is kind of a SOC CDC story. The admins managing Cisco Duo are not responsible for processing those monitoring or detections. Identity Intelligence is a great, amazing, and fantastic source of information that is absolutely relevant for the use cases that SOC CDC colleagues do for investigations that they run. They heavily rely on this and really consider it very much. They also integrate Microsoft similarly. For our managed service customers where we do SIM, CM, SOC, and CDC services kind of managed detection response, they use it a lot, so I think Identity Intelligence is a great tool.

When it comes to agentic things, we are quite at the beginning of the whole cycle. We do not see yet that big organizations really deploy those agentic agents. Of course, there are service accounts and those service accounts have been monitored, which is again a great tool. However, they are really afraid to create some AI tools that are just talking to each other because nobody has an overview about that. The organization security policy does not allow it for many customers, so it is not really a topic that we see right now. However, I think it will come at some point.

Visibility is great, and you get all the possible logs and all the possible security posture results in Cisco Duo. First of all, administrators and organizations get a lot more visibility and understanding of what is happening in their network and which identities they have.

With Cisco Identity Intelligence, you get a great overview of all possible accounts, including service accounts and user accounts. A lot of people start with the cleanup of those accounts because a lot of them are dormant, probably have been compromised, or have permissions that they do not need to have.

Cisco also has a partnership with BloodHound Enterprise , which is a great tool to discover attack paths on the active directory, which is an identity access management relevant topic. This has helped a lot. However, I must admit that we should do a better job in there because unfortunately, many customers managing Cisco Duo are firewall or network admins, and they are not really security oriented. Sometimes this teamwork is missing between those firewalling Cisco Duo management teams and the security SOC at the customer where they can really exchange information. Unfortunately, this conversation sometimes is missing, and sometimes it is just political decisions. It is really hard to affect how people work between themselves and between different teams. However, we are trying, and I think Cisco Duo has all the capabilities to improve and answer those needs. It can help a lot already to many, but it can help more. We are trying to do good work there, but people are people and unfortunately, some people do not really work the best with each other.

About 80% or a lot of phishing attacks go through email. Whenever users receive emails, those are phishing emails, and Cisco Duo does not really protect email. That is a solution that protects access to applications.

The whole email part is not covered, and I think when it comes to phishing, a lot of phishing attacks use the email vector. However, if we mean phishing attacks where attackers try to hijack MFA, Cisco Duo has done a lot of work there. For example, there are lots of features similar to conditional access in Microsoft. These include behavioral analytics, risk-based assessment, and configuration of things such as only trusted devices can be used to enter applications.

If somebody is using correct credentials to enter a website but the device is not that trusted and there is no certificate from Cisco Duo, it will be denied.

There is a great feature that is normally active by default called Bluetooth proximity. The phone, which is normally a second factor, and a laptop have to be located very close to each other. Bluetooth proximity helps against these phishing attacks, and it actually works on most devices. On Linux machines and more custom things, it is a bit harder, and there is no full support in there.

My company also uses Cisco Duo internally. We are Cisco partners, so we use a lot of Cisco products. We have all of the fancy features, like Cisco Duo Passport , which is a great tool when you authenticate once and then have single sign-on across all possible applications, across different browsers, and across different platforms. We use a lot of this, including Bluetooth proximity, and a lot of security features are configured in the background as well.

I have been using Cisco Duo for more than five years.

There are no performance issues. Cisco Duo provides 99.99% availability guarantee, which is very good.

Cisco Duo is not MSP ready by default. We had some requests from customers that wanted to make it global. For example, there was a customer located in different countries that wanted to have different admin panels, different dashboards, and completely fully isolated tenants between the countries. They wanted Austria to authenticate only in the Austrian tenant, Germany and so on. That is not possible by default. Cisco has to integrate it in the background and split it between AWS  regions, but we have no overview at all of what they do. It would be great if they were fully MSP ready. That is a scalability issue, but it is possible, though not perfect.

Depending on the customer, if we have implemented Cisco Duo correctly or if my organization heavily relies on Cisco Duo, it cannot be gone in a minute because we rely on that. If we cannot have Cisco Duo anymore for some reason, we would need to migrate to another solution, and that would take a lot of effort.

There are solutions that can cover use cases of Cisco Duo, such as maybe Okta, though maybe not all of the use cases. Most of them can be covered, and the other use cases may be covered somehow elsewhere, but somewhat differently. That would be a big, massive effort to migrate from Cisco Duo.

Cisco Duo cannot be easily replaced. If you configure it correctly and it is a primary authentication source, then you federate with an IDP , for example, and you need to federate other things. The federation itself is a real, global, major change. That is a complete traffic outage of the whole company. That is really hard if you go this way of relying on Cisco Duo as a primary authentication source. Not every company does it. For some of them, it is a lot easier to replace Cisco Duo, depending on how many applications they secure. However, for some customers, that is practically possible, but it is a massive effort.

I think the setup for Cisco Duo is very straightforward. You have to understand the whole topic a bit, like what is possible and what is achievable. Cisco Duo is not only MFA; it is a real identity access management platform with a lot of security features in there.

It takes some time to explain all of those capabilities, but the setup itself is very straightforward. However, in most cases, this topic does not land on the side of Windows or Active Directory admins that already know a lot about identities. Most of the time, the MFA topic lands on the firewall team because they start by securing remote access VPN and securing access to devices like switches. They do not know that much about identity, so it takes some time to explain how it works. I would say it is just more of a positioning thing, but the setup itself is very easy. If it lands on a person that knows about identities because they worked with identities before, that is very self-explanatory.

It is hard to calculate, but one of the features that has really affected operational costs is the fact that Cisco Duo can be integrated pretty well with any SIEM  solution, also Splunk, which belongs to Cisco.

SOC CDC teams that are doing security investigations rely on identities. Normally, it is relatively hard for them to get all of the possible identity logs. Sometimes it is just an IP address or the hostname. They get those logs from other systems or from the firewall. Cisco Duo adds this layer of identities. I know that SOC CDC colleagues spend a lot less time finding those identities and therefore reduce the whole operational cost. They would need less time finding out the identities and they can focus on other things. However, it is really hard to calculate because you need to take each individual customer, how many investigations that customer has, and how many it was without Cisco Duo and with Cisco Duo.

I think it did improve a lot of things. From the configuration perspective, they have added an AI assistant recently, like some months ago. I think that is also great. That helps some people that are starting to work with Cisco Duo to do those configurations faster.

The UI itself has developed a lot. There are a lot of explanations when you click on a button and when you see a feature, it explains it very well. That also helps to minimize the cost of configuration because some customers do not need to contact partners or somebody else more experienced. They can do a lot of things themselves, and I think they can do everything themselves. It is just that you have to read a bit, but it is not hard at all. Cisco is doing a great job in there.

Cisco Duo is trying to be cloud only with SaaS deployment. It would be great if they did it on-premises. Here  in Europe, there are plenty of customers that would benefit greatly from Cisco Duo, but they do not want it because it is SaaS only. I am not saying that they should do the whole on-prem version, but they could maybe do a data plane on site, and the control plane could reside in the cloud as SaaS. However, the data plane could reside on-prem, and for many customers, that would be already enough to consider it. Sometimes it is really a security policy. They hear cloud and they say no.

Another thing that I am really looking forward to happening is integration with the Cisco Secure Firewall . That is in terms of identity intelligence, and those kinds of risks that are dynamically assessed by Cisco Identity Intelligence, which is part of Cisco Duo, could be shared with the secure firewall. However, the identities themselves and the mappings of which users are coming from where could be used, and that would also be fantastic. They do something similar with Secure Access. Cisco Duo integrates with Secure Access. However, there is room for improvement in there. I just do not know if they go that direction. I know a lot of people at Cisco because I work a lot with them. I know that they discuss it, and they want to integrate Cisco Duo more and more with Secure Access. I do not know if they plan for Secure Firewall. I hope they plan. It would be great to see more integrations in that area.

Cisco Duo is only a SaaS solution. There is nothing else.

Cisco Duo is still kind of an island in Cisco. It is another team and kind of another company in a company. I would say they are really good, and I have really great experience with those people. They are always helpful. In general, for customer experience, they are always trying to reach out to ask for feedback, and I see that they consider those feedbacks. I would rate them as a nine. Not a ten because it is hard to be everything ten.

Cisco Identity Intelligence, which is part of Cisco Duo, is a great feature that does a lot of security checks on all accounts, including machine accounts and agentic users. Depending on those checks, administrators get notifications, and based on those notifications, they can act.

I would rate Cisco Duo a nine because they can improve in some cases like everybody. However, I think it is a really good tool. They are trying now to really promote it. You get it kind of almost for free with some products. With Secure Access, you get it, and sometimes with a great discount. However, the whole story of Microsoft is really hard to compete with in general. If it was Okta, I am sure that Okta is also struggling to compete with Microsoft because they just come in, and everybody realizes that they give the authenticator capabilities for free. That is a hard conversation to have. The overall review rating for Cisco Duo is nine out of ten.