Cisco Security Licensing: Umbrella, SecureX, and Duo

1. Cisco Security Portfolio Overview

Cisco operates one of the broadest security portfolios in enterprise IT. With the 2018 acquisition of Duo Security for $2.35 billion, Cisco doubled down on zero-trust and identity-driven security, integrating Duo's MFA and conditional access capabilities into a comprehensive security strategy alongside its legacy Umbrella (DNS security), Secure Endpoint (EDR/AMP), Secure Email, Secure Firewall (Firepower), and SecureX (XDR platform).

Understanding Cisco's security licensing model is critical because:

• High list pricing: Cisco's security products carry premium list prices (often 40-50% above street pricing).
• Complex bundling: Cisco aggressively bundles security products into a unified Security Suite EA, with bundled discounts far exceeding standalone purchasing.
• Integration incentives: Cisco incentivizes adoption across the portfolio (Umbrella → Duo → Secure Endpoint → SecureX) with staggered EA pricing.
• Competitive pressure: Strong alternatives from Microsoft (Security E5), Zscaler (SASE), and CrowdStrike (Falcon) create significant negotiation leverage.

2. Cisco Umbrella Licensing & SASE

Cisco Umbrella is the company's flagship DNS-layer security and Secure Internet Gateway (SIG) product. It sits at the intersection of SASE (Secure Access Service Edge) and advanced threat protection, competing directly with Zscaler Internet Access (ZIA) and Palo Alto Prisma Access.

Umbrella Tiers:

• DNS Security Essentials: DNS threat prevention, malware blocking, phishing defense. Per-user/per-year pricing. List price $3–5 per user/month ($36–60 /user/year).
• DNS Security Advantage: Essentials + advanced analytics, SSL inspection, content filtering. List price $5–7 per user/month ($60–84 /user/year).
• SIG (Secure Internet Gateway) Essentials: DNS + cloud web gateway (SWG) + CASB. Broader data loss prevention (DLP) and app visibility. List price $8–10 per user/month ($96–120 /user/year).
• SIG Advantage: SIG Essentials + advanced threat protection, SSL inspection, sandboxing. List price $10–13 per user/month ($120–156 /user/year).

In practice, Cisco's street pricing on Umbrella is 35-50% below list, placing Advantage at roughly $40-60 per user/year. Zscaler, however, typically undercuts Cisco by 15-30%, which is critical negotiation leverage.

SASE Positioning vs. Competition:

Cisco frames Umbrella as a foundational SASE (zero-trust network access) product, positioning it against Zscaler's ZIA and Palo Alto Networks' Prisma Access. The SASE market is consolidating, with Cisco emphasizing the integration of Umbrella with Duo (authentication) and Secure Endpoint (threat intelligence) as a unified security fabric.

3. Duo MFA & Zero Trust Access

Duo Security is Cisco's identity and access management centerpiece, providing multifactor authentication (MFA), passwordless authentication, and adaptive access controls. It competes with Microsoft Entra ID (Azure AD) MFA, Okta, and other IDaaS platforms.

Duo Tiers & Pricing:

• Duo Free: Free MFA for up to 10 users. Useful for pilots and POCs.
• Duo MFA: Per-user/month subscription. List price $3–5 /user/month. Core 2FA/MFA and device trust.
• Duo Access (formerly Premier): List price $8–12 /user/month. MFA + adaptive access, device controls, endpoint compliance.
• Duo Beyond (Duo Suite): List price $12–18 /user/month. Full IAM platform: authentication, SSO, lifecycle management, passwordless auth.
• Passwordless Authentication add-on: Optional tier enabling passwordless sign-in, biometric authentication. Typically $2–4 /user/month additional.

Street pricing on Duo MFA is $2–3.50 /user/month; Duo Access is $6–8 /user/month. Cisco often bundles Duo into larger EA deals at aggressive discounts (40-50% off list).

4. Cisco Secure Endpoint (formerly AMP) & EDR

Secure Endpoint is Cisco's endpoint detection and response (EDR) / next-gen antivirus platform. Originally called Advanced Malware Protection (AMP), it competes with CrowdStrike Falcon, Microsoft Defender for Endpoint (included in M365 E5), and SentinelOne.

Secure Endpoint Tiers:

• Essentials: Traditional antivirus + threat prevention. List price $80–120 per endpoint/year. Street price $40–60.
• Advantage: Essentials + advanced EDR, threat hunting, file behavior analysis. List price $150–200 per endpoint/year. Street price $80–120.
• Premier: Advantage + managed hunting services, forensics, priority support. List price $200–250+ per endpoint/year. Street price $120–160.

Secure Endpoint typically requires a 3-year subscription with annual renewal terms. Per-device licensing model means VMs and containers can quickly multiply costs — a critical audit risk.

CrowdStrike & Microsoft Comparison:

CrowdStrike Falcon licenses at roughly $100–120 per endpoint/year with stronger EDR capabilities. Microsoft Defender for Endpoint is included in M365 E5 at no additional cost (though E5 licensing is expensive overall). For organizations already on M365 E5, Defender for Endpoint + Sentinel for SIEM may be sufficient, eliminating Cisco Secure Endpoint entirely.

5. SecureX & Cisco XDR

SecureX is Cisco's XDR (extended detection & response) and security orchestration platform. It aggregates telemetry from Umbrella, Secure Endpoint, Secure Email, Secure Firewall, and other Cisco security products into a unified dashboard for threat detection and response.

SecureX Licensing Model:

• SecureX (Core): Included for free with most Cisco security product subscriptions (Umbrella, Secure Endpoint, Duo).
• Cisco XDR (Extended Detection & Response): Paid tier with advanced threat correlation, automated playbooks, managed threat hunting. List price varies; typically $4–8 /user/month or $8–15 per endpoint/month depending on usage.

The inclusion of SecureX (core) with other Cisco security products makes it a "free" addition, incentivizing broader product adoption. Cisco XDR is the upsell — it's where Cisco monetizes the analytics and hunting layer.

6. Cisco Security Suite in the EA

Cisco's most aggressive pricing occurs when bundling multiple security products into a unified Security Suite EA. Typical structure:

Security Suite EA Components:

• Umbrella (DNS Security Advantage or SIG Essentials)
• Duo MFA or Duo Access
• Secure Endpoint (Advantage tier)
• Secure Email (cloud-based threat prevention)
• SecureX (core XDR platform)
• Talos (threat intelligence feeds)

Security Suite Pricing: Per-user/per-year bundled pricing typically ranges $120–180 per user/year on street. This represents a 25–35% discount versus purchasing each product standalone.

Example:

• Umbrella Advantage: $50/user/year
• Duo MFA: $36/user/year
• Secure Endpoint Advantage: $100/endpoint/year (assume 1:1 user-to-endpoint)
• Secure Email: $24/user/year
• Subtotal (standalone): $210/user/year
• Security Suite EA: $155/user/year (26% discount)

This bundling is Cisco's primary lever for large deals, and the discount can stretch to 35–40% with multi-year commitments and True-Down rights.

7. Competitive Alternatives & Leverage

Effective negotiation requires understanding Cisco's competitive position. Here are the primary alternatives that create leverage:

Cisco Product	Primary Competitor	Typical Price Difference	Negotiation Leverage
Umbrella (SASE)	Zscaler Internet Access (ZIA)	Zscaler -20–30%	3-month pilot of ZIA; RFP with Zscaler
Duo MFA	Microsoft Entra ID P2	M365 E5 included; Duo standalone -40%	M365 E5 adoption; Okta alternative
Secure Endpoint	CrowdStrike Falcon; Microsoft Defender EPA	Falcon -15%; Defender free w/ E5	M365 E5 deployment; Falcon RFP
Secure Email	Microsoft Defender for Office 365; Proofpoint	Proofpoint -10%; M365 included	O365 adoption; competitive email RFP
Security Suite (bundled)	Microsoft Security E5; Zscaler/Okta/Falcon combo	M365 Security E5 -40–50%	Unified Microsoft security stack; multi-vendor RFP

Microsoft Security E5 as the Nuclear Option:

Microsoft 365 Security E5 is Cisco's strongest competitor at the portfolio level. For $22–26 /user/month, Security E5 includes:

• Microsoft Defender for Endpoint (EDR)
• Microsoft Defender for Office 365 (email security)
• Microsoft Entra ID P2 (MFA, conditional access, SSO)
• Microsoft Sentinel (SIEM/XDR)
• Microsoft Purview (data governance, DLP, eDiscovery)
• Threat Intelligence integration

For organizations already on M365, this integrated security stack is dramatically cheaper than Cisco's standalone Security Suite. Cisco's response is typically to emphasize specialized EDR capabilities (Secure Endpoint), SASE networking (Umbrella), and deeper threat intelligence (Talos). But the TCO argument favors Microsoft if you're already licensed E5.

8. Eight Negotiation Tactics

Tactic 1: Use Microsoft Security E5 as Comprehensive Alternative

If your organization is on M365 E3, propose upgrade to E5 as a security replacement strategy. Present TCO comparison: E5 security components (Defender + Entra P2 + Sentinel) vs. Cisco Security Suite. Even at premium E5 pricing ($22–26/user/month), the bundled cost often matches Cisco's standalone pricing. Force Cisco to justify specialized capabilities (Umbrella SASE, advanced EDR hunting) to retain budget.

Tactic 2: Pilot Zscaler ZIA for SASE Leverage

Run a 3-month POC of Zscaler Internet Access (ZIA) on a 20–30% sample of your user base. Zscaler is typically 20–30% cheaper than Cisco Umbrella and has feature parity (DNS filtering, SWG, CASB). Present successful pilot results to Cisco, making it clear you're willing to migrate off Umbrella if pricing doesn't move. Cisco will aggressively discount to prevent SASE loss.

Tactic 3: Challenge Duo Pricing with Entra ID P2

If on M365 E5, Microsoft Entra ID P2 (included) covers 90% of Duo's MFA and conditional access use cases. Reduce Duo scope to specialized passwordless authentication or device trust scenarios. Negotiate reduced Duo seats (e.g., 500 users for Duo Beyond SSO, rest on Entra ID P2). This forces a hybrid model that cuts Duo pricing 30–40%.

Tactic 4: Bundle Security into EA for 25–35% Discount

Avoid standalone product negotiations. Insist on Security Suite EA bundling, where discounts are deepest (25–35% vs. standalone). When Cisco fragments pricing across products, they hide the bundled discount. Demand a single bundled price covering Umbrella, Duo, Secure Endpoint, Email, and SecureX. Multi-year commitments unlock additional 5–10% off.

Tactic 5: Demand True-Down Rights on Secure Endpoint Seats

Secure Endpoint often requires 3-year subscriptions with inflexible seat commitments. Negotiate True-Down (true-down true-up) rights allowing reduction of seats with 60–90 days notice, credited to future billing. This removes the risk of over-licensing endpoints (VMs, containers) and gives you flexibility to pilot alternatives like CrowdStrike Falcon or Defender for Endpoint.

Tactic 6: Negotiate Multi-Year Price Caps (CPI Escalation)

Cisco's default position is 3–5% annual price escalation. Propose a cap at Consumer Price Index (CPI) inflation or a flat 3% maximum, with an opt-out clause if true CPI exceeds cap. Multi-year deals (2–3 years) are more attractive to Cisco, and CPI caps are increasingly common in enterprise negotiations.

Tactic 7: Time Purchase Before Cisco Fiscal Year-End

Cisco's fiscal year ends July 31st. Cisco sales are heavily quota-driven in Q4 (May-July), giving you maximum leverage in late June/early July. Delay negotiations until this window and present a competitive RFP (including Zscaler, Okta, CrowdStrike) as a fast-closing deal if Cisco meets pricing targets. Year-end desperation can unlock 10–15% additional discounts.

Tactic 8: Use Cisco XDR Adoption as Leverage for Suite Discount

Propose to adopt Cisco XDR (paid tier) as part of security bundling, positioned as a managed threat hunting and orchestration layer. Use this as justification for Cisco to discount the underlying security products (Umbrella, Duo, Endpoint) more aggressively, leveraging XDR as a "stickiness" play. XDR adoption increases lock-in and gives Cisco confidence in retention, justifying deeper discounts on base products.

9. Audit Risks & Compliance

Cisco aggressively audits security licensing, particularly Secure Endpoint and Duo device licensing. Understanding these risks is critical.

Cisco Secure Endpoint Audit Traps:

• VM licensing: Cisco counts each virtual machine as a separate endpoint license. If you have 100 physical servers with 500 VMs, you need 500 Secure Endpoint licenses — not 100. This is a major audit exposure.
• Container licensing: Similarly, Kubernetes containers and container instances may each require an endpoint license, depending on your deployment model and Cisco's interpretation of your contract.
• Device trust licensing: Duo's device trust feature can trigger additional licensing for managed devices. If Duo requires device enrollment and compliance checking, each managed device may require a separate license.
• User vs. device mismatch: Confusion between user-based and device-based licensing creates exposure. Clarify whether Umbrella and Duo count per-user or per-device.

Audit Preparation:

Conduct a pre-audit compliance baseline using Cisco's SLAW (Security License Assessment Workflow) tool. This tool identifies non-compliance and gives you time to remediate before a formal audit. Key compliance documents to maintain:

• Software asset inventory (device count, VM/container count)
• License entitlement records (purchase orders, subscription active dates)
• Network access logs (to verify endpoint deployment scope)
• Duo device trust enrollment records (to validate device counts)

10. Frequently Asked Questions

Comprehensive Cisco Security Pricing Table

Product	Tier	List Price	Street Price	Best Alternative	Price Delta
Umbrella	Advantage	$84/user/yr	$50–60	Zscaler ZIA	Zscaler -20%
Umbrella	SIG Essentials	$120/user/yr	$75–90	Palo Alto Prisma	Prisma -25%
Duo	MFA	$48/user/yr	$24–36	Microsoft Entra P2	Entra free w/ E5
Duo	Access	$120/user/yr	$72–96	Microsoft Entra P2	Entra -50%
Secure Endpoint	Advantage	$180/ep/yr	$100–130	CrowdStrike Falcon	Falcon -15%
Secure Endpoint	Premier	$240/ep/yr	$140–180	Microsoft Defender EPA	Defender free w/ E5
Secure Email	Cloud	$48/user/yr	$28–40	Proofpoint	Proofpoint -10%
Security Suite (bundled)	EA	$240/user/yr	$155–180	Microsoft Security E5	M365 -35%

Cisco Security vs. Microsoft Security E5 Feature Matrix

Capability	Cisco Product	Microsoft Equivalent	Cisco Advantage	Microsoft Advantage
DNS Filtering / SASE	Umbrella	Not included	Dedicated SASE platform	–
MFA / Passwordless Auth	Duo	Entra ID P2	Specialized MFA platform	Included in E5
EDR / Endpoint Detection	Secure Endpoint	Defender for Endpoint	Advanced threat hunting	Included in E5
Email Security	Secure Email	Defender for O365	Legacy integration	Included in E5
SIEM / XDR	SecureX / Cisco XDR	Microsoft Sentinel	Purpose-built XDR	Enterprise SIEM
Data Governance / DLP	Not included	Purview DLP	–	Included in E5