Cisco security licensing: bundles & pricing.
Cisco has consolidated its security portfolio onto per-user and per-device subscription suites. This note maps the User Protection, Breach Protection and Cloud Protection bundles, the per-user versus per-appliance pricing that sets cost, where the bundle-versus-a-la-carte line falls, and the levers that cut a security renewal.
The suites price below the sum of their parts when you deploy most of the bundle — and well above point products when you license a suite for one component. The User Protection Suite runs roughly $60–$120 per user per year by tier. The highest-value renewal move is not the discount: it is matching the suite, tier and user count to real Smart Licensing consumption, and cutting the overlaps you already pay another vendor for.
01 Key findings
Cisco security is now a platform sale, not a product sale. Duo, Secure Email, Secure Endpoint, Umbrella and XDR are packaged into per-user or per-workload suites — the pricing rewards deploying the whole bundle and punishes licensing a suite for one product.
The bundle-versus-a-la-carte line is the first question. The suite is attractively priced if you use most of its components and poor value if you could have bought the one product you need standalone. Match usage to the suite before anything else.
Two pricing bases, two cost drivers. The user suites scale linearly with headcount and tier; the Secure Firewall lines scale with appliance count and throughput band. Buying the top tier across the whole base, or a firewall band above real traffic, overpays on every unit.
Overlap is usually a bigger saving than discount. Many estates pay twice for multifactor, DNS security or endpoint that both a Cisco suite and a separate point product provide. Cutting the duplicate beats any renewal discount.
The user-count baseline controls the true-up. Suites are sold against a committed user count in Smart Licensing; mid-term additions are charged at the less favourable true-up rate. Setting the baseline from actual consumption turns the true-up from a surprise into a planned line.
02 The suite model
Cisco reorganised its security portfolio around outcomes rather than products, principally the User Protection Suite covering identity, secure access, and email and endpoint protection; the Breach Protection Suite covering detection and response across the extended estate; and the Cloud Protection Suite covering workload and application security. Each suite bundles what used to be separate products — Duo for multifactor, Secure Email, Secure Endpoint, Umbrella for DNS-layer security, and the XDR detection platform — into a per-user or per-workload subscription.
The intent is to sell security as a platform, and the pricing reflects it: the suite is attractively priced if you deploy most of the bundled components and poor value if you license it for one product you could have bought standalone. The first question in any Cisco security renewal is therefore whether your usage matches the suite you are paying for. Cisco security entitlements are tracked through Smart Licensing, the account-based system that records what you own against what you have deployed — a suite entitlement that shows as under-consumed is a candidate to reduce, while an over-consumed one is a compliance exposure to resolve before the vendor raises it.
03 Bundle & pricing matrix
Security licensing splits between the user-based suites, priced per user per year, and the network security lines, priced per firewall appliance and throughput band. Representative annual list pricing across the main lines:
| Line | Basis | What it bundles | Approx. list / year |
|---|---|---|---|
| User Protection Suite (Essentials) | Per user | Duo MFA, secure access, email & endpoint | $60–$80 |
| User Protection Suite (Advantage) | Per user | Essentials plus advanced access & endpoint | $100–$120 |
| Breach Protection Suite | Per user | XDR detection & response, extended estate | $90–$140 |
| Umbrella (DNS security) | Per user | DNS-layer security, standalone or in-suite | $24–$50 |
| Secure Firewall Threat Defense | Per appliance + throughput | Threat defense, malware, URL filtering | $3,000–$25,000+ |
The per-user suites scale linearly with headcount, which makes the user count and the tier the two cost drivers, while the firewall lines scale with appliance count and throughput. Our analysis of Cisco EA pricing covers how the security suites are valued inside the Enterprise Agreement, where a large estate is usually priced against a blended rate below standalone per-user pricing.
04 Cost at scale
Because the user suites scale linearly, the tier choice compounds across the whole base. Annual list cost per 1,000 users, at the midpoint of each line, shows how far apart the tiers sit:
Take 5,000 users on the Advantage tier at $110 — $550,000 a year. If analysis shows only 1,800 genuinely need the advanced components and the other 3,200 are covered by Essentials at $70, the split runs $198,000 plus $224,000 = $422,000, a $128,000 annual saving drawn entirely from matching the tier to the user rather than buying the top tier across the whole base.
05 The bundle trap
The suite bundle is priced to reward full deployment, which creates two symmetric traps: paying for a whole suite to get one product, and paying twice for a component you already license elsewhere. Both are found the same way — by mapping every security control to the products that deliver it before the renewal, not during it.
Map every control to its product and find the duplicates. Many organisations license a Cisco security suite alongside overlapping point products from other vendors, paying twice for multifactor, DNS security or endpoint protection that two platforms both provide. Cutting the redundant standalone product — or declining the suite component you cover elsewhere — is often a larger saving than any discount the negotiation produces. Run this against the same Smart Account consumption data Cisco uses to propose your renewal, and it becomes the evidence base to challenge it.
The mirror image also applies. The suites include centralised logging, policy reporting and audit evidence that can satisfy compliance requirements which would otherwise need separate tooling, so a suite that looks expensive on raw protection may be priced fairly once the compliance tools it displaces are credited against it. Inventory both directions — the point products the suite duplicates, and the compliance tooling it makes redundant — in the same analysis.
06 Per-user vs per-device
The two pricing bases behave differently and reward different disciplines. The per-user suites are sold against a committed user count that drives both the price and the true-up exposure; the per-appliance firewall lines price against a throughput band, where buyers most often pay for headroom they never use.
| Dimension | Per-user suites | Per-device firewall lines |
|---|---|---|
| Cost driver | User count × tier | Appliance count × throughput band |
| Baseline risk | Committed count set too high pays for empty seats | Band sized for peak carries a subscription priced for traffic it never passes |
| Growth exposure | Mid-term adds charged at the true-up rate | Refresh defaults to the next band up unless measured |
| Right-sizing lever | Split the estate by real tier need | Pull actual throughput per appliance and match the band |
For the firewall lines the fix is the same band-creep discipline as SD-WAN: pull the measured throughput per appliance before renewal and confirm each unit sits in the band its real traffic requires, not the band it was provisioned for. For the suites, the consumption data in Smart Licensing is what lets you set the committed baseline from the real deployed count rather than an estimate — the buyer who sets it from actual consumption controls the true-up; the one who guesses pays for the gap.
07 A buy framework
Four considerations decide whether a suite, a tier split, or standalone products is the right structure. Weight them to your estate before committing.
Component utilisation
Count how many of the bundled components you will actually deploy. Above roughly half the bundle, the suite prices below the parts; below that, a point product is usually cheaper.
Tier mix
Only a subset of users typically need the Advantage components. Splitting Essentials from Advantage by real need is the single largest per-seat saving in most estates.
Existing overlap
Inventory the multifactor, DNS and endpoint tools you already own. Every control a suite duplicates is a component to decline or a standalone product to retire.
Estate trajectory
Set the committed user-count baseline from Smart Account consumption, not an optimistic growth curve. The baseline drives the true-up rate on every user you add mid-term.
08 Our recommendation
You deploy most of the bundled components and value single-vendor management, integration and one negotiation. Consolidation lowers per-capability cost — but credit the compliance tooling it replaces and commit against real consumption.
A minority of users need Advantage; the rest are covered by Essentials. Split the estate by real need rather than buying the top tier across the whole base — typically the largest saving on the table.
You need one capability — Umbrella, Duo or Secure Endpoint alone — or a specialised requirement a stronger point product serves. Buy it standalone and forgo the bundle rather than licensing a suite for a fraction of its value.
09 Cutting the renewal
The Cisco security renewal responds to three moves: matching the suite to actual component usage, right-sizing the user count and tier against the Smart Licensing consumption data, and removing the overlaps with point products from other vendors. Because the firewall lines price on throughput bands, those appliances carry the same band-creep saving as SD-WAN, where a unit provisioned for peak sits a band above its real traffic. The broader Cisco licensing guide places security alongside the networking and collaboration lines, and a review through our vendor negotiation service maps the suite entitlements against real use and models the EA security bundle against standalone licensing.
Renewing Cisco security?
We map suite entitlements against real use and negotiate the renewal against the EA security bundle. Send us your suite list.
The Licensing Edge
Weekly vendor and licensing intelligence for enterprise IT leaders. 3,000+ subscribers.