Cisco security licensing: Umbrella, Duo & SecureX costs.
Cisco's security portfolio spans 20-plus products with overlapping capabilities and deeply fragmented licensing. This note isolates what enterprises actually pay across Umbrella, Duo, Secure Firewall, XDR and the Security Cloud bundle — the per-user and per-appliance benchmarks, the bundle-versus-standalone maths, and the renewal traps that quietly add 20–30% to the bill.
Most enterprises overpay for Cisco security by 20–30% — not through bad rates, but through tier mismatches, redundant capabilities and renewals that assume no negotiation. The three moves that recover it: right-size tiers to actual utilisation, model bundle versus standalone honestly, and consolidate purchasing into a benchmarked EA Security Suite on a multi-year lock.
01 Key findings
Umbrella is the most over-tiered product in the portfolio. Enterprises routinely sit on SIG Essentials or SIG Advantage when DNS Security Advantage meets their real use case — DNS filtering plus basic CASB — at roughly half the cost.
Duo renews at the last tier bought, not the tier used. Organisations that bought Duo Premier for a zero-trust initiative that stalled keep paying Premier for users who only touch basic MFA.
Secure Firewall subscriptions eventually exceed the hardware. Priced at 15–25% of hardware list per year, the five-year subscription total often surpasses the appliance purchase price — and hardware refresh timing is the strongest lever against it.
The Security Cloud bundle only pays off above three components. If you actively use only Umbrella and Duo, the bundle adds cost for capabilities you will not use; standalone purchasing wins.
EA Security Suite consolidation is the largest single lever. Folding Umbrella, Duo and XDR into an existing Cisco EA typically captures 20–30% versus transactional pricing — discount tiers standalone buyers never reach.
02 Portfolio pricing matrix
The five most cost-significant Cisco security products, their licensing model and the enterprise discount range each supports. Umbrella and Duo are the volume line items; Firewall and the bundle carry the largest per-unit decisions.
| Product | What it covers | Licensing model | List range | Enterprise discount |
|---|---|---|---|---|
| Umbrella | DNS security, SWG, SIG | Per user / year | $24–$168 /user/yr | 25–35% (EA 40–50%) |
| Duo | MFA, SSO, ZTNA | Per user / month | $3–$9 /user/mo | 20–30% |
| Secure Firewall | NGFW threat subscriptions | Per appliance / year | $18k–$45k /appliance/yr | Refresh-driven |
| XDR | Detection & response | Per user / month | $12–$18 /user/mo | EA-dependent |
| Security Cloud | Multi-product bundle | Per user / month | $18–$36 /user/mo | 8–20% vs components |
03 Umbrella licensing
Cisco Umbrella is a cloud-delivered Secure Web Gateway and DNS security platform — one of Cisco's highest-growth products, and the one most frequently oversold into tiers that exceed requirements. List prices per user, per year:
| Tier | Core capabilities | List (per user/year) |
|---|---|---|
| DNS Security Essentials | DNS filtering, basic threat intelligence | $24–$36 |
| DNS Security Advantage | Enhanced DNS + CASB visibility | $48–$60 |
| SIG Essentials | Full SWG + DNS + firewall-as-a-service | $72–$96 |
| SIG Advantage | ZTNA + full SIG + remote browser isolation | $120–$168 |
The most common overpayment: sitting on a SIG tier when the actual use case — DNS filtering and basic CASB visibility — is fully served by DNS Security Advantage at half the cost. Audit Umbrella feature-utilisation reports before renewal to confirm which tier capabilities are actually used. Competitive alternatives (Zscaler Internet Access, Netskope, Palo Alto Prisma Access) typically unlock a further 5–10% when credibly presented.
04 Duo licensing
Cisco Duo is one of the market's most widely deployed MFA platforms, protecting access to applications, VPNs and workstations. It is user-count licensed across four tiers, priced per user, per month:
| Duo tier | Key features | List (per user/month) |
|---|---|---|
| Duo Free | Up to 10 users, basic MFA | $0 |
| Duo Essentials | MFA, SSO, basic device trust | $3.00 |
| Duo Advantage | + Device health, adaptive policies | $6.00 |
| Duo Premier | + ZTNA, trusted endpoint enforcement | $9.00 |
At 1,000-plus users Cisco typically offers 15–25% off Duo, with EA bundling adding a further 5–10%. Most enterprises land between Advantage and Premier: Premier's Zero Trust Network Access competes directly with Zscaler Private Access, so it justifies the premium only when it replaces a separate ZTNA investment.
05 Secure Firewall & XDR
Cisco Secure Firewall (formerly Firepower Threat Defence, formerly ASA) combines hardware platform entitlements with annual software subscriptions. Base functionality — stateful inspection, NAT, basic routing — ships with the hardware; security capabilities are add-on subscriptions:
| Subscription | Adds | Annual list (per appliance) |
|---|---|---|
| Threat Defence (TD) | IPS/IDS, URL filtering, advanced malware | $8,000–$25,000 |
| AMP for Networks | Advanced malware protection | $3,000–$12,000 |
| URL Filtering | Web category filtering | $2,000–$8,000 |
| Cisco Talos Intelligence | Premium threat intelligence feeds | $2,500–$10,000 |
Combined, subscriptions for a mid-range Firepower 4100-series appliance run $18,000–$45,000 annually — roughly 15–25% of hardware list per year, so the five-year subscription total often exceeds the purchase price. Hardware refresh timing is the strongest lever: Cisco discounts subscriptions aggressively to protect hardware revenue at refresh.
Cisco XDR (launched 2023) consolidates telemetry across Secure Endpoint, Umbrella, Secure Firewall and email security into one detection-and-response plane, licensed per user per month from roughly $12–$18 for EA customers. Its economics are strongest when it consolidates existing Cisco investments rather than replacing best-of-breed non-Cisco tools — standalone, it is expensive relative to CrowdStrike Falcon Complete or Microsoft Sentinel.
06 Discount at scale
At 2,000-plus seats, the purchasing route matters more than the headline tier. Effective discount off Umbrella SIG list pricing by route — the difference between transactional buying and a benchmarked, multi-year EA is roughly 35 points:
Enterprises buying 2,000-plus Umbrella seats through an EA Security Suite typically reach effective SIG Essentials costs of $35–$55 per user — 40–50% off list. Transactional purchasers rarely clear 20%.
07 Bundle & renewal traps
Cisco Security Cloud Standard and Advanced tiers bundle multiple products at a per-user price. Standard typically includes Umbrella DNS Security Advantage, Duo Advantage, Secure Email and XDR telemetry; Advanced adds Umbrella SIG, Duo Premier and full XDR response.
| Bundle tier | Approx. list price | vs component pricing |
|---|---|---|
| Security Cloud Standard | $18–$22 /user/month | 8–15% saving vs components |
| Security Cloud Advanced | $28–$36 /user/month | 12–20% saving vs components |
Bundle maths and renewal inertia both cut against you. The Security Cloud bundle only saves money when you actively use three or more included components — buy it for Umbrella and Duo alone and you are paying for shelfware. Renewals compound it: Duo and Umbrella re-quote at the last tier purchased regardless of utilisation, and Cisco lists rise 8–12% a year. Map active investments against bundle inclusions, and run utilisation reports, before every renewal.
08 Buying framework
Four factors decide whether a Cisco security renewal is right-sized or overspent. Weight them against your own estate before committing.
Feature utilisation
Pull Umbrella and Duo usage dashboards. If 60% of users never touch SIG-tier or ZTNA features, that is your tier-right-sizing case — made without adversarial negotiation.
Portfolio breadth
Count actively used security components. Three or more favours the Security Cloud bundle; one or two favours standalone purchasing of exactly what you run.
Competitive leverage
Formal quotes from CrowdStrike, Zscaler, Palo Alto or Microsoft Defender unlock Cisco's highest discretionary discount — but only when the evaluation is genuine and verifiable.
Commitment term
Three-year terms add 10–15% over annual and lock pricing against 8–12% annual list rises. Negotiate annual payment within the multi-year term to protect cash flow.
09 Our recommendation
If SWG and ZTNA features sit unused, step SIG down to DNS Security Advantage and reclaim roughly half the per-user cost. Audit utilisation reports before you renew, not after.
With only two active components, the Security Cloud bundle adds cost for shelfware. Keep both products standalone and push volume and competitive discounts on each.
Running Umbrella, Duo, Firewall and XDR? Fold them into an EA Security Suite on a 3-year lock, benchmarked against CrowdStrike and Zscaler — the 40–50% tier lives here.
Right-size your Cisco security spend
Our negotiation practice audits security portfolios, right-sizes Umbrella and Duo tiers, and runs benchmarked EA Security Suite renewals.
The Licensing Edge
Weekly Cisco and licensing intelligence for enterprise IT leaders. 3,000+ subscribers.