Duo Security

Overview

Duo, acquired by Cisco in 2018, is the reference best-of-breed multi-factor authentication and device-trust layer. Rather than replace your identity provider, Duo sits in front of applications and VPNs to add strong authentication and device posture, which is why it is so widely deployed in education and mixed enterprise environments.

What it is good at

Ease of deployment and breadth of coverage. Duo protects almost anything (cloud apps, VPNs, RDP, on-prem) with a famously simple push experience, and it layers cleanly on top of Okta, Entra, or an existing directory. Device trust and health checks (the Cisco "Trusted Access" story) let you block risky or unmanaged devices, and Duo supports phishing-resistant methods including FIDO2 keys and passkeys. The free tier and transparent pricing make it approachable, and support and reliability are strong.

Where it falls short

Duo is an authentication and access layer, not a full identity platform, so lifecycle, provisioning, and governance come from elsewhere. Push-based MFA, while convenient, is susceptible to fatigue attacks unless you enable Verified Push and move toward phishing-resistant factors. Organizations standardizing on a single vendor's IdP plus MFA bundle may prefer the native option, and a 2024 breach at a Duo telephony supplier exposed SMS logs, a reminder to avoid SMS as a factor.

Pricing

Transparent per-user tiers with a free plan for small deployments, generally good value for the coverage.

Best for, and who should look elsewhere

Choose Duo when you want strong, easy-to-deploy MFA and device trust across a heterogeneous estate on top of your existing IdP. Choose native MFA in Entra or Okta if you prefer one bundled stack, or hardware-first Yubico for the highest-assurance users.

Bottom line

The default best-of-breed MFA and device-trust layer, especially for mixed environments and education. Pair it with phishing-resistant factors.