Duo Security

Duo Security: frequently asked questions

How much does Cisco Duo cost?

Duo is one of the few identity vendors publishing real list prices. As of September 2026: Duo Free is 0 dollars for up to 10 users, Essentials is 3 dollars per user per month, Advantage is 6 dollars, and Premier is 9 dollars. Licensing is per active user, not per device. Self-service purchases are sold in increments of 10 users below 100 users and increments of 25 above that. No minimum seat count is published for paid tiers, and Duo does not publish an annual versus monthly differential, so do not assume an annual discount.

Which Duo edition do I actually need?

Essentials at 3 dollars covers single sign-on, Duo Directory, phishing-resistant MFA, full passwordless, Trusted Endpoints and unlimited applications, which is enough for most organisations whose goal is strong authentication. Advantage at 6 dollars adds Cisco Identity Intelligence, Duo Passport, session theft protection, Active Directory Defense and Risk-Based Authentication. Premier at 9 dollars adds the zero trust access package, VPN-less remote access through Duo Network Gateway, and endpoint protection checks. The jump most buyers underestimate is Essentials to Advantage, because risk-based authentication and identity threat detection both sit behind it.

Did Cisco downgrade Duo inside the User Protection Suite?

Yes, and it is documented in Cisco's own legal Offer Description rather than any marketing page. Customers who purchased the Cisco Secure User Protection Suite before 4 December 2024 continue to receive Duo Premier. Purchases from that date receive Duo Advantage in both the Essentials and Advanced suite tiers. A second footnote states that customers receiving Duo Advantage via the suite may temporarily receive additional Duo features which Cisco may later disable at its sole discretion. If you buy Duo through the suite rather than directly, confirm which entitlement your contract carries.

Is Duo FedRAMP authorized?

Duo Federal is FedRAMP Authorized at Moderate impact, package FR1823149273, authorized 15 November 2019 via the agency path, with 15 authorizations and reuses. FedRAMP High is not available as a standalone Duo package: it is delivered through Cisco Security Cloud for Government, which contains Duo Federal Class D High. Duo's own naming uses Class C for Moderate and Class D for High. Federal editions offered are Federal Essentials and Federal Advantage; there is no Federal Premier. No list pricing is published for federal editions.

Is Duo FIPS validated?

Yes, with specifics worth checking against your requirement. Duo Mobile supports FIPS 140-2 on iOS 6 and later and Android Duo Mobile 3.25.0 and later, and FIPS 140-3 on iOS 16 and later and Android Duo Mobile 4.92.0 and later, using FIPS-validated random number generation via the Cisco FIPS Object Module, certificate 5430. FIPS 140-3 configurations are supported for the Duo Authentication Proxy on Windows and Linux with OS-level FIPS enabled, Duo Unix, and Duo Access Gateway 3.0.0 and later. One real constraint: LDAPS is the only FIPS-compliant authentication method for the Authentication Proxy.

Has Duo been breached?

Duo itself has not, but a supplier was. On 1 April 2024 a threat actor phished credentials from an employee of a telephony supplier Duo used for SMS and voice MFA delivery, then accessed that supplier's systems and took message logs covering 1 to 31 March 2024. Exposed data included destination phone numbers, carrier, country, state and message metadata. Message content was not accessed. Cisco assessed roughly 1 percent of Duo customers were affected, all in North America, and did not name the supplier. Widely repeated figures putting the count near 1,000 people are derived from a misreading of Duo's customer count and should be ignored.

What are Duo's real limitations?

Three are worth knowing before purchase. Duo Passport, the shared-session feature, requires TPM 2.0 on Windows or Secure Enclave on macOS and does not support Linux at all. Risk-Based Authentication is not supported for Windows Logon or Unix, which is a genuine gap for on-premises-heavy buyers paying for Advantage. And Duo's own documentation recommends against TOTP hardware tokens, since drift handling and resynchronisation are not fully supported.

What are the best Cisco Duo alternatives?

Microsoft Entra ID if you already own the licensing, since MFA and conditional access come bundled. Okta for broad vendor-neutral workforce identity where MFA is one part of a larger platform. Silverfort if the requirement is extending MFA to legacy systems, Active Directory authentication and service accounts that Duo cannot reach. Yubico for hardware-first phishing-resistant authentication. Duo remains the strongest choice when you want straightforward, well-priced MFA and SSO without buying a full identity platform.

Related on Start with Identity

• CVE
  SMB Server Kerberos reflection via Ghost SPNs

  October 2025 follow-on to CVE-2025-33073. SMB Server elevation of privilege by combining Kerberos reflection with Ghost SPNs and DNS self-registration.

• CVE
  Windows SMB Client improper authentication (tampering)

  Windows SMB Client improper authentication (CWE-287) that allows tampering. Not an Entra token bug, but it sits in the same Microsoft identity-adjacent patch tr

• CVE
  Windows SMB Kerberos reflection elevation of privilege

  Kerberos authentication reflection on SMB, still abusable via Ghost SPNs after the first fix. High-severity elevation of privilege on Windows.

• Comparison
  beyond-identity-vs-hypr

  Beyond Identity and HYPR score identically on every dimension of our rubric. The choice is device posture at every login against hardened enrollment and account

• Vendor
  Google Authenticator

  specialist

• Vendor
  Microsoft Authenticator

  top_tier