Duo
Security-first IAM and phishing-resistant MFA that attackers hate and users love.
By Cisco Duo · HQ Ann Arbor, US · 4.3/5 Value-Position score (estimate)
Positioning guardrails
Best for
- IT and security teams replacing legacy MFA with phishing-resistant, passwordless authentication
- SMBs that need MFA, SSO and device trust without a heavy deployment project
- Enterprises consolidating SSO, MFA, risk-based auth and device trust on one identity platform
- Government and regulated teams that need identity controls plus audited data-centre compliance
- Cisco-centric environments that want Duo to slot into an existing Cisco Security estate
Ideal size: 50–5,000 people · SMB to global enterprise with a named IT or security owner
Not for
- Buyers looking for a full identity governance and administration suite with access certifications and role mining
- Teams that require an on-premises-only or fully self-hosted identity stack
- Organisations wanting an all-in-one productivity suite rather than a standalone security layer
- Very small teams that need advanced IAM features beyond the 10-user free edition
Value metrics scorecard
Time-to-Value
2–4 weeks
~14 days to first production value
Total Cost of Ownership
$36,000/yr
Starts at $36 · Per user, per month, billed annually; Duo Free covers up to 10 users, paid editions are $3–$9 per user/month.
Implementation Friction
2/5
Engineering + admin effort required
Value-Position score
out of 5 · model estimate
Full cost breakdown
Mandatory implementation fee
None
Seat tiers
Under 100 users licences are bought in increments of 10; above 100 users in increments of 25.
Add-on costs
- Telephony credits for SMS and phone-call authentication are metered and billed separately
- Duo Care Signature, Enhanced Support and Solution Attached Services are paid support and onboarding add-ons (price on request)
Company & support
Who is behind Duo, and how your team gets help once it is live.
Company
- Founded
- 2010 · 16 yrs in business
- Headquarters
- Ann Arbor, US
How you get support
- PhonePaid plans
- EmailPaid plans
- Live chatNot listed
- Support portal / ticketsPaid plans
- Community forumAll plans
- Help centre / docsAll plans
- Dedicated account managerNot listed
- In person / on-siteNot listed
- Hours
- 24/7
- Response time
- Critical 1 business hour; High 2 business hours; Medium 4 business hours; Low 1 business day
Standard support covers 9am-5pm Mon-Fri with 24/7 coverage for critical and high severity issues; Duo Care Signature adds 24x7x365 support. Solution Attached Services, Quick Start and Enhanced Support are paid onboarding options.
“Not listed” means the vendor’s public pages don’t mention that channel, not that it is unavailable. Ask about it during evaluation.
Market position
Where Duo sits against its closest alternatives. Pick any two of cost, speed, friction and buyer score, and up to 9 companies to compare.
Quadrant view
Typical annual cost × Time-to-value
The lines cross at the median of the solutions shown, so about half sit on each side of each line. A dashed ring marks an outlier pinned to the edge; hover for its value.
Companies on the chart 6 / 10
- Duo
- Snyk
- Josys
- Akeyless
- Afi
- StackHawk
Add or change companies
Up to 10 companies including Duo. Listed closest first.
Stack fit signal
Compatibility with standard B2B ecosystems.
Ships an official MCP server. Connects to Claude Code, Claude Desktop, ChatGPT connectors and Cursor out of the box.
AI & MCP readiness
What Duo ships in AI, and what it asks of your ecosystem.
AI features shipped
The Cisco AI Assistant for Duo is an admin copilot for investigating access issues and finding configuration guidance. Agentic Identity & Access Management (alpha) gives visibility into AI agents plus scoped access policy, which reads as AI governance. No source states whether customers supply their own model keys or whether AI actions are logged or exportable.
In your ecosystem
- AI connection
- Official MCP server
- Model key
- Not recorded
- AI usage audit
- Not recorded
Compliance attestations
* IAPP AIGP certifies individuals, not products. It means named staff hold the credential — not that the platform does.
Bottom line
Duo, now Cisco Duo, is a security-first identity platform built around phishing-resistant MFA. It covers cloud and on-premises applications, SSO, passwordless login, device trust, risk-based authentication and identity threat detection, sold per user per month from $3 with a free tier for up to 10 users. Licences are self-service and rollout is fast; Cisco cites 100K customers, 1.3B monthly authentications and a Gartner Peer Insights Customers' Choice placement for access management.
Frequently asked questions
How long does it take to get Duo into production?
Duo is designed for self-service activation, and the pricing page states you can activate in minutes. In practice, most SMB teams enable MFA and SSO for core applications within two to four weeks, and a published customer story describes roughly 1,000 employees onboarded, registered and using the product in under 30 days. Larger estates with many legacy applications and on-premises VPN or RADIUS integrations should plan several weeks for staged rollout. Paid Solution Attached Services and Quick Start packages exist to accelerate deployment.
What does Duo cost, and what is excluded from the list price?
Duo Free covers up to 10 users at $0. Paid editions are $3 per user per month for Essentials, $6 for Advantage and $9 for Premier. Licences under 100 users are purchased in increments of 10, and above 100 users in increments of 25. Excluded from list price: metered telephony credits for SMS and phone-call authentication, and optional support or onboarding packages such as Duo Care Signature, Enhanced Support and Solution Attached Services, which are quoted on request rather than published.
Does Duo replace our existing identity provider?
Either model works. Duo can act as the primary identity source of truth through Duo Directory, with its own SSO identity provider for SAML and OIDC applications, passwordless authentication and user lifecycle management. Alternatively, Duo can broker secure access from identity sources you already run, with documented directory sync from Active Directory, Entra ID, Google, Okta and OpenLDAP. Many organisations start by adding Duo MFA in front of an existing IdP and then expand to full IAM.
Which compliance certifications and assurances does Duo publish?
Duo's security page states that its data centres are ISO 27001 and SOC 2 compliant, that it follows standards such as PCI DSS and NIST 800, and that uptime above 99.99% is backed by a service level guarantee. Duo operates data centres in nine countries including the US, Canada, Ireland, Germany, the UK, Australia, India, Singapore and Japan. Duo's public pages do not claim HIPAA, FedRAMP, ISO 42001 or an IAPP AIGP-certified individual, so buyers in those regimes should confirm terms during procurement.
What support and response times are included?
Subscription administrators can file a case from the admin Support Panel, email support, or call a regional support number. Standard support covers 9am-5pm Monday to Friday for all issues, with 24/7 coverage for critical and high severity issues. Duo Care Signature extends 24x7x365 coverage, with holiday exceptions for lower severities. Published response targets are one business hour for critical, two business hours for high, four business hours for medium and one business day for low.
How does Duo handle AI agents and MCP?
Duo documents Agentic Identity & Access Management, currently in alpha, which gives visibility into AI agents in your environment, maps them to humans and applies tightly scoped access policy. Duo's documentation also lists SSO for Model Context Protocol, providing OAuth 2.1-based MCP authorization for AI agents and agentic workflows. Administrators get the Cisco AI Assistant for Duo to investigate access issues and find configuration guidance. Duo's sources do not state whether customers supply their own model keys or whether AI actions are logged or exportable.