Vendor pricing

Cisco Secure Access and Duo pricing 2026: the tiers, the ZTNA line, and the SSE jump

Name: Cisco Duo
Brand: Cisco
Availability: InStock

Cisco covers two zero trust layers under different pricing models: Duo, where the per-user editions are published, and Cisco Secure Access (the SSE platform that replaces Umbrella), where pricing is quote-only. This page lists the verified Duo tiers, marks where ZTNA actually arrives, and gives honest reference points for the Secure Access band. Figures dated June 2026 with sources at the foot of the page.

Duo editions

Cisco Duo per-user pricing

Published list pricing, billed annually. The key zero trust detail: VPN-less ZTNA (Duo Network Gateway) only unlocks at the Premier tier.

Edition	Per user / month	Per user / year	What it covers
Free	$0	$0	Up to 10 users. Basic MFA. For evaluation or micro-teams.
Essentials	$3	$36	Phishing-resistant MFA, SSO, Duo Directory, Trusted Endpoints, unlimited app integrations.
Advantage	$6	$72	Adds Cisco Identity Intelligence (ITDR/ISPM), Duo Passport, risk-based auth, Active Directory Defense.
Premier	$9	$108	Adds VPN-less ZTNA via Duo Network Gateway and complete device trust. The full zero trust access tier.

Source: Cisco Duo official Editions and Pricing page, verified June 2026. List prices billed annually.

The SSE platform

Cisco Secure Access reference band

Cisco Secure Access is the cloud-delivered SSE platform that replaces standalone Umbrella. Pricing is quote-only; the nearest public anchors are the Umbrella SIG bundles it is built on.

Package	Indicative per user / year	Includes
Umbrella SIG Essentials (anchor)	~$72	DNS security, secure web gateway, inline CASB, cloud-delivered firewall.
Umbrella SIG Advantage (anchor)	~$120	Adds DLP and remote browser isolation.
Cisco Secure Access (full SSE)	quote-only (~$7-$20+ / user / mo band)	ZTNA, SWG, CASB, FWaaS, DLP in one subscription. Custom partner quote.

Umbrella SIG figures from third-party licensing guides (June 2026). The Secure Access band is a reference point benchmarked against rival SSE platforms, not a Cisco list price. Cisco publishes no per-user Secure Access rate.

The traps

Where the Cisco zero trust bill spirals

The published Duo tiers are honest, but the access use case and the SSE jump are where buyers under-budget.

Tier creep to Premier. ZTNA (Duo Network Gateway) only arrives at the $9 Premier tier. A budget built on Essentials ($3) or Advantage ($6) understates the cost of the VPN-replacement use case by two to three times.

The SSE step-change. Moving from Duo to a full Cisco Secure Access subscription is a different order of spend, and that pricing is quote-only. Buyers who scope only Duo and later need full SSE face an unplanned uplift.

The Umbrella transition. Legacy Umbrella SKUs reached end-of-sale in 2025. Renewals migrate onto Secure Access packaging, which reprices the deal rather than rolling the old rate forward.

Enterprise Agreement true-forward. Cisco EA terms can reprice unused commit and seat growth at renewal. The headline discount on signing is not the renewal rate.

Alternatives

Compare before you commit

Cisco spans identity and SSE. Depending on which pillar you are buying, a dedicated identity platform or a focused ZTNA tool can cost less.

Okta pricing

Best-of-breed identity vs Duo

Microsoft Entra pricing

Identity-led, M365-bundled path

Zscaler pricing

Premium SSE vs Secure Access

Netskope pricing

Another premium SSE platform

ZTNA cost (all platforms)

If you only need private-app access

Full vendor comparison

Side-by-side across the market

Frequently asked

Cisco zero trust pricing questions

How much does Cisco Duo cost per user?

Cisco publishes Duo list pricing per user per month, billed annually: Essentials is $3.00 (phishing-resistant MFA, SSO, Duo Directory, Trusted Endpoints), Advantage is $6.00 (adds Cisco Identity Intelligence, Duo Passport, risk-based authentication and Active Directory Defense), and Premier is $9.00 (adds VPN-less remote access via Duo Network Gateway and complete device trust, the tier that delivers full zero trust access). A free tier covers up to 10 users. For zero trust private-app access the relevant tier is Premier at $9 per user per month, which is the closest Cisco gets to a published ZTNA list price.

How much does Cisco Secure Access (SSE) cost?

Cisco Secure Access, the SSE platform that succeeds standalone Umbrella, is quote-only: Cisco publishes no per-user list price and every deal is a custom partner quote. The nearest public anchors are the Umbrella SIG bundles it builds on, roughly $72 per user per year (SIG Essentials: DNS security, secure web gateway, CASB and cloud-delivered firewall) and about $120 per user per year (SIG Advantage: adds DLP and remote browser isolation). A full Secure Access subscription with ZTNA, SWG, CASB, FWaaS and DLP typically lands in the same band as rival SSE platforms, broadly $7 to $20+ per user per month depending on modules, term and seat count. Treat these as reference points, not a Cisco rate card.

What is the difference between Cisco Duo and Cisco Secure Access?

Duo is Cisco's identity and access layer (MFA, SSO, device trust and, at the Premier tier, VPN-less ZTNA via Duo Network Gateway). Cisco Secure Access is the broader cloud-delivered SSE platform (ZTNA, secure web gateway, CASB, cloud firewall and DLP) that replaces the legacy Umbrella line. For the network pillar of zero trust, smaller estates often get sufficient ZTNA from Duo Premier alone, while larger or inspection-heavy estates buy Secure Access for full SSE coverage. The two are frequently licensed together through the Cisco User Protection Suite, which bundles Duo, Secure Access and email security at a packaged discount.

Where does the Cisco zero trust bill spiral?

Four places. First, tier creep on Duo: ZTNA only arrives at the Premier ($9) tier, so a quote built on Essentials or Advantage understates the cost of the access use case. Second, the SSE jump: moving from Duo to a full Cisco Secure Access subscription is a step-change in spend, and that pricing is quote-only. Third, the Umbrella end-of-sale transition, legacy Umbrella SKUs reached end-of-sale in 2025, pushing buyers onto Secure Access packaging that reprices the deal. Fourth, professional services and Cisco Enterprise Agreement true-forward terms, where unused commit and growth get repriced at renewal.

Is Cisco cheaper than Zscaler or Okta for zero trust?

It depends which pillar. For identity and basic ZTNA, Duo Premier at a published $9 per user per month is competitive with Okta's mid suites and undercuts buying a separate identity platform plus a ZTNA tool. For full SSE, Cisco Secure Access sits in the same premium band as Zscaler, Netskope and Palo Alto Prisma Access, so headline rate rarely decides it. Cisco's strongest commercial position is with estates already running Cisco networking or holding a Cisco Enterprise Agreement, where Secure Access and Duo can be bundled into an existing commitment at favourable terms. Greenfield buyers should benchmark all three SSE platforms.

Cisco, Duo, Umbrella and Cisco Secure Access are trademarks of Cisco Systems, Inc. ZeroTrustCost.com is an independent pricing reference and is not affiliated with, authorised by, sponsored by, or endorsed by any vendor named on this page. Product and company names are used for identification, commentary and price comparison only (nominative fair use).

Sources

Cisco Duo, official Editions and Pricing page (Essentials $3, Advantage $6, Premier $9 per user/month; Premier includes VPN-less remote access via Duo Network Gateway). https://duo.com/editions-and-pricing
Redress Compliance, Cisco Security Licensing Guide 2026 (Duo Essentials/Advantage/Premier annual pricing; Umbrella SIG Essentials ~$72/yr, SIG Advantage ~$120/yr). https://www.redresscompliance.com/cisco-security-licensing-umbrella-duo-xdr-guide.html
UnderDefense, Cisco Pricing 2026 Guide for Security Products (Duo tiers, Umbrella per-user ranges). https://underdefense.com/industry-pricings/cisco-pricing-ultimate-guide-for-security-products/
Cisco, Secure Access subscription ordering guide (Secure Access succeeds Umbrella; packaging is partner-quoted). https://www.cisco.com/c/en/us/products/collateral/security/secure-access/secure-access-sub-og.html

Pricing accessed and verified June 2026. Duo editions are Cisco published list prices; Cisco Secure Access SSE pricing is quote-only and the band shown is a third-party-sourced reference point that changes with negotiation, modules, region and term.