Cisco Duo
Widely deployed MFA and access-security product, acquired by Cisco in 2018, known for simple push-based multi-factor authentication.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
Duo Security was founded in Ann Arbor, Michigan in 2010 and built its early reputation on making multi-factor authentication simple enough for broad employee adoption — push notifications to a phone rather than hardware tokens or complex enrollment. Cisco acquired the company in October 2018 for $2.35 billion, folding it into Cisco’s security portfolio as its identity and access piece alongside network and endpoint security.
Duo remains one of the most widely deployed MFA products, particularly in higher education and mid-market enterprise, and has expanded from pure authentication into device trust and adaptive access policy as part of Cisco’s broader Secure Access/zero-trust bundle.
As a Cisco business unit rather than an independent company, its roadmap and investment are now tied to Cisco’s networking and security strategy rather than operating as a standalone identity innovator, and detailed standalone financials are no longer separately disclosed.
Innovation Matrix Assessment
Continues to ship device-trust and adaptive-access features as part of Cisco's broader Secure Access bundle, but pace is set by Cisco's integration priorities.
Simple, high-adoption MFA UX genuinely reduces help-desk friction and improves MFA enrollment rates versus harder-to-use alternatives.
Extremely broad install base, particularly in education and mid-market, and continued bundling into Cisco's security portfolio.
MFA-as-a-utility is now a mature, well-understood category; Duo's original UX innovation has been widely copied across the market. However, Duo Security was acquired by Cisco for $2.35B in 2018 (per cnbc.com), which is the scale of an established incumbent rather than an emerging category disruptor, so this dimension is scored more conservatively.
Long, broad production deployment history, though as with any MFA push-notification product it has had to add number-matching and other controls to counter MFA-fatigue attacks industry-wide.
MFA remains foundational, though push notifications are increasingly viewed as a weaker control relative to phishing-resistant passkey/FIDO2 approaches.
Why CISOs Should Care
Duo remains one of the easiest MFA products to roll out broadly with minimal user training, which matters for organizations (like universities) with large, diverse, low-IT-literacy user populations.
What Makes It Different
Its historical differentiator — frictionless push-based MFA — is now table stakes across the industry; its current value is Cisco-ecosystem bundling rather than technical novelty.
The Matrix Verdict
58/100 — INCUMBENT
A mature, widely trusted MFA product now operating as a Cisco business line; strong on operational simplicity and reach, but limited independent momentum or disruption as a standalone entity. An Incremental Innovator.
Editorial Note: Claims vs. Verified Findings
Acquisition price and date are independently confirmed via Cisco's own investor announcements; current standalone employee/customer figures are not separately disclosed by Cisco.
Sources
Alternatives to Cisco Duo
Teleport
An identity-based infrastructure access platform issuing short-lived cryptographic identities for humans, machines, and AI agents in place of…
SpecterOps
Identity attack-path security specialist behind BloodHound, the widely used open-source tool for mapping Active Directory and Entra ID…
Keyfactor
Machine identity and PKI management platform helping enterprises secure certificates, keys, and post-quantum cryptography readiness at scale.
Astrix Security
Non-human identity security platform that discovers and governs API keys, OAuth tokens, service accounts, and AI-agent credentials across…
Socure
AI-driven identity verification and fraud platform used by banks, fintechs, and government agencies to validate identities during digital…
Astrix Security
Non-human and AI agent identity security platform that discovers and remediates over-privileged API keys, service accounts and secrets.