Cisco's security portfolio has consolidated dramatically around Umbrella (DNS, SWG, CASB, SIG bundles), Duo (MFA, SSO, Trust Monitor), Secure Firewall (NGFW with subscription threat services) and the umbrella Cisco XDR construct. Each carries a tier ladder where the upsell ratios are aggressive and the buyer-side rationalisation discipline is uneven. This article walks through how Cisco Security licensing actually works, where the upsell pressure lands, and the renewal moves that hold Cisco Security spend to 25-35% below the standard proposal — particularly in the wake of credible competition from Zscaler, Cloudflare, Palo Alto and Okta.
Cisco Umbrella sells in four principal tiers: DNS Essentials, DNS Advantage, SIG Essentials and SIG Advantage. The price ladder roughly doubles at each step and the feature deltas are uneven. SIG Essentials adds secure web gateway and basic CASB. SIG Advantage adds full Cloud DLP, Cloud Malware detection, broader CASB control and remote browser isolation. The buyer-side question is whether the Advantage tier features are actually being deployed at the user count licensed, and the answer in our practice is usually "no, not at full count." Right-tiering the Umbrella estate typically recovers 20-30% of the security line.
In our experience across 340+ engagements, the most common Umbrella over-buy is SIG Advantage applied uniformly across the entire workforce when the actual high-value SIG Advantage features (RBI, Cloud Malware Defence) are needed only on a defined subset of contractors, third parties or high-risk roles. Mixed-tier Umbrella deployment — SIG Advantage for the subset, SIG Essentials or DNS Advantage for the broader population — is technically supported and rarely proposed by Cisco.
Tier rationalisation is the single largest source of recoverable spend on most Umbrella estates.
Duo Security sells in four tiers since the latest re-stack: Free, Essentials, Advantage and Premier. Essentials covers MFA and basic device trust. Advantage adds SSO, broader policy controls and Risk-Based Authentication. Premier adds VPN-less ZTNA via the Duo Network Gateway and Trust Monitor anomaly detection. The Premier upsell carries the most aggressive Cisco pressure and is the easiest line to over-buy: most buyers do not need ZTNA at full workforce count, and Trust Monitor value is highly dependent on operational maturity around alert handling.
The negotiation move is to model Duo licensing in two segments: privileged users (admins, finance, executives, third-party access) at Premier; general workforce at Advantage or Essentials. The Cisco proposal will almost always default to flat Advantage or flat Premier — the savings from segmentation typically run 25-40%.
Duo's strongest competitor is Okta MFA and Workforce Identity Cloud. Cisco knows this and renewals where the buyer brings credible Okta benchmarking (per-user pricing, migration timeline, integration scope) consistently produce 25-35% deeper discounting than renewals run on price-only logic. The competitive alternative does not need to be the chosen plan — it needs to be specific enough to register as a real exit risk.
Umbrella tier decoder, Duo segmentation framework and Secure Firewall subscription audit.
Cisco Secure Firewall (formerly Firepower) sells the hardware once and the subscription threat services every year — Threat, Malware, URL Filtering, AnyConnect Plus or Apex, Identity Services Engine integrations. The subscription stack on a typical NGFW deployment can match or exceed the hardware cost over a five-year horizon. Buyers who do not audit the active feature deployment per firewall — many subscriptions are licensed and not actively consumed — over-pay consistently. The renewal exercise should map subscriptions to features actually enforced in policy.
AnyConnect Plus versus Apex is the single most common over-buy: Apex bundles posture and endpoint capabilities that most buyers have replaced with separate EPP/EDR tooling. Downgrading from Apex to Plus across the appropriate firewall count typically recovers 15-25% on the AnyConnect line alone. The same per-feature consumption evidence that drives this downgrade is what underpins a strong Cisco audit defense when Smart Licensing telemetry is used against you.
Cisco XDR consolidates SecureX, threat intelligence, response orchestration and a forthcoming AI-assist layer into a per-endpoint subscription that is increasingly the construct Cisco wants on every security renewal. The XDR bundle pulls in Talos intelligence, response playbooks and integrations across the broader portfolio. The licensing question is what's bundled versus add-on, and what the per-endpoint price translates to net of existing entitlement. Most XDR proposals we audit double-bill capability the buyer already holds under Umbrella or Secure Endpoint contracts.
We run usage-based tier rationalisation and competitive benchmarking across Umbrella, Duo and Secure Firewall.
Yes. Cisco supports mixed-tier deployment within a single Umbrella organisation. The buyer-side discipline is to segment by user role and risk and license each segment to the actual feature need. Cisco rarely proposes mixed-tier — it has to be requested explicitly.
It can be. Cisco offers Duo within the Enterprise Agreement construct with EA-style multi-year economics and true-up mechanics. Whether the EA is the right vehicle depends on the broader Cisco spend profile.
Per-endpoint per-month, with tier ladders (Essentials, Advantage, Premier) and bundling credits where SecureX, Umbrella or Secure Endpoint are already licensed. The credit ratios are negotiable — published rates are a starting position.
For prepared buyers with usage data, tier rationalisation and credible competitive alternatives: 25-35% off list across the security portfolio. Without rationalisation and competitive pressure, 8-12% is the typical renewal outcome.
Independent Cisco Security benchmarking — Umbrella tier rationalisation, Duo segmentation, Secure Firewall subscription audit and competitive pressure that holds Cisco to 25-35% off list.
One email a week, no filler — the vendor moves that quietly add 9–18% to a renewal, and how clients take it back out.
