In short
Cisco Secure is the family of security products Cisco sells, which its own pages now usually call Cisco Security. It spans cloud and network protection (Secure Firewall, Hybrid Mesh Firewall, Hypershield, AI Defense), workforce protection (Secure Access, Duo, ISE, Secure Client), and threat intelligence and response (Splunk Enterprise Security, Talos, XDR), sold separately or in suites.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What is Cisco Secure?
Cisco Secure is the name Cisco gave its security portfolio when it brought products such as Firepower, AMP, Stealthwatch, Umbrella and Duo under one brand. On cisco.com today you will mostly see Cisco Security, while the individual products keep "Cisco Secure" in their names (Cisco Secure Firewall, Cisco Secure Access, Cisco Secure Endpoint and so on). Both terms describe the same thing. If you want to know how Forever Group supplies and supports Cisco security alongside its networking and voice services, the main Forever Group site covers that.
The Cisco Secure portfolio covers five broad jobs:
- Protecting networks, data centres, clouds and AI applications: firewalls, segmentation and cloud network security
- Protecting the workforce: secure internet and private app access, multi-factor authentication and network access control
- Protecting endpoints and email: EDR, email gateways, Microsoft 365 protection and malware sandboxing
- Detecting and responding to threats: XDR, network detection, SIEM and SOAR from Splunk, and incident response
- Securing operational technology (OT): visibility and remote access for industrial networks
Underneath all of it sits Cisco Talos, Cisco's threat intelligence and research group, whose detections and reputation data are built into most of the products below. Many products were renamed during the move to the Cisco Secure brand; our Cisco security end-of-life and migration guide lists the old and new names side by side.
Cloud protection: firewalls, segmentation and AI security
On cisco.com, Cisco groups Cisco Firewall, Hypershield and AI Defense under cloud protection. The idea is one security policy, enforced at whichever point suits the traffic: the internet edge, the data centre switch, the workload or the public cloud.
| Product | What it does |
|---|---|
| Cisco Secure Firewall (formerly Firepower) | Next-generation firewall and Snort 3 IPS for branch, campus, data centre, industrial, virtual and public cloud deployments. Cisco's pages also call it Cisco Firewall. |
| Secure Firewall Threat Defense and Secure Firewall ASA | The two software images that run on Secure Firewall hardware, with a migration path from ASA |
| Cisco Hybrid Mesh Firewall | Cisco's approach to running many enforcement points as one distributed firewall under single management |
| Cisco Hypershield | Stateful segmentation enforced inside the data centre fabric on Cisco Smart Switches, plus compensating controls while patches are pending |
| Cisco Multicloud Defense | Cloud network security for AWS, Microsoft Azure, Google Cloud and Oracle Cloud from a SaaS control plane |
| Cisco Secure Workload (formerly Tetration) | Microsegmentation and application dependency mapping for workloads |
| Cisco AI Defense | Visibility, validation and runtime guardrails for enterprise AI applications and agents |
| Cisco Security Cloud Control (formerly CDO) | Cloud management for Threat Defense, ASA, Multicloud Defense, Hypershield and the shared Hybrid Mesh Firewall policy |
Firewall management is covered on the Secure Firewall Management Center page, and the Cloud Protection Suite is the licence vehicle Cisco uses for Hybrid Mesh Firewall. If you are weighing up a cloud-managed branch firewall instead, see Cisco Secure Firewall vs Meraki MX.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
Workforce protection: secure access for people and devices
Workforce protection is Cisco's heading for letting staff, contractors and devices reach what they need, from anywhere, without trusting the network they happen to be on.
- Cisco Secure Access: Cisco's security service edge (SSE), combining secure internet access (secure web gateway, DNS security, CASB, DLP, firewall as a service) with zero trust network access to private apps
- Cisco SASE: Secure Access combined with Cisco SD-WAN, including Meraki SD-WAN
- Cisco Secure Duo: multi-factor authentication, passwordless login, single sign-on and device trust, covered in depth on our Cisco Duo site
- Cisco Identity Services Engine (ISE): network access control, 802.1X, posture, guest access and segmentation for wired, wireless and VPN users
- Cisco ITDR: identity threat detection and response with Cisco Identity Intelligence, across Duo, Microsoft Entra ID, Okta and other identity sources
- Cisco Secure Client (formerly AnyConnect): the endpoint agent for VPN, zero trust access, roaming security and posture
- Cisco Secure Web Appliance (formerly WSA): an on-premises web proxy for organisations that need one
Cisco Umbrella still protects many UK organisations at the DNS layer, but Cisco has set an end-of-sale date for Umbrella DNS and SIG, with Secure Access as the successor: see Cisco Secure Umbrella and the move to Secure Access.
Endpoint, email and malware analysis
- Cisco Secure Endpoint (formerly AMP for Endpoints): next-generation antivirus, EDR, device trajectory and isolation, in Essentials, Advantage and Premier editions
- Cisco Secure Email: the Secure Email Gateway (formerly IronPort ESA), API-based Secure Email Threat Defense for Microsoft 365, and the Secure Email Encryption Service
- Cisco Secure Malware Analytics (formerly Threat Grid): sandboxing that is also built into endpoint, email, firewall and Secure Access products
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Threat intelligence, detection and response
Detection and response is where the portfolio comes together. Telemetry from firewalls, endpoints, email, identity and the network is correlated so analysts see one incident instead of a dozen alerts.
- Cisco XDR: correlated incidents across the Cisco portfolio and selected third-party tools, with built-in network detection and automated response, in three editions
- Cisco Secure Network Analytics (formerly Stealthwatch): network detection and response from flow telemetry
- Cisco Secure Cloud Analytics: the former Stealthwatch Cloud, whose detections now live inside Cisco XDR and are no longer sold separately
- Splunk Enterprise Security: Splunk's SIEM, now part of Cisco and at the core of what Cisco calls its agentic SOC, with Cisco Talos enrichment from version 8.4
- Splunk SOAR and Splunk Attack Analyzer: automation playbooks and automated malware and phishing analysis
- Cisco Talos for intelligence and Cisco Talos Incident Response for retainers and emergency help
Splunk products keep the Splunk brand ("Splunk, a Cisco company") rather than the Cisco Secure name, but Cisco sells and integrates them as part of its security portfolio.
OT and industrial security
Factories, utilities, transport and building systems need security that understands industrial protocols and does not disrupt operations. Cisco Cyber Vision gives OT asset visibility and threat detection using sensors built into Cisco industrial switches and routers, and Cisco Secure Equipment Access, now delivered as part of Cyber Vision, replaces ad hoc remote access to machines with zero trust sessions. Both are relevant to organisations in scope of the UK NIS Regulations.
Suites, licensing and product lifecycle
You can buy most Cisco security products on their own, or as part of a suite that bundles several products under one subscription:
| Suite | Built around |
|---|---|
| User Protection Suite | Secure Access, Duo Advantage and Secure Email Threat Defense, with Secure Endpoint and ISE added in the Advantage tier |
| Breach Protection Suite | Cisco XDR, Secure Endpoint and Secure Email Threat Defense; higher tiers add Talos threat hunting, Secure Network Analytics, Cisco's managed XDR service and Talos Incident Response |
| Cloud Protection Suite | Two packages for Hybrid Mesh Firewall: Segmentation (Secure Workload, Hypershield, Isovalent) and Gateway (virtual Secure Firewall, Multicloud Defense) |
The Cisco security suites page compares them. For how Smart Accounts, term subscriptions and the Essentials, Advantage and Premier tiers work across products, read Cisco security licensing explained. Pricing depends on your user, device and endpoint counts and the term, so ask us for a quote. Running something Cisco has renamed or retired? Start with the end-of-life guide. If you need help beyond Cisco products, Forever Group also provides wider cyber security services.
Explore the Cisco security portfolio
Licensing explainedSmart Accounts, term subscriptions, tiers, metrics and suites across the portfolio.
Cisco TalosCisco's threat intelligence and research group, and how it feeds every product.
End of life and renamesRenamed and end-of-life Cisco security products, with dates and migration paths.
Cisco Secure DuoMFA, passwordless and device trust: where Duo fits in Cisco Secure.
Cisco Secure UmbrellaUmbrella DNS security and the move to Cisco Secure Access.
Secure FirewallNext-generation firewall and Snort 3 IPS, formerly Firepower.
Security Cloud ControlCloud security management, formerly Cisco Defense Orchestrator (CDO).
Hybrid Mesh FirewallOne policy across firewalls, switches, clouds, workloads and AI apps.
HypershieldStateful segmentation enforced inside Cisco Smart Switches.
Multicloud DefenseCloud network security for AWS, Azure, Google Cloud and Oracle Cloud.
Secure WorkloadMicrosegmentation and application mapping (formerly Tetration).
AI DefenseDiscovery, red teaming and guardrails for AI apps and agents.
Secure AccessCisco's security service edge: secure internet, SaaS and private app access.
Cisco SASESecure Access plus Cisco SD-WAN or Meraki SD-WAN.
Secure Web ApplianceOn-premises secure web proxy, formerly the Web Security Appliance (WSA).
Cisco ISENetwork access control: 802.1X, profiling, posture, guest and segmentation.
Cisco ITDRIdentity threat detection and response with Cisco Identity Intelligence.
Secure Client (AnyConnect)VPN, zero trust access and endpoint modules in one agent, formerly AnyConnect.
Secure EndpointEndpoint protection and EDR, formerly AMP for Endpoints.
Secure EmailEmail gateway, Microsoft 365 threat defence, encryption and DMARC.
Secure Malware AnalyticsMalware sandboxing and intelligence, formerly Threat Grid.Cisco XDRExtended detection and response across endpoint, network, email, cloud and identity.
Secure Network AnalyticsNetwork detection and response, formerly Stealthwatch.Secure Cloud AnalyticsFormerly Stealthwatch Cloud, now part of Cisco XDR.
Splunk Enterprise SecuritySplunk's SIEM, now part of Cisco: Essentials and Premier.
Splunk SOARSecurity orchestration, automation and response playbooks.
Splunk Attack AnalyzerAutomated malware and phishing analysis.
Talos Incident ResponseIR retainer, emergency response and readiness services.Security suitesUser, Breach and Cloud Protection: Cisco's bundled security licences.
Cyber Vision (OT)OT asset visibility, risk and threat detection built into the network.How Forever Systems supplies and supports Cisco Secure
We supply and support products across the Cisco security portfolio, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems is a Cisco Partner, so we can recommend and supply the right mix of Cisco security products for your estate.
Frequently asked questions
What is Cisco Secure?
Cisco Secure is the brand for Cisco's security portfolio. It covers firewalls and cloud protection, workforce protection (SSE, MFA and network access control), endpoint and email security, threat detection and response (XDR and Splunk), OT security and the Talos threat intelligence behind them.
What does the Cisco Secure portfolio include?
Cisco Secure Firewall, Hybrid Mesh Firewall, Hypershield, Multicloud Defense, Secure Workload and AI Defense for cloud and network protection; Secure Access, Duo, ISE and Secure Client for the workforce; Secure Endpoint, Secure Email and Secure Malware Analytics; Cisco XDR, Secure Network Analytics and Splunk for detection and response; Cyber Vision for OT; and the three Cisco security suites.
Is Cisco Secure the same as Cisco security?
Yes. Cisco's website now mostly uses "Cisco Security" for the portfolio, while product names such as Cisco Secure Firewall, Cisco Secure Access and Cisco Secure Endpoint keep the Cisco Secure prefix.
Do I have to buy everything from Cisco?
No. Each product works on its own, and most integrate with third-party tools; Cisco XDR, for example, takes in telemetry from several other endpoint and firewall vendors. Suites can work out better value when you need several products, but buying one product at a time is common.
Which Cisco security product should I start with?
It depends on your biggest gap. Organisations replacing a remote access VPN often start with Secure Access, those refreshing the network edge with Secure Firewall, and those short of security analysts with Cisco XDR or the Breach Protection Suite. Contact us and we will review your estate first.
Is this the official Cisco website?
No. Cisco Secure UK is run by Forever Systems, a Cisco Partner that supplies, deploys and supports Cisco security products.
Still have a question about Cisco Secure supply and support?
Ask us and a member of our team will reply by email.