In short: Cisco Identity Intelligence is Cisco's identity threat detection and response (ITDR) and identity security posture management (ISPM) service. It combines data from Duo, Microsoft Entra ID, Okta and other identity sources, flags weak accounts and attacks such as MFA fatigue and session hijacking, and can respond through Duo. It is included in Duo Advantage and Premier.
What is Cisco Identity Intelligence?
Cisco Identity Intelligence (sometimes shortened to CII) was launched at Cisco Live Amsterdam in February 2024. It addresses a simple problem: most organisations hold identities in several places, such as Active Directory, Microsoft Entra ID, Google Workspace, Okta, an HR system and cloud platforms, and no single system sees the whole person. Attackers use the gaps, for example a forgotten account with no MFA or an administrator role that nobody reviewed.
Identity Intelligence is vendor-agnostic. It ingests identity and authentication data from Duo and from those other sources, builds a combined view of each person and their accounts, and uses it for two jobs:
- Identity security posture management (ISPM): finding weaknesses before they are exploited
- Identity threat detection and response (ITDR): spotting attacks on identities while they are happening, including after a successful login
It is delivered as part of Cisco Duo: Duo Advantage and Duo Premier include it, while Duo Essentials and Duo Free do not. For the Duo-specific set-up, data sources and the replacement of Duo Trust Monitor, see the Identity Intelligence guide on our Duo site.
What it finds and detects
| Area | Examples |
|---|---|
| Posture (ISPM) | Dormant but still licensed accounts; accounts without MFA or relying on weak methods; risky or over-privileged administrators; people who have left in the HR system but remain active elsewhere |
| Threats (ITDR) | MFA fatigue (push bombing); session hijacking and token theft after login; misuse of unused or dormant accounts |
| AI agents and non-human identities | Duo's editions page now lists agentic visibility and governance features for AI agents; this area is moving quickly and availability varies by plan, so check before relying on it |
Rather than a stream of raw events, each Duo user gets an Identity Intelligence trust level (from Trusted to Untrusted) that administrators can sort and filter on, so they can deal with the riskiest accounts first.
At the time of writing, Duo documents data ingestion integrations for Duo itself, Microsoft Entra ID, Microsoft Active Directory, Okta, Google Workspace, Auth0, AWS, GitHub, Salesforce and Workday. The more of your identity estate you connect, the more complete each person's combined view becomes.
How it responds
When an administrator grants Identity Intelligence write access to Duo, it can do more than alert: for example disabling a compromised user or removing a suspicious device from their account. Notifications and tickets can go to Microsoft Teams, Slack, ServiceNow, Jira or Microsoft Sentinel, so they land where your team already works. Pair it with Duo risk-based authentication, also in Duo Advantage, which raises login checks when a sign-in looks risky.
Within the wider Cisco Secure portfolio, Identity Intelligence is the identity layer of a joined-up response:
- Cisco ISE governs network access for users and devices, including those that never see an MFA prompt, and can contain an endpoint on the network
- Cisco Secure Access applies zero trust access to applications and the internet, using Duo identity
- Cisco XDR and Splunk Enterprise Security correlate identity alerts with endpoint, email and network detections
Used together, a risky identity finding can lead to stronger authentication, restricted application access and, if needed, network containment, rather than an alert that waits in a queue.
Why identity threat detection matters now
MFA has raised the bar, so attackers have moved to the gaps around it: tricking users into approving prompts, stealing session tokens with adversary-in-the-middle phishing kits, and abusing dormant or service accounts that MFA never covered. The NCSC's guidance for UK organisations stresses strong authentication and the management of privileged and unused accounts, and these are exactly the areas ISPM reports on.
ITDR is also useful evidence. Auditors, cyber insurers and boards increasingly ask how you would know if an account were taken over; a monitored identity estate with a documented response is a better answer than MFA alone. For staff-side defences, pair it with phishing awareness training.
Who it suits
- Organisations with more than one identity system, such as on-premises Active Directory plus Entra ID, or Entra ID plus Okta or Google Workspace
- Teams without a 24/7 security operations centre, who need findings prioritised for them
- Duo Essentials customers whose main gap is visibility of risky accounts, where moving to Duo Advantage adds Identity Intelligence
- Organisations building towards the Cisco User Protection Suite, which includes Duo Advantage
How we help
- Review your identity estate: which directories, identity providers and cloud platforms hold accounts, and how Duo is deployed today.
- Confirm licensing: whether you already have Duo Advantage or Premier, or what an upgrade involves. Ask us for a quote.
- Connect the data sources and agree who receives which alerts and digests.
- Work through the first findings: dormant accounts, MFA gaps and stale administrator rights are usually quick wins.
- Tune the response: decide which actions run automatically through Duo and which need a person, and link alerts into XDR, Splunk or your ticketing system.
Contact us to arrange an identity review.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Cisco Identity Intelligence?
It is Cisco's identity threat detection and response and identity posture service. It combines identity data from Duo and other sources such as Microsoft Entra ID and Okta, finds weak accounts and detects attacks on identities, including risky behaviour after login.
Is Cisco Identity Intelligence included in Duo?
Yes, in Duo Advantage and Duo Premier. It is not part of Duo Essentials or Duo Free. See Duo Advantage for the edition detail.
What is the difference between ITDR and ISPM?
Identity security posture management (ISPM) finds weaknesses before they are used, such as dormant accounts or missing MFA. Identity threat detection and response (ITDR) spots attacks in progress, such as MFA fatigue or session hijacking, and helps you respond.
Does Cisco Identity Intelligence work without Duo MFA everywhere?
Yes. It can analyse identities from sources Duo does not protect directly, such as Entra ID, Okta or Google Workspace, so it gives visibility across the whole estate. Response actions are strongest where Duo is in use.
When was Cisco Identity Intelligence launched?
Cisco announced it at Cisco Live Amsterdam in February 2024. It has since replaced Duo Trust Monitor as Duo's user threat detection feature.