In short: Cisco Multicloud Defense is cloud network security delivered from a Cisco-run SaaS controller. It deploys auto-scaling gateways into AWS, Microsoft Azure, Google Cloud and Oracle Cloud, protects ingress, egress and east-west traffic, discovers cloud assets, and works with Terraform and Security Cloud Control.
What is Cisco Multicloud Defense?
Each public cloud has its own native security groups, firewalls and routing constructs, and they do not share policy. Once you run workloads in more than one cloud, or across many accounts and subscriptions, keeping rules consistent becomes hard and gaps appear.
Multicloud Defense solves this with a split architecture:
- A SaaS controller run and maintained by Cisco, where you define policy, view discovered assets and manage gateways
- Gateways deployed into your own cloud accounts (for example an AWS account, Azure subscription or Google Cloud project), which inspect and enforce traffic. The controller deploys, scales, upgrades and heals them, and automates the underlying cloud network plumbing
Cisco lists Multicloud Defense as its firewall for public cloud, and it is one of the enforcement points in Cisco Hybrid Mesh Firewall. Cisco states that it has achieved US FedRAMP authorisation, which some UK organisations working with US government bodies ask about.
Ingress, egress and east-west protection
Gateways sit in a service VPC or VNet (a central security network) that your application networks route through, using each cloud's own load balancing and transit services. Cisco documents the supported gateway use cases for each cloud.
| Traffic | What the gateway does | Typical threats stopped |
|---|---|---|
| Ingress (internet to apps) | Acts as a reverse proxy in front of applications, with web application firewall and IPS | Exploits against web apps and APIs, malicious inbound traffic |
| Egress (apps to internet) | Forwarding or forward-proxy mode with FQDN and URL filtering | Command-and-control callbacks, data exfiltration, downloads of malware |
| East-west (between VPCs and VNets) | Inspects traffic between application networks in forwarding or forward-proxy mode | Lateral movement after a workload is compromised |
Security profiles in Cisco's user guide include decryption, network IDS/IPS, data loss prevention, anti-malware, web application firewall, URL filtering, FQDN filtering and malicious IP blocking, plus packet capture and log forwarding. Gateways can also build site-to-site VPN tunnels, and Multicloud Defense can deploy and orchestrate Secure Firewall Threat Defense Virtual as a gateway where you want the full Threat Defense feature set (this needs a Security Cloud Control firewall management subscription).
Discovery, automation and integrations
- Asset and inventory discovery across AWS, Azure, Google Cloud and Oracle Cloud, with security insights and discovery reports that show where gaps are
- Infrastructure as code: a Cisco-maintained Terraform provider and onboarding scripts, so gateways and policy are deployed through the same pipelines as your applications
- Security Cloud Control: since April 2026 a guided Cloud Deployment feature sets up Threat Defense Virtual and Multicloud Defense across AWS, Azure and Google Cloud from the console, with Oracle Cloud supported for Multicloud Defense gateways
- Cisco AI Defense integration to secure AI applications running in your cloud accounts
- Alerting and log forwarding to destinations including Splunk, Microsoft Sentinel, Datadog, PagerDuty, ServiceNow, Slack, Microsoft Teams and Webex
Multicloud Defense or Threat Defense Virtual?
Both put Cisco firewalling into the cloud. The difference is who runs the plumbing.
| Cisco Multicloud Defense | Secure Firewall Threat Defense Virtual | |
|---|---|---|
| Control plane | Cisco-run SaaS controller | Management Center (on-premises, virtual or cloud-delivered) or Device Manager |
| Deployment and scaling | Automated by the controller, including cloud networking and healing | You build it, using Cisco templates and the cloud's own auto-scaling |
| Policy model | Cloud-native, tag and asset aware, consistent across clouds | Same policy as your on-premises Secure Firewall estate |
| Best fit | Cloud-native estates with many accounts, VPCs and VNets | Lifting existing firewall designs and VPN termination into the cloud |
They are not either-or: Multicloud Defense can orchestrate Threat Defense Virtual gateways, which gives you full Threat Defense inspection with cloud-native automation. See our Threat Defense Virtual and cloud firewalls page for the virtual appliance route.
Licensing
Cisco's ordering guide licenses Multicloud Defense on aggregated gateway hours consumed across all your clouds, in Advantage and Premier tiers. Usage is consumption-based but it is a committed subscription, not pay-as-you-go, with standard terms from one to five years. Premier adds capabilities including the option to license Threat Defense Virtual gateways orchestrated by Multicloud Defense from your Premier gateway hours. Cisco does not enforce the licence by cutting traffic if you use more hours than you bought, but repeated unanswered over-use notices can leave the console read-only, so we monitor consumption with you.
Multicloud Defense is also included in the Gateway package of the Cisco Cloud Protection Suite, can be covered by a Cisco enterprise agreement, and Cisco describes buying routes through the AWS and Azure marketplaces for organisations that want to use committed cloud spend. We size gateway hours from your traffic and architecture; ask us for a quote.
Who it suits and how we help
Multicloud Defense suits organisations with workloads in more than one public cloud, many accounts or subscriptions, or DevOps teams who want security deployed as code. If you only need a firewall for a single small cloud network, native controls or one virtual firewall may be enough, and we will say so.
We review your cloud networking, choose between Multicloud Defense and Threat Defense Virtual (or both), design the security VPCs and VNets, onboard accounts with Terraform, and tune policy from discovery data. Contact us to plan your cloud security.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Cisco Multicloud Defense?
Cisco Multicloud Defense is a cloud network security service. A Cisco-run SaaS controller deploys and manages security gateways in your AWS, Azure, Google Cloud and Oracle Cloud accounts, protecting ingress, egress and east-west traffic with consistent policy.
Which clouds does Multicloud Defense support?
Cisco's documentation covers Amazon Web Services, Microsoft Azure, Google Cloud and Oracle Cloud Infrastructure, with asset discovery across all four.
Is Multicloud Defense the same as Secure Firewall Threat Defense Virtual?
No. Threat Defense Virtual is the Secure Firewall software as a virtual machine you deploy and manage yourself. Multicloud Defense is a SaaS-managed service that automates gateways and cloud networking, and it can deploy Threat Defense Virtual as one of its gateway types.
How is Multicloud Defense licensed?
On aggregated gateway hours across all clouds, in Advantage and Premier tiers, as a committed one to five-year subscription rather than pay-as-you-go. It is also included in the Gateway package of the Cisco Cloud Protection Suite. Ask us for a quote.
Can Multicloud Defense be deployed with Terraform?
Yes. Cisco maintains a Multicloud Defense Terraform provider and publishes Terraform onboarding scripts for cloud accounts, so gateways and policies can be managed as infrastructure as code.