Cisco Secure Access licensing: Essentials vs Advantage

In short: Cisco Secure Access licensing is built from two use cases, Secure Internet Access and Secure Private Access, each sold in Essentials or Advantage tiers, plus the separate DNS Defense tier. Licences are normally per user on 12, 36 or 60-month terms. Advantage adds Layer 7 firewalling with IPS, remote browser isolation for any site, multimode DLP and unlimited sandboxing.

How Secure Access is packaged

Cisco Secure Access is delivered in one subscription, policy set and dashboard, but it is ordered by use case:

You can buy SIA alone, SPA alone, or both, and Cisco's FAQ says you can buy separate user counts for each. Experience Insights is added automatically, at no extra charge, to SIA and SPA user subscriptions. Cisco also sells Secure Access for Government and a China package, which are outside the scope of most UK projects.

Essentials vs Advantage

This comparison follows Cisco's SSE package guide (updated July 2026) and its 2026 ordering guidance. Cisco revises packaging from time to time, so we confirm against the latest guide before quoting.

In short, Essentials covers the core of SSE and suits organisations replacing Umbrella SIG or a basic web proxy. Advantage suits organisations that need application-level firewalling, intrusion prevention, full isolation and DLP, for example those handling regulated personal data or wanting tight control over generative AI uploads.

Add-ons

• Data loss prevention for Essentials subscriptions
• Threat defence add-on bringing Layer 7 firewall and IPS to Essentials
• Remote browser isolation: isolation for risky sites, which Cisco's current package guide lists as an add-on, and an advanced option for wider isolation
• AI Access guardrails for supported third-party generative AI apps
• Secure Malware Analytics add-on with manual file submission, the glove box and analyst console access
• Additional Investigate console users for threat hunters who query Cisco's domain, IP and ASN intelligence
• Premium software support, as an upgrade from Enhanced support

Add-on rules and quantities are set out in Cisco's ordering guidance and change from time to time, so we build them into the quote rather than leaving them for you to work out.

Licence metrics, terms and support

• Per covered user is the normal metric: Cisco defines a covered user as an internet-connected employee, subcontractor or other authorised individual, and the quantity should cover all of them
• Per site licensing is available for SIA Essentials (Cisco says SIA Advantage is to follow), based on site bandwidth, which suits SD-WAN branches; it does not include some functions, such as Experience Insights and Secure Client, so many organisations mix site licences for offices with user licences for remote staff
• Terms of 12, 36 or 60 months; Cisco's ordering guidance says subscriptions renew automatically for a further 12 months unless the renewal is cancelled
• Changes mid-term: users can be added during the term and co-terminate with the existing subscription
• Support: Enhanced software support is ordered with the subscription, with an upgrade to Premium available
• Included extras: limited-use Cisco Duo licences and multi-organisation management at no extra cost, per Cisco's data sheet

For how this fits with firewall, ISE and other Cisco licences, see Cisco security licensing. Secure Access subscriptions include the right to download and use Cisco Secure Client with Secure Access; using Secure Client with on-premises ASA or Threat Defense VPN headends needs a separate licence, covered under Secure Client licensing.

Secure Access in the User Protection Suite

Cisco also sells Secure Access inside the User Protection Suite. The suite's Essentials tier combines Secure Access Essentials (SIA and SPA) with Duo and Secure Email Threat Defense; its Advantage tier moves to Secure Access Advantage and adds Secure Endpoint and ISE. If you need three or more of those products, compare the suite with buying Secure Access alone; see Cisco security suites for the full picture.

Sizing and quoting

1. Count the users who need internet protection, private app access or both, including contractors.
2. Decide whether offices are better covered by site licences or user licences.
3. Choose the tier from the features you actually need (Layer 7 and IPS, isolation, DLP).
4. Add only the add-ons that close a real gap, and pick a term that lines up with other renewals, such as an Umbrella end date.
5. Check whether the User Protection Suite or a Cisco Security Enterprise Agreement works out better.

Prices depend on user band, term and add-ons, so ask us for a quote. Contact us and we will size it with you.

How Forever Systems supplies and supports Cisco Secure

We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.

• Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
• Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
• Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
• Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
• Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals

Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.

Frequently asked questions

Explore the Cisco security portfolio

Related from Forever Group

• Cisco Umbrella pricing and licensing
• Cisco Duo pricing and licensing
• SASE explained (vendor-neutral)
• Cisco security at Forever Group