In short: Cisco Firepower Threat Defense (FTD), now Cisco Secure Firewall Threat Defense, is Cisco's unified next-generation firewall software. It combines firewall, VPN, Snort 3 IPS, SnortML, application and URL control, malware defence and universal ZTNA, runs on Secure Firewall hardware, virtual machines, public clouds and containers, and is managed by Management Center or Device Manager.
What is Threat Defense?
After Cisco bought Sourcefire, it combined the Sourcefire next-generation IPS with its own ASA firewall into a single software image called Firepower Threat Defense, or FTD. Today that image is Cisco Secure Firewall Threat Defense (Cisco's current release notes shorten it to Firewall Threat Defense), and it is the image that carries the next-generation inspection features on Cisco Secure Firewall. Older appliances and older documentation still use the Firepower name.
One image covers every form factor: branch, campus, data centre and industrial appliances, Threat Defense Virtual on private and public cloud, and a container version for Docker and Kubernetes. That means one policy model and one set of skills across the estate.
What it does
- Firewall, NAT, routing and VPN: stateful access control, dynamic routing, site-to-site VPN (including route-based VPN) and remote access VPN with Cisco Secure Client
- Snort 3 IPS with Talos rules. Snort 2 is deprecated, so any device still on Snort 2 must be switched to Snort 3 before it can be upgraded to 7.7 or later
- SnortML, a neural-network inspector that detects web exploits such as SQL injection and command injection by learned pattern rather than by individual signature
- Application visibility and control, URL filtering and Security Intelligence blocking of known bad IPs, domains and URLs
- Malware Defense: file inspection and dynamic analysis with Secure Malware Analytics
- Encrypted Visibility Engine for insight into encrypted traffic without decryption (version 10.1 added SSH and STUN fingerprinting), plus full decryption policies where you need them
- Universal zero trust network access (ZTNA): access to internal applications based on user identity, trust and posture, so that reaching one application does not open up the whole network. It is enforced on the firewall and requires Cisco Secure Access and Security Cloud Control
Version 10 and the new release numbering
After the 7.7 release, Cisco moved Threat Defense to version 10, which Cisco describes as the start of a new release numbering scheme and cadence. Key releases, from Cisco's release notes:
| Release | When | Highlights |
|---|---|---|
| 7.7.10 | August 2025 | Universal ZTNA introduced in Management Center (managed devices need Threat Defense 10.0 or later) |
| 10.0.0 | December 2025 | Redesigned Management Center menus, a new decryption policy interface, simultaneous editing of access control policies, SnortML command injection detection, identity-based dynamic access control, a SIEM syslog wizard, IPv6 for clientless ZTNA |
| 10.0.1 | February 2026 | Management Center-only maintenance release |
| 10.0.2 | September 2026 | Maintenance release |
| 10.1.0 | September 2026 | SnortML inspection of URL queries and POST data, universal ZTNA on all device models with IPv6 support, a wizard for site-to-site tunnels to Cisco Secure Access, multicast routing over static VTIs |
Cisco has since published further maintenance releases, 10.0.3 and 10.1.1, which contain bug and security fixes rather than new features.
Upgrades need planning. The Management Center is upgraded before the devices it manages. Threat Defense Virtual cannot be reverted from version 10 to 7.7 or earlier, because version 10 adds Secure Boot and UEFI support. Upgrading a universal ZTNA device to 10.1 or later from an older version disables the feature, and traffic is interrupted until you deploy policy from Management Center. We check the supported upgrade path for your exact hardware and versions before every upgrade.
How Threat Defense is managed
| Manager | Best for |
|---|---|
| Secure Firewall Management Center (on-premises, virtual or public cloud) | Central management of many firewalls with full event analysis and correlation |
| Cloud-delivered Management Center in Security Cloud Control | The same policy model without running a management server; Cisco updates it |
| Secure Firewall Device Manager | A single firewall managed on the box, or a handful of small sites |
Licences are assigned through Cisco Smart Licensing via the manager; see Secure Firewall licensing for Essentials, IPS, Malware Defense, URL Filtering and Carrier.
FTD vs ASA
Both images run on current Secure Firewall hardware, so the choice is about features, skills and how you manage the estate.
| Threat Defense (FTD) | Secure Firewall ASA | |
|---|---|---|
| Purpose | Full next-generation firewall | Stateful firewall and VPN headend |
| Intrusion prevention | Snort 3 IPS and SnortML | Not included |
| Application and URL control | Yes, with Talos categories and reputation | Not included |
| Malware defence and sandboxing | Yes, with the Malware Defense licence | No |
| Zero trust access | Universal ZTNA with Secure Access | Remote access VPN |
| Management | Management Center, cloud-delivered Management Center, Device Manager | ASDM, command line, Security Cloud Control |
| Ongoing development | Cisco's next-generation features, such as SnortML and universal ZTNA, arrive here | Still released (ASA 9.24 is current), but without the next-generation inspection features |
If you run ASA today, our Cisco ASA page covers when staying on ASA software is reasonable, and the ASA to Threat Defense migration guide shows how the move works.
How we help
We design, deploy, migrate and support Threat Defense for UK organisations: sizing the platform, building IPS and decryption policies that fit your applications, planning version 10 upgrades, enabling universal ZTNA with Secure Access, and handling licensing and renewals. Contact us and ask us for a quote.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Cisco FTD?
FTD stands for Firepower Threat Defense, the name Cisco used for its unified next-generation firewall software. It is now called Cisco Secure Firewall Threat Defense and runs on Secure Firewall hardware, virtual machines and public clouds.
What is the latest version of Cisco Secure Firewall Threat Defense?
Cisco moved to version 10 numbering with 10.0.0 in December 2025. At the time of writing (October 2026), the newest release train is 10.1: 10.1.0 was released in September 2026 and has been followed by maintenance release 10.1.1. Always check the release notes and the supported upgrade path before upgrading.
Is FTD better than ASA?
For most firewalls that inspect user and internet traffic, yes: Threat Defense adds Snort 3 IPS, SnortML, application control, URL filtering, malware defence and universal ZTNA, none of which ASA software offers. ASA software can still suit dedicated VPN headends or designs that depend on ASA-specific features.
Can FTD be managed without a Management Center?
Yes. Secure Firewall Device Manager manages a single device on the box, and the cloud-delivered Management Center in Security Cloud Control removes the need for an on-premises server.
Does Threat Defense still use Snort 2?
Snort 2 is deprecated. A device must be switched to Snort 3 before it can be upgraded to 7.7 or later, and current releases are built around Snort 3.