In short: Cisco Security Cloud Control, formerly Cisco Defense Orchestrator (CDO), is Cisco's cloud platform for managing security policy. It includes the cloud-delivered Firewall Management Center for Threat Defense, manages ASA, Meraki MX, Multicloud Defense, Hypershield and Secure Access, and adds AI agents, AIOps insights, policy analysis and bulk upgrades. It is now part of Cisco Cloud Control.
What is Security Cloud Control?
Cisco Defense Orchestrator (CDO) began as a cloud tool for managing ASA and Firepower policy at scale. It is now Cisco Security Cloud Control, a cloud service you sign in to at security.cisco.com. In June 2026 Cisco introduced Cisco Cloud Control, a unified operations platform that brings network, security, observability and other context into one experience, and Security Cloud Control now sits inside it: Cisco's product page is headed "Security in Cisco Cloud Control". The documentation and data sheet still use the Security Cloud Control name.
The aim is to set security policy once and apply it consistently wherever Cisco enforces it: on firewalls at the edge and in the data centre, in public cloud, and in the network itself.
What it manages
| Enforcement point | How Security Cloud Control handles it |
|---|---|
| Secure Firewall Threat Defense | Through the built-in cloud-delivered Firewall Management Center, or by connecting an on-premises Management Center |
| Secure Firewall ASA | Policy, objects and bulk software image upgrades, for ASA hardware and ASA virtual |
| Cisco Multicloud Defense | Cloud network security gateways for ingress, egress and east-west traffic in public cloud |
| Cisco Hypershield | Segmentation policy for the data centre |
| Cisco Secure Access | Security service edge policy, which universal ZTNA on Threat Defense also depends on (see ZTNA) |
| Cisco Meraki MX and Cisco Secure Routers | Meraki MX security appliances, and the firewall capabilities of Catalyst SD-WAN routers |
| Other products | Cisco also lists Secure Workload (SaaS), AI Defense and AWS security groups |
Together these make up Cisco's Hybrid Mesh Firewall approach. In January 2026 Cisco also announced intent-based policy management through a Mesh Policy Engine that extends to selected third-party firewalls. Ask us what is supported for your specific products before planning around it.
AI-assisted operations and other features
Cisco's current data sheet and FAQ describe these operational features:
- AgenticOps: AI agents for policy, VPN, zero trust, performance and compliance tasks, and AI Canvas, a shared workspace where operators and agents investigate issues together
- Natural-language help: ask questions in plain English to investigate issues, find gaps, explain likely causes and get recommended next steps, with documentation answers covering Secure Firewall, Secure Access, Hypershield, XDR and Duo
- AIOps for Secure Firewall: flags critical issues, runs continuous best-practice assessments, tracks feature adoption, and gives real-time and historical traffic and capacity insights
- Policy Analyzer and Optimizer: detects duplicate, redundant, shadowed, expired, overlapping and mergeable rules
- Bulk upgrades: plan and run ASA and Threat Defense image upgrades across many devices
- Multi-tenant management: several tenants coordinated under a central global administrator, useful for groups and service providers
- Automation: an open API and a command-line tool for bulk changes
- Cloud logging: Security Analytics and Logging, a SaaS log store for firewall events, viewed in Security Cloud Control
Licensing in general terms
Cisco's FAQ describes the core service as available at no cost to customers who own the products it manages, such as Secure Firewall, with additional capabilities sold as subscriptions. The data sheet describes per-device firewall management licences (including an option with logging and 90-day retention), separate Security Analytics and Logging subscriptions, and terms of one, three or five years. Security Cloud Control is also included in the Essentials Segmentation and Essentials Gateway options of the Cloud Protection Suite. Exactly what you need depends on which devices you manage and how long you keep logs, so ask us for a quote.
Who it suits
- Organisations with many branches that do not want to run an on-premises Management Center
- Mixed estates running ASA and Threat Defense side by side during a migration
- Teams adopting Hybrid Mesh Firewall, Multicloud Defense or Hypershield, which are managed here
- Managed service providers and multi-company groups that need multi-tenant management
If data location matters to you (for UK GDPR or contractual reasons), ask us and we will confirm the current hosting options with Cisco before you commit.
How we help
We onboard firewalls into Security Cloud Control, migrate on-premises managed Threat Defense devices to cloud management, clean up policy with the analyser, and set up cloud logging and alerts. Contact us for a review of your current management set-up; for licensing, ask us for a quote.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Cisco Defense Orchestrator the same as Security Cloud Control?
Yes. Cisco Defense Orchestrator (CDO) became Cisco Security Cloud Control, which you sign in to at security.cisco.com. Some Cisco documentation and trial addresses still contain the old Defense Orchestrator name.
Has Security Cloud Control been renamed Cisco Cloud Control?
Not exactly. In June 2026 Cisco introduced Cisco Cloud Control, a unified operations platform, and brought Security Cloud Control into it as security in Cisco Cloud Control. The Security Cloud Control name is still used in Cisco's documentation and data sheet.
Can Security Cloud Control replace an on-premises Firewall Management Center?
Yes, for most estates. Its cloud-delivered Management Center manages Threat Defense devices, and Cisco supports moving on-premises managed devices to cloud management. Air-gapped networks still need on-premises management.
Does Security Cloud Control manage Cisco ASA?
Yes. It manages policy and objects for ASA hardware and ASA virtual, and runs software image upgrades across many devices at once.