In short: Cisco security end of life covers two things: renamed products that are still current, such as Firepower (now Secure Firewall) and AMP (now Secure Endpoint), and genuinely retired products. Key dates include Umbrella DNS and SIG end of sale on 31 January 2027 and AnyConnect 4.x support ending on 31 March 2027.
Renamed, not retired
Many searches for "end of life" are really about a name change. These products are all current; only the name moved on:
| Former name | Current name | Our guide |
|---|---|---|
| Firepower, Firepower Threat Defense (FTD) | Cisco Secure Firewall, Secure Firewall Threat Defense | Secure Firewall, Threat Defense |
| Firepower Management Center (FMC) | Secure Firewall Management Center | Management Center |
| Cisco Defense Orchestrator (CDO) | Cisco Security Cloud Control | Security Cloud Control |
| AnyConnect | Cisco Secure Client | Secure Client |
| AMP for Endpoints | Cisco Secure Endpoint | Secure Endpoint |
| Stealthwatch (Enterprise) | Cisco Secure Network Analytics | Secure Network Analytics |
| Stealthwatch Cloud | Cisco Secure Cloud Analytics, now part of Cisco XDR | Secure Cloud Analytics |
| Tetration | Cisco Secure Workload | Secure Workload |
| Threat Grid | Cisco Secure Malware Analytics | Secure Malware Analytics |
| IronPort, Email Security Appliance (ESA) | Cisco Secure Email Gateway | Secure Email Gateway |
| Cloud Mailbox Defense | Cisco Secure Email Threat Defense | Secure Email Threat Defense |
| Web Security Appliance (WSA) | Cisco Secure Web Appliance | Secure Web Appliance |
Device outputs were rebranded in Threat Defense release 7.6, so older hardware, older software versions and older documentation may still show the Firepower name. That is cosmetic: what matters is whether your hardware and software versions are still supported.
End-of-life dates and migration paths
The table below covers the retirements we are asked about most. Dates come from Cisco's end-of-life notices; always check the bulletin for your exact product before planning.
| Product | Key dates | Migration path |
|---|---|---|
| AnyConnect 4.x | Software maintenance ended 31 March 2024; application software support ends 31 March 2027 | Cisco Secure Client 5, at no extra charge for customers with valid term licences, or perpetual licences with active support contracts |
| Older ASA hardware generations | Last date of support reached; the most recent group on 31 August 2026 | Current Secure Firewall hardware running Threat Defense or ASA software |
| Cisco Umbrella DNS and SIG | Announced 1 September 2026; end of sale 31 January 2027; renewals and additions until 31 January 2028; last date of support 31 January 2029 | Cisco Secure Access: DNS Defense replaces the Umbrella DNS packages and Secure Internet Access replaces SIG |
| Cisco Secure Cloud Analytics (standalone) | Last day to order or renew standalone 13 November 2023; support continues through Cisco XDR | Cisco XDR, which now delivers its network and cloud detections |
| Cisco Secure MDR services | End of sale in 2024 | Cisco XDR Premier, which delivers XDR as a Cisco-managed service (XDR editions) |
| Previous Secure Web Appliance hardware generation | End of sale 17 June 2026; last date of support 30 June 2031 | Current appliance generation, virtual appliance, or Secure Access for cloud-delivered web security |
| Older Secure Network Analytics appliances | Announced July 2026; end of sale 18 December 2026; last date of support 31 December 2031 | The next hardware generation or virtual editions of Secure Network Analytics |
| Previous Secure Malware Analytics appliance | End of sale 31 March 2026; last date of support 31 March 2031 | The current appliance generation or cloud-based Secure Malware Analytics |
| Cisco Vulnerability Management, Vulnerability Intelligence and Application Security Module (formerly Kenna) | End of sale 10 March 2026; last renewal 11 June 2026; last date of support 30 June 2028 | Cisco names no replacement, so plan an alternative vulnerability management tool before support ends |
Hardware notices also set a last ship date and an end of software maintenance date between end of sale and last date of support, and some components (such as power supplies or drives) have their own replacements. Check the notice for your exact appliances.
What the end-of-life milestones mean
Cisco end-of-life notices list several milestones. The ones that matter most for planning are:
- End of sale: the last day to order the product. Existing deployments keep working.
- Last ship date: the last date Cisco will ship hardware ordered before end of sale.
- End of software maintenance: no more bug-fix releases after this date, although critical security fixes may still appear for a while.
- End of service contract renewal: the last date to renew or extend support.
- Last date of support: the end of all Cisco support, including TAC cases, replacement hardware and security patches.
Running a security product past its last date of support is a real risk: it stops receiving fixes for new vulnerabilities, and unsupported software on internet-facing devices fails the security update control in Cyber Essentials. Firewalls and VPN headends deserve particular attention because they are exposed to the internet.
How to plan a Cisco security migration
- Inventory every Cisco security product, appliance and software version, with its licence and support contract dates.
- Check the bulletins for each one and note end of sale, end of software maintenance and last date of support.
- Decide the target: like-for-like hardware, a virtual or cloud version, or a different product (for example Secure Access instead of an on-premises web proxy or Umbrella).
- Map licences: work out how existing entitlements translate, and whether a suite now makes more sense than separate renewals.
- Migrate in stages: use Cisco's tools where they exist, such as the Secure Firewall Migration Tool for ASA configurations, and test each stage.
- Cut over and decommission: switch traffic or users across, keep a rollback plan, then remove the old product and close its contract.
Our detailed guides cover the two most common moves: ASA to Secure Firewall Threat Defense and AnyConnect to Cisco Secure Client. For Umbrella, see the Cisco Umbrella end-of-life guide on our Umbrella site.
How we help
We run Cisco security migrations from start to finish: lifecycle audit, design, licence mapping, configuration conversion, staged cut-over and support afterwards. If you have a renewal or end-of-support date coming up, contact us early; the best options (such as co-terming renewals or moving to a suite) are easier to arrange with time in hand. Pricing depends on what you are moving and to what, so ask us for a quote.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Will AnyConnect stop working after 31 March 2027?
It will not switch off, but Cisco's application software support for AnyConnect 4.x ends on that date, so there will be no further fixes or TAC support. Move to Cisco Secure Client 5, which customers with an active term licence or support contract are entitled to.
Is Cisco Firepower end of life?
The Firepower name has been retired, but the product continues as Cisco Secure Firewall and its Threat Defense software. Some older Firepower-branded hardware has its own end-of-life dates, so check the bulletin for your appliances.
Is Cisco ASA end of life?
ASA software is not: it still runs on current Secure Firewall hardware and as ASA virtual. Older ASA hardware generations have reached their last date of support, so those appliances need replacing, either with ASA software on new hardware or with Secure Firewall Threat Defense.
Is Stealthwatch end of life?
No. Stealthwatch was renamed Cisco Secure Network Analytics and is still sold. Stealthwatch Cloud became Secure Cloud Analytics, which is no longer sold on its own; its detections are now part of Cisco XDR. Some older appliance generations have end-of-sale dates.
What happens after the last date of support?
Cisco stops all support for the product: no software or security fixes, no TAC cases and no replacement hardware. The product may keep running, but it becomes an increasing security and compliance risk.