In short: Cisco security licensing uses Smart Licensing: entitlements sit in your Smart Account rather than on product keys. Most products are sold as term subscriptions in Essentials, Advantage or Premier tiers and counted per user, per device or per endpoint. You can buy products a la carte, in suites, or across the portfolio under an Enterprise Agreement.
Smart Licensing and Smart Accounts
Cisco no longer ships most security software with product activation keys. Instead it uses Smart Licensing: your entitlements are held centrally and devices or cloud services draw on them.
- Smart Account: your organisation's central record of Cisco licences and devices, with administrator and user roles to control who can manage it. Orders are assigned to it, so it is worth setting one up (or confirming the existing one) before you buy.
- Virtual Accounts: sub-folders inside a Smart Account, used to split licences by department, site, customer or environment.
- A shared pool: licences are not locked to a particular piece of hardware, so you can move entitlement between devices as your estate changes.
- Cisco License Central: Cisco's centralised licence management platform on Cisco Software Central, giving one view of your assets and entitlements from order through to activation. It is also where you create a new Smart Account.
- Connected, on-premises or disconnected reporting: devices can report usage directly over the internet or a proxy, through Smart Software Manager On-Prem for isolated networks, or by licence reservation in fully air-gapped environments.
For firewalls specifically, Cisco added a Smart Licensing dashboard to Cisco Security Cloud Control in early 2026 (limited release), so licence status can be seen alongside the devices that use it. Cloud services such as Secure Access, Cisco XDR and Duo are provisioned against your subscription rather than registered device by device.
Term subscriptions and the tier pattern
Most Cisco security products are sold as term subscriptions, usually with a choice of contract lengths (one, three and five years are the common ones), and include software updates and Cisco support for the term. A few exceptions remain, such as the base firewall licence on most Secure Firewall hardware, which is perpetual.
Across much of the portfolio Cisco uses the same three tier names. Each tier normally includes everything in the tier below:
| Tier | Typical meaning | Examples |
|---|---|---|
| Essentials | The core product | Secure Endpoint, Secure Access, XDR, ISE, Duo, Secure Email, the suites |
| Advantage | Adds advanced detection, integrations or controls | Secure Endpoint, Secure Access, XDR, ISE, Secure Client, Duo, Secure Email, the suites |
| Premier | Adds expert services or the fullest feature set | Secure Endpoint, XDR, ISE, Secure Client, Duo, Breach Protection Suite |
The pattern is a guide, not a rule. Secure Firewall uses feature licences instead (Essentials, IPS, Malware Defense, URL Filtering and Carrier), Secure Client has Advantage, Premier and VPN Only, Secure Access and Secure Email have just Essentials and Advantage, and the Cloud Protection Suite is sold as Segmentation and Gateway packages. Always check the product page before assuming what a tier includes.
Licence metrics: per user, per device, per endpoint
The biggest source of licensing mistakes is counting the wrong thing. Each product has its own metric:
| Product | What is counted | Licensing guide |
|---|---|---|
| Cisco Secure Firewall | Each firewall (hardware appliance or virtual instance) and its feature licences | Secure Firewall licensing |
| Cisco Secure Access | Users | Secure Access licensing |
| Cisco Secure Client | Unique users (Advantage, Premier) or concurrent VPN connections (VPN Only) | Secure Client licensing |
| Cisco ISE | Concurrent active endpoints, plus Device Administration and virtual machine node licences | ISE licensing |
| Cisco Secure Endpoint | Protected endpoints | Secure Endpoint editions |
| Cisco XDR | Users | XDR editions |
| Cisco security suites | Set per suite and tier | Cisco security suites |
| Cisco Duo | Users | Duo pricing and licensing |
| Cisco Umbrella | Users | Umbrella pricing and licensing |
Splunk products, including Splunk Enterprise Security, follow Splunk's own licensing models rather than the Cisco Secure tiers. We size every one of these from your real numbers, so ask us for a quote rather than relying on a list price.
Suites or a la carte?
Cisco bundles related products into three suites: User Protection, Breach Protection and Cloud Protection, plus a combined User and Breach Protection option. A suite gives you one subscription, one renewal date and products that are designed to work together.
A suite tends to make sense when:
- you need two or more of the products in it within the same budget cycle
- you want aligned renewal dates instead of a scatter of separate subscriptions
- you plan to use the integrations between products, such as Secure Endpoint and Secure Email Threat Defense feeding Cisco XDR
Buying products individually (a la carte) is usually better if you only need one product, if you already own a strong alternative for part of the suite, or if renewal dates are years apart. We model both options for you; see Cisco security suites for what each suite contains.
Enterprise Agreements
For larger estates, Cisco offers Enterprise Agreements that cover a whole architecture, including security, on one contract. Rather than counting every licence product by product, you commit to a set of products or suites for a multi-year term, and Cisco's True Forward billing lets you grow during the term without a retroactive bill for the extra usage. Cisco sets minimum sizes and the eligible suites in its current programme guide, and these change from time to time.
An Enterprise Agreement suits organisations that are standardising on Cisco security across several products and want predictable annual costs. It is rarely the right choice for a single product or a small user count. We can check whether your estate qualifies and compare it with buying suites or individual products.
How we help with Cisco licensing
- Audit what you already own: we review your Smart Account, renewal dates and which features are actually in use.
- Size each product on the right metric: users, devices, endpoints or connections.
- Compare a la carte, suite and Enterprise Agreement options, including co-terming renewals onto one date.
- Quote the option that fits. Pricing depends on quantities, term and tier: ask us for a quote.
- Activate and manage: we help register devices, set up Virtual Accounts and keep track of renewals.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is a Cisco Smart Account?
A Smart Account is your organisation's central repository for Cisco licences and registered devices. Orders are assigned to it, and Virtual Accounts inside it let you organise licences by site, department or environment.
Do Cisco security licences expire?
Most do, because they are term subscriptions. When the term ends you renew to keep updates, threat intelligence, cloud services and support. A few licences, such as the base Secure Firewall licence on most hardware, are perpetual.
Can I move Cisco licences between devices?
Generally yes. Smart Licensing puts entitlements in a shared pool rather than locking them to hardware, so you can release a licence from one device and use it on another in the same account.
Is a Cisco security suite cheaper than buying products separately?
It can be when you need several of the products in the suite, but not if you only need one. We price both options for your user and device counts so you can compare: ask us for a quote.
What is Cisco License Central?
Cisco License Central is Cisco's centralised licence management platform, on Cisco Software Central. It gives one view of the assets and entitlements in your Smart Account, from order to activation, and is where you create a Smart Account. Products such as Secure Firewall still register through Smart Software Manager.