In short: Cisco security suites are tiered subscriptions that bundle related Cisco security products under one licence. The User Protection Suite secures users and their access, the Breach Protection Suite delivers XDR-led detection and response, and the Cloud Protection Suite is the licence route to Hybrid Mesh Firewall. A suite usually pays off when you need several of its products.
What are the Cisco security suites?
Cisco used to sell each security product with its own licence, its own tiers and often its own renewal date. Its suites change that by grouping products around the problem you are trying to solve rather than the technology. There are three:
- User Protection Suite: protects users and their access to applications, built from Cisco Secure Access, Cisco Duo, Secure Email Threat Defense, Secure Endpoint and Cisco ISE
- Breach Protection Suite: detects, investigates and responds to attacks, built around Cisco XDR with Secure Endpoint, Secure Email Threat Defense and, in higher tiers, Secure Network Analytics and Cisco-delivered services
- Cloud Protection Suite: protects applications and workloads across data centres and public clouds, and is Cisco's licence route to Hybrid Mesh Firewall
The User Protection and Breach Protection suites complement each other. Cisco XDR, the core of Breach Protection, integrates natively with Cisco's security portfolio, so an organisation that holds both suites can correlate identity, access, email and endpoint signals in one place. We can quote the two on aligned terms.
The suites compared
| Suite | Tiers | Core products | Typical buyer |
|---|---|---|---|
| User Protection | Essentials, Advantage | Secure Access, Duo, Secure Email Threat Defense; Advantage adds Secure Endpoint and ISE | Hybrid workforce, VPN replacement, identity-led zero trust |
| Breach Protection | Essentials, Advantage, Premier | Cisco XDR, Secure Endpoint, Secure Email Threat Defense; Advantage adds Secure Network Analytics and Cisco Telemetry Broker; Premier adds managed XDR and Talos Incident Response | Small or stretched security teams, SOC consolidation |
| Cloud Protection | Segmentation and Gateway packages | Secure Workload, Hypershield, Isovalent; or virtual Secure Firewall and Multicloud Defense; Security Cloud Control in both | Data centre and multicloud estates moving to Hybrid Mesh Firewall |
Tier contents change as Cisco renames and repackages products, so we always check the current offer description before quoting. Each suite page on this site lists the components tier by tier.
How the tiers work
The suites follow the same Essentials, Advantage, Premier pattern that Cisco uses across the portfolio (see Cisco security licensing):
- Essentials gives you the foundation: the core products, usually at their entry or mid edition
- Advantage includes everything in Essentials and adds products or higher editions, such as Secure Endpoint Premier and Cisco XDR Advantage in Breach Protection, or Secure Access Advantage and ISE Premier in User Protection
- Premier, where it exists, adds Cisco-delivered services rather than more software: in Breach Protection that means managed XDR, Talos Incident Response and a Technical Security Assessment
User Protection and Breach Protection are counted per user. Cisco's ordering guide shows device-based products inside them, such as Secure Endpoint and ISE, entitled as a set number of endpoints or devices per licensed user, and network detection as a flow rate per user. One term and one quantity apply to every product in the subscription. The Cloud Protection Suite protects workloads and cloud traffic rather than people, and Cisco does not publish per-user counting for it, so we size it against the estate in scope.
Suite or a la carte?
A suite is not automatically better value. It tends to win when:
- You would otherwise buy three or more of the included products separately
- You want one renewal date, one quantity and one support entitlement instead of several
- You want the products wired together (XDR correlating endpoint, email and identity, for example) rather than running side by side
- You plan to grow into the higher tiers and want a clear upgrade path
Buying a la carte usually makes more sense when you only need one or two products, when you already own long-running licences that would overlap, or when user counts differ sharply between products (for example, ISE covering many more devices than you have staff). It is also worth checking renewal dates first: moving to a suite mid-term can mean paying for overlapping licences until the old ones expire.
How we help
Forever Systems starts with what you already own. We list your current Cisco and non-Cisco security licences and their renewal dates, map them to suite components, and model three options: stay a la carte, move to a suite, or combine a suite with selected standalone products. Where a suite overlaps something you already pay for, we show the overlap so you can decide whether to co-terminate or wait for a renewal.
We then deploy and integrate the products so the suite works as one system, not a bundle of unopened licences. Pricing depends on the suite, tier, user count and term, so ask us for a quote. Contact us to review your licences.
Explore Security suites
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What are the three Cisco security suites?
The User Protection Suite (secure access, identity, email and endpoint for users), the Breach Protection Suite (XDR-led detection and response) and the Cloud Protection Suite (segmentation and cloud firewalling for Hybrid Mesh Firewall). User Protection and Breach Protection are designed to complement each other and can be held together.
Are Cisco security suites licensed per user?
The User Protection and Breach Protection suites are licensed per user, with device-based products such as Secure Endpoint and ISE entitled as a set number of endpoints or devices per user. The Cloud Protection Suite protects workloads and cloud traffic, and Cisco does not publish per-user counting for it, so we size it against what it protects.
Is a Cisco suite cheaper than buying products separately?
Often, when you need several of the included products, but not always. We model both options against your current licences and renewal dates. Ask us for a quote.
Can I upgrade from one suite tier to another?
Yes. Each tier includes the one below it, so moving from Essentials to Advantage adds products or editions without replacing what you have deployed. We plan the upgrade to line up with your term.
Do the suites include support?
Cisco includes a support entitlement with the suite subscriptions, and the level depends on how the suite is bought. We confirm what is included on your quote and provide our own support on top.