In short: The Cisco Breach Protection Suite bundles Cisco XDR, Secure Endpoint and Secure Email Threat Defense in its Essentials tier. Advantage adds Talos threat hunting, Secure Network Analytics and Cisco Telemetry Broker, and Premier adds Cisco's managed XDR service, Talos Incident Response and a Technical Security Assessment. It is licensed per user.
What is the Breach Protection Suite?
Most breaches show up first as weak signals in different places: a phishing email, an odd process on a laptop, a new connection out of the network. Separately, each looks minor. The Breach Protection Suite is Cisco's way of putting those signals in one place, so they can be correlated into a single incident and acted on quickly.
At its heart is Cisco XDR, which takes telemetry from the other products in the suite, enriches it with Cisco Talos intelligence, maps it to MITRE ATT&CK techniques and offers guided or automated response. Around it sit Cisco Secure Endpoint for devices, Secure Email Threat Defense for Microsoft 365 mail and, from the Advantage tier, Secure Network Analytics for the network, with XDR Advantage adding third-party and public cloud telemetry.
Breach Protection tiers compared
Each tier includes everything in the tier below. This reflects Cisco's current suite licensing page and ordering guide:
| Component | Essentials | Advantage | Premier |
|---|---|---|---|
| Cisco XDR | XDR Essentials (all Cisco telemetry) | XDR Advantage (adds third-party and public cloud telemetry) | XDR Premier (Cisco managed XDR) |
| Secure Endpoint | Secure Endpoint Advantage | Secure Endpoint Premier, with Talos threat hunting | As Advantage |
| Secure Email Threat Defense | Included (Essentials) | Included | Included |
| Secure Network Analytics | No | Included (flow rate licences) | Included |
| Cisco Telemetry Broker | No | Included | Included |
| Talos Incident Response | No | No | Included |
| Cisco Technical Security Assessment | No | No | Included |
For the detail of each product edition, see Cisco XDR licensing and Secure Endpoint editions.
What each tier adds in practice
Essentials gives a small team a working detection and response stack: endpoint protection and EDR with Orbital queries and remote scripts, email threat detection for business email compromise and account takeover, and XDR to join the two and run response actions such as isolating a device or removing a message.
Advantage extends visibility to the network and adds expert help. Secure Network Analytics spots threats in flow data that endpoints cannot see (unmanaged devices, lateral movement, data leaving the network), and Cisco Telemetry Broker collects, filters and forwards that telemetry to the tools that need it. Cisco's ordering guide says the suite entitles you to flow rate licences, with the Manager, Flow Collector and Data Store virtual appliances included; Flow Sensors and the Secure Network Analytics threat intelligence feed are added separately. Secure Endpoint Premier brings proactive threat hunting by Talos, and XDR Advantage connects supported third-party security tools.
Premier adds people. In Cisco's managed XDR service, Cisco's security operations centre monitors incidents around the clock, prioritises and escalates them, takes pre-approved response actions on your behalf and provides quarterly briefings. Talos Incident Response adds proactive and emergency services to help you prepare for, respond to and recover from incidents, with service hours that build up in line with the number of Premier licences you buy. The Cisco Technical Security Assessment is a set of proactive services, such as threat modelling, penetration testing, red, blue and purple team exercises, and architecture and configuration reviews.
Who each tier suits
| If you are... | Consider |
|---|---|
| A small IT team that needs EDR and email protection joined up | Essentials |
| Running a mixed estate with other vendors' security tools | Advantage, for the third-party XDR integrations |
| Worried about devices you cannot put an agent on, or lateral movement | Advantage, for Secure Network Analytics |
| Without a security operations team, or unable to staff one around the clock | Premier, for managed XDR and Talos IR |
| Already running a SIEM such as Splunk Enterprise Security | Essentials or Advantage, feeding XDR incidents into the SIEM |
If you already have a mature SOC, compare the suite with Splunk Enterprise Security; many organisations run XDR for correlated response and a SIEM for wider log analytics.
Licensing, user protection and how we help
The suite is a term subscription counted per user, with Secure Endpoint entitled as a set number of endpoints per user and Secure Network Analytics as a flow rate per user, according to Cisco's ordering guide. One term and quantity cover every product in the subscription, and Cisco Solution Support is included. Pairing it with the User Protection Suite brings in Secure Access, Duo and ISE, so XDR can also draw on identity and access signals.
Forever Systems sizes the suite against your users, endpoints and network flows, deploys Secure Endpoint and Email Threat Defense, connects everything to XDR and tunes the first incidents so your team trusts what it sees. Pricing depends on tier, user count and term, so ask us for a quote. Contact us to plan your roll-out.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is included in the Cisco Breach Protection Suite?
Essentials includes Cisco XDR, Secure Endpoint and Secure Email Threat Defense. Advantage adds Talos threat hunting through Secure Endpoint Premier, Secure Network Analytics and Cisco Telemetry Broker, plus XDR Advantage. Premier adds Cisco managed XDR, Talos Incident Response and a Technical Security Assessment.
Does the Breach Protection Suite include managed detection and response?
Only the Premier tier. It includes Cisco's managed XDR service, where Cisco's security operations centre monitors incidents around the clock and takes pre-approved response actions, along with Talos Incident Response service hours.
Is the Breach Protection Suite licensed per user or per device?
Per user. Cisco's ordering material entitles each user to a set number of Secure Endpoint endpoints and a flow rate for Secure Network Analytics, so you do not license each product separately.
Does Breach Protection work with non-Cisco security tools?
Yes, from the Advantage tier. XDR Advantage adds commercially supported, curated integrations with selected third-party tools and public cloud telemetry, so incidents can draw on products you already run.
What is the difference between the Breach Protection Suite and Cisco XDR?
Cisco XDR is one product, the correlation and response platform. The suite bundles XDR with the endpoint, email and network sensors that feed it, and in Premier with Cisco-delivered services.