In short: The Cisco User Protection Suite is a per-user subscription combining Cisco Secure Access, Duo Advantage and Secure Email Threat Defense in its Essentials tier. The Advantage tier moves to Secure Access Advantage and adds Secure Endpoint Advantage and ISE Premier, covering zero trust access, identity, email, endpoint and network access control.
What is the User Protection Suite?
Users are where most attacks start: a phishing email, a stolen password, a compromised laptop or an unmanaged device on the network. Cisco built the User Protection Suite to cover each of those routes with products that share identity and device context, so access decisions take everything into account.
In practice the suite applies zero trust principles to the workforce. Users get direct, secure access to SaaS, private and internet applications from anywhere, while the business gets consistent policy, phishing-resistant authentication and a single place to see who is accessing what.
Components
- Cisco Secure Access: Cisco's security service edge, covering Secure Internet Access (secure web gateway, DNS security, CASB, firewall as a service) and Secure Private Access (ZTNA and VPN as a service)
- Cisco Duo Advantage: MFA, passwordless sign-in, single sign-on, risk-based authentication, Duo Passport and device trust and health policies. Cisco lists Cisco Identity Intelligence as part of Duo Advantage, adding identity threat detection. Edition detail is on our Duo Advantage page
- Secure Email Threat Defense: API-based protection for Microsoft 365 against business email compromise, phishing and account takeover
- Secure Endpoint Advantage: endpoint protection and EDR with vulnerability prioritisation and live investigation tools
- Cisco ISE Premier: network access control that evaluates device posture and applies security policy to every device joining the network
Essentials vs Advantage
Cisco's suite page says the Advantage tier includes and builds on Essentials. The edition mapping below follows Cisco's licensing page and ordering guide:
| Component | User Protection Essentials | User Protection Advantage |
|---|---|---|
| Cisco Secure Access | Secure Access Essentials (Secure Internet Access and Secure Private Access) | Secure Access Advantage |
| Cisco Duo | Duo Advantage | Duo Advantage |
| Secure Email Threat Defense | Included | Included |
| Secure Endpoint | No | Secure Endpoint Advantage |
| Cisco ISE | No | ISE Premier |
Secure Access Essentials already includes digital experience monitoring, CASB, Layer 3 and 4 firewall as a service, remote browser isolation for risky traffic and Secure Malware Analytics. Secure Access Advantage adds Layer 7 firewall as a service, advanced remote browser isolation and data loss prevention, including for generative AI applications. Cisco Solution Support is included in both tiers. See Secure Access licensing and ISE licensing for the detail.
How it is licensed
The suite is a term subscription counted per user. In Cisco's ordering guide, the device-based products are entitled per user too: each user licence covers a set number of Secure Endpoint endpoints and ISE devices, so you do not count laptops, phones and printers separately. The term and quantity apply to every product in the subscription.
Two points are worth checking before you buy:
- Device-heavy networks: if ISE must cover many more devices than you have users (IoT, printers, medical or building systems), a separate ISE licence may fit better
- Existing licences: if you already hold Duo, Umbrella or Secure Endpoint terms, we line up co-termination so you are not paying twice
Umbrella customers should note that Umbrella DNS and SIG reach end of sale on 31 January 2027, with Secure Access as the successor; the suite is one way to make that move. See our Cisco Umbrella hub and the Umbrella end of life guide.
Who it suits
- Hybrid and remote workforces replacing a remote access VPN with ZTNA
- Organisations retiring Umbrella or an on-premises proxy and moving to Secure Access
- Microsoft 365 users who want email protection beyond the built-in controls, without changing MX records
- Networks that need NAC: offices, campuses, schools and healthcare sites where you must know what is plugged in (Advantage tier)
- Teams consolidating vendors across identity, access, email and endpoint
If you also want detection and response, add the Breach Protection Suite: its Cisco XDR integrates natively with Cisco's security products, so it can correlate signals from the User Protection components too.
How we help
Forever Systems plans the suite as a project, not a licence drop. A typical sequence:
- Review identity sources, remote access, email and endpoint tools you run today, and their renewal dates.
- Roll out Duo for MFA and device trust first, because every other component benefits from strong identity.
- Move internet and private application access to Secure Access, replacing VPN and proxy use cases in phases.
- Connect Secure Email Threat Defense to Microsoft 365 by API.
- In Advantage, deploy Secure Endpoint and then ISE, starting in monitor mode so nobody is locked out.
Pricing depends on tier, user count and term, so ask us for a quote. Contact us to plan your move.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is included in the Cisco User Protection Suite?
Cisco Secure Access, Duo Advantage and Secure Email Threat Defense in the Essentials tier. The Advantage tier moves to Secure Access Advantage and adds Secure Endpoint Advantage and Cisco ISE Premier.
Which Duo edition is in the User Protection Suite?
Cisco's licensing page and ordering guide list Duo Advantage, which Cisco says includes Identity Intelligence. Edition detail is on cisco-duo.co.uk.
Is the User Protection Suite a replacement for Cisco Umbrella?
It can be. It includes Cisco Secure Access, which Cisco names as the successor to Umbrella DNS and SIG ahead of their 31 January 2027 end of sale. Organisations that only need DNS-layer security can look at Secure Access DNS Defense instead.
How is the User Protection Suite licensed?
As a per-user term subscription. Device-based products such as Secure Endpoint and ISE are entitled as a set number of endpoints or devices per licensed user. Ask us for a quote.
Can I combine User Protection with Breach Protection?
Yes. You can hold both suites, and Cisco XDR in Breach Protection integrates natively with Cisco's security products, so it can see identity, access, email and endpoint signals together. We can quote both on aligned terms.