In short: Cisco XDR licensing has three editions. Essentials integrates the Cisco security portfolio. Advantage adds curated third-party integrations such as Microsoft Defender and CrowdStrike. Premier delivers Advantage as a Cisco-managed service with Talos Incident Response and a Cisco Technical Security Assessment. All are term subscriptions sized by users, with 90 days of data retention as standard.
The three Cisco XDR editions
Every edition shares the same core platform: correlated incidents, risk-based prioritisation, AI-guided recommendations, Talos intelligence, MITRE ATT&CK mapping for threat hunting, customisable automation workflows and Cisco's built-in network detection. What changes is which data sources you can connect and who does the work.
| Capability | Essentials | Advantage | Premier |
|---|---|---|---|
| Correlated, prioritised incidents and AI-guided actions | Yes | Yes | Yes |
| Talos and third-party threat intelligence | Yes | Yes | Yes |
| Threat hunting with MITRE ATT&CK mapping | Yes | Yes | Yes |
| Automation workflows and response actions | Yes | Yes | Yes |
| Built-in network detection and response | Yes | Yes | Yes |
| Meraki MX telemetry integration (needs MX Advantage) | Yes | Yes | Yes |
| Integrations across the Cisco security portfolio | Yes | Yes | Yes |
| Curated third-party data and telemetry integrations | No | Yes | Yes |
| XDR Forensics | No | Yes | Yes |
| Managed XDR run by Cisco security experts | No | No | Yes |
| Cisco Talos Incident Response and Cisco Technical Security Assessment | No | No | Yes |
| Standard data retention | 90 days | 90 days | 90 days |
This table reflects Cisco's published edition summary and licences page. Cisco updates edition contents over time, so we always confirm against the current ordering guide before quoting.
Which edition suits which buyer
- XDR Essentials: organisations that run mostly Cisco security, for example Secure Endpoint, Secure Firewall, Secure Email and Secure Access, and want them correlated in one place
- XDR Advantage: mixed estates where the endpoint, email or cloud tooling comes from another vendor (Cisco names Microsoft Defender, CrowdStrike, SentinelOne, Cybereason and Palo Alto Networks among supported integrations) and you still want one incident queue
- XDR Premier: organisations without a 24x7 security operations team that want Cisco's analysts to monitor, investigate and respond around the clock, with Talos Incident Response and a technical security assessment included
- XDR Forensics: if forensic evidence matters to your investigations, note that Cisco lists XDR Forensics in Advantage and Premier only
A useful test: if your team cannot reliably look at incidents out of hours, Premier or a managed service around Advantage is usually a better fit than Essentials on its own.
How Cisco XDR is licensed
- Term subscription: XDR is a SaaS service sold as a fixed-term subscription
- Sized by users: the licence count is based on the number of users in your organisation, and each edition includes a monthly data ingestion allowance per user
- Data retention: 90 days is standard in every edition, and Cisco sells 180-day and 365-day retention add-ons, plus additional ingest if you need more than the allowance
- Where your data sits: confirm the XDR region for your tenant at setup, as it matters for UK GDPR records and data mapping
- Smart Licensing: entitlements sit in your Cisco Smart Account, like other Cisco security subscriptions (see Cisco security licensing)
A la carte or the Breach Protection Suite?
Cisco XDR can be bought on its own or as the core of the Cisco Breach Protection Suite, which bundles it with endpoint, email and network detection:
| Suite tier | XDR element | Also includes |
|---|---|---|
| Breach Protection Essentials | XDR Essentials | Secure Endpoint Advantage and Secure Email Threat Defense |
| Breach Protection Advantage | XDR Advantage | Secure Endpoint Premier, Secure Email Threat Defense, Secure Network Analytics and Cisco Telemetry Broker |
| Breach Protection Premier | XDR Premier (managed XDR) | Everything in Advantage, plus Talos Incident Response and a Cisco Technical Security Assessment |
If you already need two or more of those components, the suite is often simpler to manage and renew than separate subscriptions. If you only want XDR over an existing third-party EDR, XDR Advantage a la carte is usually the cleaner choice. Our Cisco security suites page compares all the suites.
Migrating from older Cisco services
Two earlier Cisco offers now lead to XDR:
- Cisco SecureX, the integration platform once included with Cisco security licences, was replaced by Cisco XDR.
- Secure Cloud Analytics reached end of sale on 13 November 2023 and its monitoring became part of Cisco XDR, with XDR Essentials and Advantage as Cisco's listed replacements. See Secure Cloud Analytics now part of XDR.
If you used an earlier Cisco managed detection and response service, XDR Premier is Cisco's current managed XDR offer.
Our Cisco security end-of-life guide lists other renamed and retired products.
Getting a Cisco XDR quote
- Count your users and list the security tools you want XDR to ingest, Cisco and third-party
- Decide who will work the incidents: your team (Essentials or Advantage) or Cisco (Premier)
- Choose a retention period that matches your investigation and audit needs
- Compare a la carte XDR with the Breach Protection Suite tiers
- Agree the term and how it lines up with your other Cisco renewals
Cisco list prices are public in some catalogues, but your price depends on edition, term, add-ons and bundle, so ask us for a quote. Contact us using the form.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How is Cisco XDR licensed?
Cisco XDR is a term subscription sized by the number of users in your organisation. It comes in Essentials, Advantage and Premier editions, with 90 days of data retention as standard and optional 180-day or 365-day retention add-ons.
What is the difference between Cisco XDR Essentials and Advantage?
Essentials integrates the Cisco security portfolio. Advantage adds curated, commercially supported third-party integrations, such as Microsoft Defender, CrowdStrike and SentinelOne, so you can correlate them with Cisco data.
What does Cisco XDR Premier include?
Premier gives you the Advantage capabilities delivered as a managed detection and response service by Cisco security experts, with Cisco Talos Incident Response and a Cisco Technical Security Assessment included.
Is Cisco XDR included in the Breach Protection Suite?
Yes. Each Breach Protection Suite tier includes the matching XDR edition: Essentials, Advantage or Premier. The Premier tier includes Cisco's managed XDR, Talos Incident Response and a Technical Security Assessment.
How much does Cisco XDR cost?
It depends on users, edition, term, retention and whether you buy it in a suite. Ask us for a quote through the contact form.