There is always room for improvement. Duo Security is a great product in its current state. However, Cisco can further enhance the integrations, as they possess exceptional integrations with various providers' products and feature sets. They should continue to improve and expand these integrations to include more products. The more integrations they offer, the more advantageous it becomes for us as a Cisco partner to promote and sell their product.

The pain point for us at one point was the Duo Authentication Proxy since we're on-premises and not in the cloud. We had to have a proxy machine that's in our DMZ to talk to Duo for us. The configuration of that was a little complicated.

They could just continue to add more integrations.

More automation and device insights would be helpful in achieving a seamless single pane of glass. Having the additional capability to streamline processes would also make things better.

We found it difficult to integrate it into our broader product family of Microsoft tools and other applications used across our organization. So, we have pulled back from this solution a little bit. It was easier to use Microsoft MFA, which integrated with everything and still did the two-factor authentication that we needed. 

There is nothing wrong with the product, as far as its functionality. It was just the breadth of support. It got harder and harder to integrate.

For what it does, it is fantastic. Once we started hitting Microsoft Office stacks, we then began to find its limitations.

It is not so good for securing access to our application and network. We found it harder to integrate, particularly with the Office stack, which is our primary application stack. We did get it working with a few other cloud applications that we were working with as part of our single sign-on story. However, it certainly wasn't easy to integrate in-house.

It created another step for users who don't know about the benefits, as far as the corporate benefits. I wouldn't consider having another app on their phones and having another thing to deal with a positive for our user community.

I have a few suggestions for improving Duo Security. One major aspect would be the ability to gather contextual data. This means being able to determine the location where someone is authenticating from and whether it aligns with their regular location patterns. While two-factor authentication with mobile devices provides a high level of security, it's still not foolproof, as someone could potentially steal your phone. It would be beneficial to have information about the authentication location. 

If a partner could obtain that data, we could implement it, or if we had our own application, we could incorporate this feature. Additionally, having the ability to customize aspects of the API or the app's appearance would be useful. For example, if you're using Duo for both VPN access and authentication, you might want a different user interface for each scenario. This way, you can easily identify if someone is impersonating you at the door or accessing your computer. These are some suggestions to enhance the functionality of Duo Security.

Integration with a product such as Microsoft Sentinel would be great. As the product continually improves, I'm unsure if this feature is available.

We had some trouble with the password reset function. When a user's password is expired, you can prompt them using Cisco AnyConnect — a password management feature — to change their password in the same channel during the login process. We had a lot of trouble configuring that. As a result, we now have a second channel that bypasses Duo to allow them to reset their password.

For this, we needed Cisco support, Duo support, and our network administrator all lined up. It should have just been something that they could have just configured, but they weren't able to do it in the same channel. We had to actually create a second channel. When you do this, people will try to log on and it'll tell them that their password is incorrect. They'll realize that their password is expired because it's been 90 days. Afterward, they'll have to then go back to AnyConnect, change the channel that they're logging into, attempt to log in, get the password prompt, disconnect from the AnyConnect, and then reconnect using the Cisco Duo multifactor authentication — this is extremely complicated.

Still, it's really only a problem for a small subset of users. The ones who ignore the notifications 10 days before saying, "Hey, change your password."  So, it's not as big of a deal as it sounds. Just by having a functional way to do it, it makes it so that if nobody's on staff, the user can reset their own password without having to call us in the middle of the night on a Saturday, because that's the best time for those passwords to expire. 

Also, it would be nice if it was easier to modify the splash screen that comes up when entering your username and password.

The technical engineers in the first line of support should improve their knowledge. We often have to bounce all the cases to different levels.

We use Yubikey for pushing it to the phones. Yubikeys can get expensive because people tend to lose those for some reason. Fifty dollars a device is pretty high.

The reporting feature is somewhat limited. All that you get is the list of times that the user connected. Given that it's only a secondary authentication, it may not be possible to enhance the reporting.

We have had instances where Duo Security stops working on a user's device, which we have fixed by uninstalling and then reinstalling it.

I would like to see some features simplified, such as securing, configuring, and implementing Microsoft Remote Desktop. Other than that, the solution was rock solid throughout my time administering it. 

Password management is difficult for us, especially for users. We would like to go passwordless. If we can go passwordless then you don't have a password manager. 

I am looking at other security features with Duo right now. We're currently looking at the passwordless options. We're looking at VPN displacement options. We're looking at those things right now. We haven't adopted yet. 

I'm not using it as much as I could. So far, it has everything I need. I don't have any requirements or improvements. Everything is working smoothly, and we're happy with it.

The only thing I can think of to improve for tech support is to have a dedicated engineer but then I would get an engineer that has priorities in one area or another and maybe not the scope I need.

I like the fact that when I open a ticket, I'm not getting the same caller calling back. I like the variety of support that Cisco offers.

Opening a technical assistant's request is a little challenging at times. I wish that the Cisco website could understand who I am from the chart and just let me in rather than forcing me to pick out my contract number, my address, or something like that. They should make it streamlined, make it simple.

One of the challenges was for the police force. A lot of them, at first, weren't keen on using their personal cell phone for, quote-unquote, city business. As a city, we require them to download an app for two-factor authentication. There is a little bit of apprehension for some users thinking, well, "How do I know this app is not collecting personal information from my personal device?" was the only obstacle we ran into. Overall, satisfaction is good.

To mitigate this problem, there was an option where the city would choose to just go with utilizing the app. There's another option where you can get a text message as opposed to having to download the app and accept what the app has on it.

It would be nice if there was a biometric option rather where you could accept with a fingerprint. Like, in an iPhone, they have fingerprint authentication and face ID. It would be nice if there was a biometric acceptance as opposed to just clicking and accepting.

From an administrative standpoint, I'd love to see it be a little better at remembering a device and location so that I don't have to continually authenticate. That's pretty much it.

Most of my colleagues from other companies use the Microsoft MFA solution because it's included in Office 365. Few people are considering Cisco Duo. That's the primary problem in our area. It's a solution mostly adopted by Cisco users.

There could be improvements made to the dashboards and more integration with the rest of the Cisco ecosystem. Duo was clearly purchased, and Cisco has a lot of other panels for their Firepower products, et cetera. They need to continue bringing it, Umbrella, and the endpoint pieces even more together and make the integration a little more seamless among all of them.

Duo Security should better organize its tile feature to organize applications better.

It could be a little bit more intuitive when it comes to the sign-up process. I know they send out an email, but sometimes our users get a little confused. It could be an end-user problem, but Cisco could work on that a little.

Duo has some issues that we're trying to work through. For example, if I install it on a WordPress site and another admin needs to log in, they can't because Duo hasn't been set up for them. It doesn't appear that I can add permissions on a user-by-user basis. It's not obvious.  

I would also like to see password-free login. There used to be a password-free product where you used your phone and looked at the screen. I can't remember what it's called now, but it was great. It used blue wavy lines that constantly changed, so nobody could ever screen capture and use them to log in. That was by far the best solution. 

Duo bought them out and did away with them. They probably saw it as a threat because it was a better solution. And a couple of companies have tried to mimic that, but they have never come close. If Duo were to go back to something like that, I would be ecstatic. Passwords are supposed to be a thing of the past.

Previously, we encountered an issue with utilizing the passcode as part of the second factor; however, that has now been transformed into a feature.

I would appreciate it if Duo Security could improve its integrations with Windows Hello.

It's fairly simple. Our end users don't have many issues with it other than getting locked out for administrative purposes, but it's not something to do with Duo Security. There might be a little slowness, but that could be my connection.

Smart Licensing needs improvement. It's terrible. We have problems with it every year and we need to involve support to fix it. 

Our appliances are connected to Cisco Smart Center but they don't get the license. That's our pain point. But then when they work, they work. 

I liked the traditional licensing. We get the license key, pass it, and it works.

We first deployed Duo Security for our company with the VPN, and afterward, about a year later, we implemented it for a customer of ours where we offered infrastructure as a service. When I tried to establish a VPN connection through Duo Security, it did not function well on that version, which was the latest one at the time. So, I had to make a copy of the machine and then implement Duo Security with the VPN because it did not function well with the newer version. I didn't know why, but it did not function. I haven't tried to update it since then, but that could be an area of improvement.

It is not easy to maintain network connectivity.

Duo Security should have more customized use cases. For example, if a client needs to have more customization, it would be better to connect directly with Duo's R&D to try to discuss the issues together in order to add customizations.

For upgrades, there should be a better notification of when they're coming out. We always have a testing phase, so we need to be ahead of it. It takes us longer before we can upgrade to the newest version.

Integration between Duo Security and FTDs needs improvement. Integrating Next Generation Firewall safety with Duo Security currently requires a proxy agent between Active Directory and the appliance. It's an additional factor that we need to think about. It would be great to have direct integration with FTD so that we don't have to worry about middleware products. For the rest of the Cisco Secure solutions, the APIs need improvement.

Duo Security needs to improve the delivery of text messages to the users. This has been a big pain point for us over the years. Though we understand that the local telecoms are the ones responsible for the final delivery of the message, there should be a way to improve the process. Some users don't use the application and rely on SMS messages. It is a problem at times because the messages are not delivered.

I would like to see Duo Security increase the time that the users have to log into the devices. The maximum time interval is 15 minutes at the moment, and I would like it to be 60 minutes.

When you try to log into a device and have to authenticate yourself, sometimes it's not very pleasant. It's not the best thing particularly if you have to do this every 15 minutes, which is the maximum time that Duo gives. This makes it difficult to use and does not save time.

Sometimes, it's a little harder for customers to adopt.

Also, when it comes to the single pane of glass for management, there are some mixed reviews and opinions that say there could be some other options. But those are very unique cases.

The majority of my customers are really good with just the two-factor authentication and don't really take advantage of a lot of the extra bells and whistles that it has. Getting them to adopt more of those features, versus asking for anything new, would probably be where my first step would be.

When you come to the push in Duo Security, there are some integrations where you have to use the code instead of the push functionality. Sometimes, you have to go and push from the app, go to Duo Security, and then go back over after you've accepted the push. It would be good if a seamless web comes down, you press the button at the top, and it goes away while you're still in the app.

It's already good, but there could be more integration. There could be ready-made integration. Other than that, it's a good product. It already integrates with lots of products, but it can integrate with more products. There should be easy integration with Cisco products because sometimes, it can be quite complicated.

We have a 24 hour timer for our Duo cookie and we would like to reduce this to a shorter time when using Duo. We use Duo together with GlobalProtect and I am not sure which solution would be responsible for this improvement. 

The biggest challenge is integrating it into all our end user utilities. We use it for other networks, not just our personal network. So, the challenge is just integrating it across the board.

There is not much improvement as far as the front-facing part of it. For the back-end, there could be a few more security features applied. Obviously, as they grow, it will get better.

I am interested in adding auto-admin services and incorporating icons for easier navigation. This could contribute to a new business idea platform. I have seen the features, and they make things easier, resolving issues from before. The platform has been updated, and there's now another link in my platform for media access.

When it comes to improvements, the UI can be more user-friendly, and there is room for easier navigation. 

There could be enhancements in customization. I haven't had issues with storage or backup, but I am open to improvements in customization functionality. It's not my environment, but I see possibilities for improvement in the deployment of funds.

We have some users that don't prefer to use the app. The product could be more intuitive on the app. We have users that are a little dated in their technology adoption. Telling some of our non-intuitive users to use the app was a little struggle.

The integration has improved recently but it can still be better. 

We were considering purchasing other products, like AMP for Endpoints, and it was not properly integrated with the firewall function. It might be better now with SecureX.

I'd like to see it integrated into other applications. I know there are some integrations, but I haven't been able to explore that any further. 

They can make authentication easier. It should be done in a shorter time. Sometimes, it can take a bit more time to get the answer on your phone. You have to wait a bit longer to get the SMS code and other things. There can be some internet or connection issues. They should make it faster because sometimes, it's urgent, and you need to access something as soon as possible.

I wouldn't mind seeing some options for remembering a device for a short period of time or a specific login, particularly for administrative engineering staff, as we may be logging in to four or five different services. We're having to use it a lot. I understand it, it's just part of it. That's not specific to Duo. That's two-factor authentication in general.

Its documentation must be in French because we are a French-speaking country. They should also provide more training documentation.

Its management interface should also be improved. They should also improve its update period. If I compare its update period with other products such as Palo Alto firewalls, this solution is really slow in updates.

End-users find it more annoying than anything else. It's tough to manage user perception of the service, especially when there isn't feature parity between Mac and Windows users. There are some challenges in making that user experience the same between platforms and helping users feel the least amount of burden possible while helping to ensure the organization's security.

Network connectivity depends on where users are located. Internally, on-premises, it's not hard keeping connectivity, but we have users who move throughout the world, and their levels of connectivity change. It can be a challenge, if someone is in Bahrain, to authenticate via Duo.

One area that might be improved is that setting up SMS texting is not as easy as using the app, even though it does support it.

Also, a faster management user interface would help. It tends to lag a little bit.

The only time I really had some negative feedback for them was about the UI of their mobile app, but they improved it in the last version. There was no way to (re)name 3rd party OTP accounts so it got confusing when multiple ones were existing. In addition, each account took a lot of space on the screen, they condensed it in the new version to make it easier for people that have a lot of accounts added. Duo has a beta program and actively solicits and listens to feedback which personally I think is great.

It is good on the functionality side, but their pricing model is a little bit weird. Currently, there is no price advantage in signing up for yearly contracts. If you are on a monthly term or a yearly contract, you basically pay the same price, and that is very unusual. Normally, there is a discount when someone signs up for the 12-month system.

Duo Security could be improved with the addition of more applications. 

Duo Security has not helped free up our IT department's time.

Technical support could be improved. I don't think all support should have to go through an agreement.

Duo Security could improve by being more compatible with other vendors.

Improving coverage of different solutions and on-premise residents would make a difference. It would help if you could deploy on-premises, and not only with the cloud. Connection with an active directory requires something on-premises and for that, you need to have some kind of client or proxy, or something on-prem but keeping the idea of the users for GDPR and not sending them to the cloud to do it, makes sense.

Removing the need for a password would be a positive change as well as the ability to cover all the different enterprise applications. They don't have coverage for everything. 

Reducing or eliminating the "telephony credits" system used by Duo would be great.  I recognize that they are meant to provide transparency around the cost of using what is supposed to be a limited-use feature set, but I would just rather have the ability to use unlimited telephony and roll that cost into the annual subscription.

I haven't experienced any issues with Duo Security, but I'm only on the front end, I don't see the back end. I don't know what the IT guys are struggling with. From the front end, it's very fast and it hasn't missed a beat, so to say. As soon as I log in, within a second, I receive a message on my mobile, and as soon as I hit okay, that is within a second, then it's already passed on to the database where I need to be. It's lightning-fast, I've never experienced anything like it in the past.

I think that the dashboard needs to be improved.  

Duo Security is a cloud-based product. Most of the security technicians in India that we work with want a security product in-house for their main data center security solution. Because it is possible to integrate Duo Security with cloud-based services, it is good for use with various customers and hybrid architecture. Other features are good, but the only thing is because of compliance, certain customers can not use it as a solution. This is due to compliance with regulations for lots of customers like banks and financial sectors who can not go with cloud products.