What needs improvement with Duo Security?

For the next release, Cisco Duo could be improved by adding touchless authentication and biometric features.

I would love to see improvements around Identity and Access Management with Cisco Duo, specifically how we can use that as a central source of truth for all of our IAM tools, including Active Directory. I would definitely like to see more integration from that for sure. I really want to get more hands-on with IAM for more features within Cisco Duo. I would like to see Cisco Duo fully develop what it would look like as an IAM service. I would love to get involved in that.

We have not really used Cisco Duo for phishing attacks, but we have used other solutions such as Proofpoint and campaigns to phish our own employees to help them learn how not to fall victim to phishing. However, I need to look into Cisco Duo; I had not realized they had an email aspect. I think there may be a feature already, but we have been trying to explore Cisco Duo for the desktop in ways that we could authenticate users on the desktop to access certain applications.

Addressing agentic IAM with the rise of AI agents is quite complex. Many people now utilize agentic AI, and while I believe Cisco Duo’s multi-factor authentication adds a layer of security, I acknowledge that there are sophisticated attacks that could potentially target it. The fact that Cisco Duo encrypts connections and requires user presence enhances its security, but attackers could still try if they're on the same network. I don't see Cisco Duo playing a significant role in managing agentic AI identities at this moment. Currently, in my experience, agentic AI does not integrate well with Cisco Duo, and while I hope Cisco will find solutions for this in the future, I don't believe that capability exists yet. I believe Cisco Duo should integrate with Cisco Cloud Control. Given the wide array of security products Cisco offers, it would be beneficial to consolidate them into one dashboard. Having Cisco Duo integrated into Cloud Control would allow us to access all security functions seamlessly.

The way Cisco Duo can be improved, including features that should be included in the next release, is something I don't know off the top of my head; I would need to go back and look at our customers' wants and what they would like to see implemented.

Cisco Duo can be improved in various ways, but for all we use it for, the way it is works just fine for us, so I do not know what could be improved for our use case.

I would rate my experience with Cisco Duo at around eight out of ten. The experience with customer support and tech support when I first started with Cisco Duo was lacking on some parts where we were having issues. However, over the past close to two years, they have definitely improved overall for support. Not only has the product been very good and we have done fewer support cases, but I think support overall has been very fast.

Cisco Duo can be improved by including some more pieces as far as pattern analysis. If there are questionable logins or questionable attempts, proactive alerting for security teams would be beneficial.

I'm pretty happy with Cisco Duo. However, I know that sometimes integrating it with the Linux environment is a bit of a pain. I would say some Linux usability improvements would be beneficial.

Cisco Duo can be improved by integration into Security Cloud Control, which would be a significant advantage. Better or easier integration with Secure Access is also needed. Additionally, I would benefit from better propagation of identities across all different security platforms so that I can view events based on users rather than IP addresses. It would be helpful to more easily determine the identity of the user that generated network traffic or alerts, as this would be more effective than current methods. Currently, certain elements remain somewhat siloed. For example, FMC logs do not contain Cisco Duo identity information on the way in. When I have an IP address for an event, it is not easily correlated to the user assigned that IP address. I hope that Cisco Duo can help with this, although this could potentially be an improvement on a separate product.

Cisco Duo can be improved, but additional features that should be included in the next release are not my area of responsibility.

I am not certain how Cisco Duo can be improved or what additional features should be included in the next release. I am not certain how Cisco Duo has helped me evolve in my IAM strategy from simple authentication to a more comprehensive identity security platform.

I am not sure how Cisco Duo can be improved. It is working for us. We are a small community with a small network, and I believe it is working the way it is for us.

If I could improve Cisco Duo, I would suggest providing some notification back that the Cisco Duo system was not able to reach the remote device, because I was left in a situation where I did not know if it was actually my cell phone or something was wrong with Cisco Duo.

Cisco Duo is a really good product and I am very happy with it, but sometimes we have to authenticate multiple times, which may be part of our administration. Being able to reduce the number of times that you have to authenticate would be an improvement.

Cisco Duo could definitely be improved, particularly regarding some of the reporting it does, as it currently lacks detail; for example, we had an issue where someone was getting prompted multiple times, but the console only detected it that one time. Cisco Duo has improved the security side of things by adding that additional layer, although it probably slowed operations down a little since we have to enter a token every time we log in, but the peace of mind definitely outweighs the inconvenience.

The UI of Cisco Duo could improve somewhat. It is a little dated, but otherwise, the functionality is excellent. I do not see much more room for improvement, especially now with how it integrates with tokens. It is excellent.

In terms of how Cisco Duo can be improved, I do not have any issues off the top of my head. I have not faced an issue in a couple of years with Cisco Duo at all.

Cisco Duo is doing exactly what we need it to do, so I cannot really give a suggestion for areas that could be improved since we do not use everything that it currently offers.

I think Cisco Duo can be improved. Perhaps making it cheaper would be an improvement. Pricing is always a consideration.

I think Cisco Duo can be improved by integrating it more with developer tools; there is not a lot in terms of developer tooling with respect to authenticating to command line toolsets.

I am very comfortable with Cisco Duo for the next release.

I don't use Cisco Duo's adaptive authentication feature, and I don't know what that is. I really need something that works with RADIUS and TACACS+, and ICE in general, which should be a little bit easier to integrate for admin, especially for elevated access beyond just clients and end users. I know that Cisco Duo is pretty expensive; we have affiliates that use the Microsoft product just because Cisco Duo is so expensive, and they don't want to pay for it.

I think Cisco Duo could improve the dashboard to make logging in and credential management more visible. I have noticed that when you are offline, you can log in straight without using Cisco Duo, while online it requires Duo, which some users may exploit, allowing for logins without an internet connection.

Cisco Duo can be improved by integrating into TAC more. We recently had an issue with an edge firewall. VPN was part of that, and part of our VPN is Cisco Duo. If an edge firewall use case goes down and support needs to be called in for the firewall, we're going to call Cisco TAC. For Cisco Duo, we actually have to contact a separate support to get the same level of engineering support.

I'm not entirely certain about areas for improvement. When we met our rep last week, they showed us a whole bunch of different things that I didn't know we had access to. I think there is a broader scope for Cisco Duo, but we haven't actually explored it.

Cisco Duo could be improved by making it available on Microsoft Azure. I would rate Cisco Duo seven out of ten because of the issues I have already mentioned. The Cisco firewall is a bit slow, and I am uncertain whether they have a mobile pass feature in Cisco Duo. I think a mobile pass feature should be an alternative option nowadays in case there are any issues in the telecom sector.

I believe Cisco Duo needs to be improved on the delay process because there is a delay when we send a Duo Push or when we are signing into any applications. We can work on making it faster and speed this up. That's the part we need to work on, and on the outages, instances where we face issues with Cisco Duo and they are disabled, and systems are not working. While the user interface of Cisco Duo is good and does not need to improve as it is quite user friendly, we do need to improve on the API because that is causing a delay in the process of revoking the tokens. The tokens are being sent a little late. Sometimes it has happened with me on multiple clients.

The primary issue is adoption. When I used to work for Deloitte, I did consulting and advisory for at least 95 of the 100 Fortune 100 companies. The number of enterprises using Cisco Duo was considerably lower and definitely not at the median. There are other tools that integrate better or whose integrations are not dependent upon SaaS vendors and SaaS applications. This could be related to how the product is positioned or how other companies are doing better with their sales. If a product is not being adopted by a very large footprint of enterprises, you need to start asking questions. Cisco Duo is definitely not doing things that others are not doing, so there is no unique selling proposition. It is definitely doing all the things that others are doing, but the adoption for other vendors is definitely better. I would compare Cisco Duo to Okta and to some extent Azure Entra ID, because Azure Entra ID has picked up very well with conditional access policies and Identity and Access Governance. Azure Entra ID also has integrations with SailPoint, which Cisco Duo does in full transparency. The issue is that Cisco Duo is not being adopted by a very large set of enterprises.

I have not had the chance to rate Cisco Duo's support because I pass my documentation to the group responsible for creating tickets, as being a contractor, I don't have the account permissions to create tickets myself. I document everything with screenshots and pass it along. Based on what I heard regarding their response, Cisco Duo's support is pretty good. They are responsive and accurate in their responses, and they do their homework. This is one thing I now observe as a stark contrast with Oracle, where the support experience is terrible. You need to create a ticket, and then I have to call back and create another ticket just to monitor the first ticket. With no responses on those two, I had to create a third ticket to monitor the second ticket. I created about 33 tickets on this IAM thing because there was an intermediary, Accenture Federal. I created about 33 tickets just to monitor the previous tickets, and no resolution was given. I came up with my own solution. I am not involved with Cisco Duo's pricing, so I am the person where they said, 'We bought this product, go ahead and do your magic.'

The only area I could think of is support for more applications. Cisco Duo already covers a wide range of apps, especially the common ones, but there is always room to add more.

Areas that have room for improvement in Cisco Duo include pricing, as Cisco is quite expensive, and the fact that Cisco Duo relies heavily on external identity providers such as Active Directory or Entra ID and does not offer full identity lifecycle management on its own, which leads organizations to often pair Cisco Duo with another IAM solution for complete identity governance.

One downside of Cisco Duo is the expense, as there are clients that can afford only the basic package, which does not include Geo-fencing, leaving them unable to pay for the more expensive level, which I do not feel justifies the double price of that upper tier version. That is about the only thing I would change, otherwise, it is a wonderful product, and I have interacted with their support quite often with no issues.

Cisco Duo can be improved by allowing a specific support engineer, which would be helpful for many organizations. I need better support for Cisco Duo.

I don't have much detail about the integration of comprehensive identity security into the Duo IAM solution, but my complaint is that it's not as seamless as a product like Zscaler for remote access. It's not as seamless. It's difficult for me to summarize the room for improvement as I'm on the enterprise network side, not really security. My response will be based on user experience, not detailed technical aspects of the network with respect to security. I use ZIA and Zscaler for remote access connection, and Zscaler is seamless. I don't need to do anything; it does the identification of my system. As far as my system is issued by the company, I don't need to do any multi-layer authentication. It authenticates seamlessly. With Cisco Duo, you have to do that, and customers complain about that process. At some point, you need to be technically savvy to understand how to use Cisco Duo.

As support, I do not find it an issue with Cisco Duo product itself; it is more an issue of organization administration. Often, people do not receive expiration messages, and sometimes, for security reasons, accounts get disabled without notifying the end user, so they mistakenly think something has gone wrong when it really just needs to be re-enabled on the external system. It is primarily an issue on the administrative side of the firm I am working for.

It needs to be made more comfortable for the customer and for the system administrator. The GUI environment could be improved. There is another issue with removing the application from your computer. It is difficult to remove the application on Windows. Additionally, if you don't have internet access, you can't access your computer, only local access is available. This is problematic.

I do not think about how Cisco Duo can be improved right now, including additional features or enhancements.

Improving Cisco Duo might involve alerting us about telephony credits when people receive texts. We hit zero at one point, and we were running around in circles without any idea until I discovered it. That's my only complaint. Other than that, I appreciate Duo significantly.

Cisco Duo can be improved with better ways to set users up. Currently, we might not be doing it perfectly as we're having them email in phone numbers to get them set up with Duo Mobile. I wish there was more of a self-service option than there is currently, at least to my understanding of Duo.

I would appreciate seeing Cisco Duo improved with a tighter integration with Active Directory to secure not just Remote Desktop to a server, but all the remote levels of connection that you can make to a server. Other than that, there can be a better way to onboard users who don't want to use a phone, but that's stretching it because we can do a token or order Cisco Duo tokens, or do FIDO keys.

Cisco Duo can be improved by exploring a way to make it a more seamless integration and by deploying an in-house server. There has to be a way to make the whole process of push notifications easier, so that when I have my phone with me, I do not have to do anything. It pushes it to my phone and says, 'Yep, that's Roger,' and sends a reply back. Getting in should be totally seamless.

Cisco Duo could be improved, possibly by adding features for the healthcare space. If you're selling something to a healthcare provider, there needs to be consideration for how to launch Cisco Duo with a handheld device that is not native, where you can install the application.

Cisco Duo is a modern product that does not support older applications, lacking backward compatibility. It should work on supporting legacy applications and legacy approaches.

I found some issues yet do not remember them specifically. There was an project requirement related to facial recognition integration imbedded in duo.

The price of Cisco Duo could be better.

The product price needs improvement.

I am interested in adding auto-admin services and incorporating icons for easier navigation. This could contribute to a new business idea platform. I have seen the features, and they make things easier, resolving issues from before. The platform has been updated, and there's now another link in my platform for media access. When it comes to improvements, the UI can be more user-friendly, and there is room for easier navigation. There could be enhancements in customization. I haven't had issues with storage or backup, but I am open to improvements in customization functionality. It's not my environment, but I see possibilities for improvement in the deployment of funds.

Password management is difficult for us, especially for users. We would like to go passwordless. If we can go passwordless then you don't have a password manager. I am looking at other security features with Duo right now. We're currently looking at the passwordless options. We're looking at VPN displacement options. We're looking at those things right now. We haven't adopted yet.

The only thing I can think of to improve for tech support is to have a dedicated engineer but then I would get an engineer that has priorities in one area or another and maybe not the scope I need. I like the fact that when I open a ticket, I'm not getting the same caller calling back. I like the variety of support that Cisco offers. Opening a technical assistant's request is a little challenging at times. I wish that the Cisco website could understand who I am from the chart and just let me in rather than forcing me to pick out my contract number, my address, or something like that. They should make it streamlined, make it simple.

From an administrative standpoint, I'd love to see it be a little better at remembering a device and location so that I don't have to continually authenticate. That's pretty much it.

I'd like to see it integrated into other applications. I know there are some integrations, but I haven't been able to explore that any further.

For upgrades, there should be a better notification of when they're coming out. We always have a testing phase, so we need to be ahead of it. It takes us longer before we can upgrade to the newest version.

I have a few suggestions for improving Duo Security. One major aspect would be the ability to gather contextual data. This means being able to determine the location where someone is authenticating from and whether it aligns with their regular location patterns. While two-factor authentication with mobile devices provides a high level of security, it's still not foolproof, as someone could potentially steal your phone. It would be beneficial to have information about the authentication location. If a partner could obtain that data, we could implement it, or if we had our own application, we could incorporate this feature. Additionally, having the ability to customize aspects of the API or the app's appearance would be useful. For example, if you're using Duo for both VPN access and authentication, you might want a different user interface for each scenario. This way, you can easily identify if someone is impersonating you at the door or accessing your computer. These are some suggestions to enhance the functionality of Duo Security.

There is always room for improvement. Duo Security is a great product in its current state. However, Cisco can further enhance the integrations, as they possess exceptional integrations with various providers' products and feature sets. They should continue to improve and expand these integrations to include more products. The more integrations they offer, the more advantageous it becomes for us as a Cisco partner to promote and sell their product.

The technical engineers in the first line of support should improve their knowledge. We often have to bounce all the cases to different levels.

Duo Security should better organize its tile feature to organize applications better.

We use Yubikey for pushing it to the phones. Yubikeys can get expensive because people tend to lose those for some reason. Fifty dollars a device is pretty high.

When you come to the push in Duo Security, there are some integrations where you have to use the code instead of the push functionality. Sometimes, you have to go and push from the app, go to Duo Security, and then go back over after you've accepted the push. It would be good if a seamless web comes down, you press the button at the top, and it goes away while you're still in the app.

Integration between Duo Security and FTDs needs improvement. Integrating Next Generation Firewall safety with Duo Security currently requires a proxy agent between Active Directory and the appliance. It's an additional factor that we need to think about. It would be great to have direct integration with FTD so that we don't have to worry about middleware products. For the rest of the Cisco Secure solutions, the APIs need improvement. Duo Security needs to improve the delivery of text messages to the users. This has been a big pain point for us over the years. Though we understand that the local telecoms are the ones responsible for the final delivery of the message, there should be a way to improve the process. Some users don't use the application and rely on SMS messages. It is a problem at times because the messages are not delivered.

Duo Security could be improved with the addition of more applications. Duo Security has not helped free up our IT department's time.

They could just continue to add more integrations.

We found it difficult to integrate it into our broader product family of Microsoft tools and other applications used across our organization. So, we have pulled back from this solution a little bit. It was easier to use Microsoft MFA, which integrated with everything and still did the two-factor authentication that we needed. There is nothing wrong with the product, as far as its functionality. It was just the breadth of support. It got harder and harder to integrate. For what it does, it is fantastic. Once we started hitting Microsoft Office stacks, we then began to find its limitations. It is not so good for securing access to our application and network. We found it harder to integrate, particularly with the Office stack, which is our primary application stack. We did get it working with a few other cloud applications that we were working with as part of our single sign-on story. However, it certainly wasn't easy to integrate in-house. It created another step for users who don't know about the benefits, as far as the corporate benefits. I wouldn't consider having another app on their phones and having another thing to deal with a positive for our user community.

I wouldn't mind seeing some options for remembering a device for a short period of time or a specific login, particularly for administrative engineering staff, as we may be logging in to four or five different services. We're having to use it a lot. I understand it, it's just part of it. That's not specific to Duo. That's two-factor authentication in general.

More automation and device insights would be helpful in achieving a seamless single pane of glass. Having the additional capability to streamline processes would also make things better.

End-users find it more annoying than anything else. It's tough to manage user perception of the service, especially when there isn't feature parity between Mac and Windows users. There are some challenges in making that user experience the same between platforms and helping users feel the least amount of burden possible while helping to ensure the organization's security. Network connectivity depends on where users are located. Internally, on-premises, it's not hard keeping connectivity, but we have users who move throughout the world, and their levels of connectivity change. It can be a challenge, if someone is in Bahrain, to authenticate via Duo.

It could be a little bit more intuitive when it comes to the sign-up process. I know they send out an email, but sometimes our users get a little confused. It could be an end-user problem, but Cisco could work on that a little.

Duo has some issues that we're trying to work through. For example, if I install it on a WordPress site and another admin needs to log in, they can't because Duo hasn't been set up for them. It doesn't appear that I can add permissions on a user-by-user basis. It's not obvious. I would also like to see password-free login. There used to be a password-free product where you used your phone and looked at the screen. I can't remember what it's called now, but it was great. It used blue wavy lines that constantly changed, so nobody could ever screen capture and use them to log in. That was by far the best solution. Duo bought them out and did away with them. They probably saw it as a threat because it was a better solution. And a couple of companies have tried to mimic that, but they have never come close. If Duo were to go back to something like that, I would be ecstatic. Passwords are supposed to be a thing of the past.

Duo Security could improve by being more compatible with other vendors.

We had some trouble with the password reset function. When a user's password is expired, you can prompt them using Cisco AnyConnect — a password management feature — to change their password in the same channel during the login process. We had a lot of trouble configuring that. As a result, we now have a second channel that bypasses Duo to allow them to reset their password. For this, we needed Cisco support, Duo support, and our network administrator all lined up. It should have just been something that they could have just configured, but they weren't able to do it in the same channel. We had to actually create a second channel. When you do this, people will try to log on and it'll tell them that their password is incorrect. They'll realize that their password is expired because it's been 90 days. Afterward, they'll have to then go back to AnyConnect, change the channel that they're logging into, attempt to log in, get the password prompt, disconnect from the AnyConnect, and then reconnect using the Cisco Duo multifactor authentication — this is extremely complicated. Still, it's really only a problem for a small subset of users. The ones who ignore the notifications 10 days before saying, "Hey, change your password." So, it's not as big of a deal as it sounds. Just by having a functional way to do it, it makes it so that if nobody's on staff, the user can reset their own password without having to call us in the middle of the night on a Saturday, because that's the best time for those passwords to expire. Also, it would be nice if it was easier to modify the splash screen that comes up when entering your username and password.

The only time I really had some negative feedback for them was about the UI of their mobile app, but they improved it in the last version. There was no way to (re)name 3rd party OTP accounts so it got confusing when multiple ones were existing. In addition, each account took a lot of space on the screen, they condensed it in the new version to make it easier for people that have a lot of accounts added. Duo has a beta program and actively solicits and listens to feedback which personally I think is great. It is good on the functionality side, but their pricing model is a little bit weird. Currently, there is no price advantage in signing up for yearly contracts. If you are on a monthly term or a yearly contract, you basically pay the same price, and that is very unusual. Normally, there is a discount when someone signs up for the 12-month system.

Its documentation must be in French because we are a French-speaking country. They should also provide more training documentation. Its management interface should also be improved. They should also improve its update period. If I compare its update period with other products such as Palo Alto firewalls, this solution is really slow in updates.

I haven't experienced any issues with Duo Security, but I'm only on the front end, I don't see the back end. I don't know what the IT guys are struggling with. From the front end, it's very fast and it hasn't missed a beat, so to say. As soon as I log in, within a second, I receive a message on my mobile, and as soon as I hit okay, that is within a second, then it's already passed on to the database where I need to be. It's lightning-fast, I've never experienced anything like it in the past.

I think that the dashboard needs to be improved. Duo Security is a cloud-based product. Most of the security technicians in India that we work with want a security product in-house for their main data center security solution. Because it is possible to integrate Duo Security with cloud-based services, it is good for use with various customers and hybrid architecture. Other features are good, but the only thing is because of compliance, certain customers can not use it as a solution. This is due to compliance with regulations for lots of customers like banks and financial sectors who can not go with cloud products.

Improving coverage of different solutions and on-premise residents would make a difference. It would help if you could deploy on-premises, and not only with the cloud. Connection with an active directory requires something on-premises and for that, you need to have some kind of client or proxy, or something on-prem but keeping the idea of the users for GDPR and not sending them to the cloud to do it, makes sense. Removing the need for a password would be a positive change as well as the ability to cover all the different enterprise applications. They don't have coverage for everything.

Reducing or eliminating the "telephony credits" system used by Duo would be great. I recognize that they are meant to provide transparency around the cost of using what is supposed to be a limited-use feature set, but I would just rather have the ability to use unlimited telephony and roll that cost into the annual subscription.