Only four features force you into Cisco Secure Client Premier, and Cisco explicitly permits mixing Premier with Advantage on a per-user basis in the same environment
Cisco's own ordering guide limits the Premier delta to posture assessment, the Network Visibility Module, next-generation VPN encryption (Suite B), and the Management VPN Tunnel. Everything else, including per-app VPN, third-party IKEv2 headend support, FIPS, the 802.1X supplicant, and the Umbrella Roaming module, sits in Advantage. If fewer than 100 percent of your unique users need those four capabilities, a blanket Premier buy is over-purchase you can unwind at the next term.
Prepared by Redress Compliance · September 4, 2026 · Cisco advisory. Secure Client and AnyConnect renewal engagements, 2024 to 2026.
Executive summary
The Premier premium buys exactly four capability groups, and Cisco documents them in a single paragraph of the Secure Client Ordering Guide: endpoint posture (Secure Firewall Posture or ISE Posture), the Network Visibility Module, next-generation VPN encryption including Suite B.
And the Management VPN Tunnel.
Every other module a typical remote-access deployment touches, including device and per-application VPN, trusted network detection, FIPS compliance, the Network Access Manager 802.1X supplicant, and Umbrella Roaming, is already inside Advantage.
So the tier decision reduces to a four-item checklist rather than a broad security posture debate.
Cisco states in the Features, Licenses and OSs guide for Release 5.x that Advantage and Premier can be mixed in the same environment and that only one license is required per user, which makes a split buy contractually clean rather than a grey-area optimization.
Because Premier is a functional superset of Advantage, the two quantities are independent, and in practice we see posture and NVM needed by 15 to 40 percent of the user base, not 100 percent, in estates outside regulated healthcare and defense.
Licensing counts unique or authorized users, not concurrent sessions, so the single most common sizing error is buying against peak VPN concurrency and then discovering the entitlement is short by the full headcount difference.
The one exception is the VPN Only SKU, which is concurrent-endpoint based, applied per individual ASA, non-portable, and explicitly incompatible with Plus and Apex, which makes it usable only in Cisco's own example profile of roughly 10,000 potential users with about 100 active at once.
Premier does not close the bill on posture: deploying the client from an ISE headend and running the ISE Posture module requires a Cisco ISE Premier License on the ISE Administration node, a second line item that turns a tier upgrade into a two-product commitment.
Buyers who model only the Secure Client per-user delta routinely under-forecast the posture path by the entire ISE Premier stack, and that omission is what turns a defensible upgrade into a budget overrun at true-up.
How the two tiers map to Plus, Essentials, Apex and Premium
The rebrand is not a repackage. Cisco's Secure Client Ordering Guide states plainly that Advantage is similar to the previous AnyConnect Plus and Essentials licenses, and that Premier is similar to the previous Apex, Premium and Premium Shared licenses.
Cisco's own contract paperwork repeats it: the Security Portfolio buying program offer description lists "Secure Client Premier is formerly named AnyConnect Apex." This is not just sales collateral, either.
The Release Notes for Cisco Secure Client, Release 5 record that the Apex and Plus licenses were changed to Premier and Advantage.
The practical consequence for a buyer sitting on legacy paper is that your existing entitlement position transfers rather than resets, and Cisco explicitly permits stacking of Advantage and Premier licenses and terms with valid AnyConnect Plus and Apex licenses and terms.
That matters at renewal, because a reseller quoting you a clean-sheet Premier count is ignoring entitlement you already own. If you are still working through the transition mechanics, our Cisco Secure Client migration and licensing guide covers the March 2027 AnyConnect deadline in detail.
| SKU family | Legacy name | Metric | Terms | Support treatment | Premier-only features |
|---|---|---|---|---|---|
| Secure Client Advantage subscription | AnyConnect Plus subscription (Essentials functionality) | Unique or authorized users | 12 to 60 months (1, 3, 5 year in CCW) | Application support and upgrades bundled | None. Includes per-app VPN, third-party IKEv2 headend, FIPS, 802.1X supplicant, Umbrella Roaming |
| Secure Client Advantage perpetual | AnyConnect Plus perpetual | Unique or authorized users | Perpetual | SWSS subscription must be bought separately | Same as above |
| Secure Client Premier subscription | AnyConnect Apex, Premium, Premium Shared | Unique or authorized users | 12 to 60 months | Application support and upgrades bundled | Posture (Secure Firewall Posture and ISE Posture), Network Visibility Module, next-generation encryption including Suite B, Management VPN Tunnel |
| Secure Client VPN Only perpetual | AnyConnect VPN Only perpetual | Concurrent connections, per individual ASA | Perpetual | SWSS separate | Cannot be combined with Plus or Apex; not portable |
The mapping table cannot show you the thing that decides the deal: Advantage is far broader than most buyers assume.
Device and per-application VPN, third-party IKEv2 remote-access VPN headend support, trusted network detection, basic device context collection, FIPS compliance, the Network Access Manager 802.1X supplicant, and the Umbrella Roaming module all sit in Advantage.
Buyers routinely upgrade the whole population to Premier because someone in the room said "we need FIPS" or "we run 802.1X wired." Neither is a Premier trigger.
Note also the metric asymmetry in row four. VPN Only is concurrent-endpoint based and tied to an individual ASA, while Advantage and Premier count unique or authorized users and need no license server and no per-headend concurrent-connection entitlement.
Those are different accounting universes, and a quote that mixes them is a quote you should send back for a rebuild.
The four features that actually force Premier, and who needs them
Take the triggers in order of how often they actually appear in a renewal. Posture is first by a wide margin. If you enforce endpoint compliance before granting network access, whether through Secure Firewall Posture or ISE Posture, that population needs Premier.
It also carries a second bill most buyers do not model: Cisco's AnyConnect 4.10 release notes state that deploying the client from an ISE headend and using the ISE Posture module requires a Cisco ISE Premier License on the ISE Administration node.
Budget both lines or the posture business case is wrong before you start.
The Network Visibility Module is second. NVM collects endpoint application-usage telemetry for administrators. It is a genuine Premier feature, and it is also the one most often switched on for a security-operations pilot that never scaled past a few hundred endpoints.
Ask who consumes the flow data today and how many endpoints actually report. Next-generation VPN encryption, including Suite B, is third, and in our experience it is driven by a specific federal, defense, or regulated-contract obligation rather than a general policy preference.
Note that FIPS compliance is in Advantage; Suite B is not the same requirement, and the two get conflated in requirements documents constantly. The Management VPN Tunnel is fourth, and it usually attaches to a narrow, always-on managed-laptop fleet, not the general remote-access population.
Run a per-population test rather than a per-feature one.
For each user group, ask: does this group hit a posture-enforced access policy, does NVM telemetry from this group get consumed, does this group have a contractual Suite B obligation, and does this group need machine-context tunneling before user logon? Four yes/no answers per group.
And the Premier count falls out.
Groups with four noes belong on Advantage, and Cisco's licensing documentation says the Advantage and Premier quantities are independent of each other. Bring that segmentation to the table before your reseller does, alongside the leverage points in our Cisco Secure licensing negotiation playbook.
Cut your Cisco Secure licensing cost in 2026
How to cut Cisco Secure licensing cost in 2026 across Umbrella, Secure Endpoint, Duo, and XDR, with the bundle and contract levers that hold at renewal.
Get the white paper →Why blanket Premier is the default outcome, and how the mixed-tier buy breaks it
In 25 years of negotiating Cisco remote-access paper, I have almost never seen a blanket Premier order that was driven by a technical requirements document. It is driven by procurement ergonomics. A single number, 8,400 users at Premier, survives an internal review meeting without a fight.
A split, 6,900 Advantage plus 1,500 Premier, invites three questions the network team cannot answer on the spot: who is in the 1,500, what happens when someone moves out of it, and who owns the list next year. The path of least resistance is one line item, and Cisco's account teams know it.
The uplift is not sold as function, it is sold as insurance against a future posture project, and insurance is an easy thing to say yes to when the delta is buried inside a larger security portfolio commitment.
The second driver is the posture pilot.
Someone stands up Secure Firewall Posture or ISE Posture for a contractor population or a regulated business unit, the pilot succeeds, and suddenly nobody wants to be the person who tells a user their laptop cannot connect because the entitlement was scoped to Advantage.
That fear of stranding is disproportionate to the actual failure mode. Cisco's own Features, Licenses and OSs, Release 5.x documentation states plainly that you can mix Advantage and Premier in the same environment and that only one license is required per user.
There is no headend that has to be flipped, no license server to reconfigure, no per-ASA concurrent pool to rebalance. Moving a user from Advantage to Premier is a purchasing event, not an outage.
That permission is worth reading twice, because it is an unusual concession. Most vendors resolve tier ambiguity in their own favor by requiring the highest tier in use to apply to the entire estate, which is exactly how enterprise agreements at Microsoft and Oracle behave.
Cisco did not write that rule here. It also allows stacking of Advantage and Premier terms, including against valid legacy Plus and Apex entitlements, which means an existing Apex population can sit alongside a new Advantage buy without a forced consolidation.
Buyers under-use both provisions almost universally, and the reason is not contractual. It is governance.
The real barrier is entitlement hygiene in the Smart Account. A mixed-tier estate only works if someone can produce, on demand, a defensible list of which named users consume Premier features.
If your Smart Account shows two quantities and your AD shows one population with no attribute distinguishing posture-scoped users from the rest, you have no audit story and no renewal story.
That is a solvable problem, an attribute or a group membership tied to the posture policy, but it requires an owner. Where no owner exists, blanket Premier is the rational hedge, and Cisco is not wrong to price it that way. Where an owner does exist, the split is straightforward to evidence.
The economics only hold if the Premier population is re-measured at each renewal rather than inherited. Posture projects expand, NVM deployments occasionally stall and get switched off, and Management VPN Tunnel use tends to be concentrated in a small managed-device fleet that changes size.
If you set 18 percent Premier in 2024 and carry that ratio forward untouched in 2027, you have simply built a smaller version of the same over-buy.
Instrument the measurement: pull the posture policy scope, the NVM deployment target list, and the Management VPN Tunnel profile assignment, and reconcile those three against your Smart Account quantities twice a year.
Our Secure Client migration and tier guidance covers how to structure that reconciliation before the March 2027 AnyConnect end date compresses your negotiating window.
Treat the mixed buy as the default position and make Cisco argue you out of it. The vendor's own documentation is the strongest evidence you will get in a Secure Client negotiation, and it points the other way from the standard quote.
Sizing mechanics: unique users, stacking, PAKs and the VPN Only trap
The counting rule is the first thing to get right because it changes the number materially. Cisco licenses Secure Client Advantage and Premier on unique or authorized users, not simultaneous connections.
If 12,000 employees are authorized to use the client and 3,000 connect on a typical Tuesday, you buy 12,000, not 3,000.
Buyers who size on concurrency arrive under-licensed and discover it at the worst moment, when FMC or cdFMC blocks an RA VPN deployment because the device lacks entitlement for at least one Secure Client license type.
Conversely, buyers who count devices rather than people over-buy, because one user with a laptop, a phone and a tablet still consumes one license.
Stacking is explicitly permitted across tiers and terms, including against valid legacy Plus and Apex entitlements, so a phased migration does not require a clean-sheet consolidation.
| Mechanic | The rule as Cisco writes it | Where buyers lose money |
|---|---|---|
| Counting metric (Advantage, Premier) | Unique or authorized users, one license per user regardless of device count | Sizing on concurrent sessions, or counting endpoints instead of people |
| Tier mixing | Advantage and Premier may coexist in the same environment | Blanket Premier because no one owns the split list |
| Stacking | Advantage and Premier terms may stack, including with valid Plus and Apex | Retiring usable legacy entitlement early during migration |
| PAK registration | Applies to physical ASAs only, not ASAv, Firepower NGFW running ASA software, routers, ISE or Meraki MX | Chasing PAK registration on headends where it does not apply |
| VPN Only | Concurrent-endpoint metric, applied per individual ASA, non-portable, cannot combine with Plus or Apex | Buying it into a mixed estate as a cheap tail-user tier |
| Support | Bundled on subscription, separate SWSS line on Advantage perpetual and VPN Only | Perpetual quotes compared against subscription without adding SWSS |
The VPN Only row is the one that costs real money in a mixed estate.
It looks attractive because it is priced on concurrency and the concurrency number is always smaller, but it is a different licensing universe: it binds to an individual ASA, it does not move between headends, and Cisco's own documentation states it cannot be used with Apex or Plus.
Drop it into an estate that already runs Advantage or Premier and you have created two incompatible entitlement pools that cannot cover each other during a failover or a headend refresh.
VPN Only exists for one profile, and Cisco's licensing FAQ names it: a university with 10,000 potential users and roughly 100 active at once.
If your ratio of authorized users to peak concurrent sessions is not in that range, and if you terminate on more than one headend, the per-ASA and non-portability constraints will erase the unit-price advantage the first time you rebalance traffic.
Price it as a single-headend, single-purpose instrument or leave it out of the quote entirely, and pressure-test the rest of the structure against our Cisco Secure licensing negotiation playbook before you sign a five-year term.
Pricing bands, term choice and the support line buyers forget
Cisco does not publish list pricing for Secure Client Advantage or Premier, which is the first structural fact to internalize: there is no public reference point to anchor a discount conversation against.
So the reseller quote you receive is the only number in the room unless you build your own benchmark.
Resellers quote in user bands, typically 25 to 99, 100 to 249, 250 to 499 and 500 to 999, crossed with 1, 3 and 5 year terms. That grid is where the negotiation actually lives.
A 245 user requirement quoted in the 100 to 249 band and a 255 user requirement quoted in the 250 to 499 band can produce a lower total for the larger quantity, because the per-user rate steps down at the boundary.
In our experience across Cisco security renewals, buyers sitting within roughly 10 seats of a band edge should always price both sides of the boundary before signing, and should ask the reseller to show the per-user rate, not just the extended total.
The street-implied perpetual figure we see referenced most often is around $27 per user for Advantage perpetual. Treat that as a street data point, not a Cisco list price, and use it only as a sanity check on quoted subscription economics over a 3 or 5 year horizon.
The support asymmetry is the line most buyers miss entirely. Subscription licenses (Advantage and Premier, 12 to 60 months) bundle software application support and upgrades in the subscription fee.
Advantage perpetual and VPN Only do not: a separate SWSS subscription must be purchased alongside them, and that recurring line is easy to omit from a perpetual versus subscription comparison, which then flatters the perpetual option.
Separately again, support agreements for the headend termination devices, Secure Firewall and ISE, are their own purchase and are not covered by any Secure Client entitlement. Three support lines, three different owners inside most organizations, and no single quote that shows them together.
The band structure and the support split interact in a way no quote line reveals.
A 5 year Premier subscription at a 250 to 499 band rate looks expensive next to Advantage perpetual until you add mandatory SWSS across five years to the perpetual side, at which point the gap narrows sharply and the perpetual option loses its upgrade rights advantage.
Model both over the same term, with SWSS included, before the tier decision is even discussed.
Ask for the band grid in writing. Then split the population: Premier only for the users who need the four Premier features, Advantage for everyone else, and price each count against its own band.
Two smaller quantities can land in worse bands than one large one, so run the blended-versus-split comparison rather than assuming the mixed buy always wins.
The Cisco Secure licensing negotiation playbook for 2026 covers how to hold band pricing across a multi-year term when your user count grows mid-contract.
Evidence base: what we see in Secure Client renewals
The posture, NVM, Suite B and Management VPN Tunnel delta is what separates the tiers; most renewals we review show adoption of one, on a subset of users.
Per-app VPN, third-party IKEv2 headend support, FIPS, the 802.1X supplicant and Umbrella Roaming all sit in Advantage, yet these are the reasons buyers most often cite for buying Premier.
The patterns repeat with unusual consistency. First, over-scoped Premier counts traced back to a posture pilot: security ran ISE Posture against a few hundred endpoints, the pilot never went estate-wide, and the next renewal quoted Premier for the full unique user population anyway.
Second, concurrency-based sizing carried over from the ASA era, where the count was built on simultaneous sessions rather than the unique or authorized users Cisco actually licenses on, which distorts the number in both directions.
Third, VPN Only entitlements orphaned on decommissioned physical ASAs, still on the renewal because nobody mapped them to a live headend and because VPN Only is applied per individual ASA and is not portable.
Fourth, PAK stacks registered against headends that never required them, since PAK registration applies only to physical ASAs and not to ASAv, Firepower NGFW running ASA software, routers, ISE or Meraki MX.
Enforcement is real but narrow, and buyers should understand where it bites.
At the FMC and CDO layer, RA VPN configuration cannot be deployed unless the device holds entitlement for at least one Secure Client license type, the license must be shared with the Smart Account, and export-controlled strong encryption features must be enabled.
Expired or out-of-compliance entitlements raise licensing alerts and health events. None of that enforces the Advantage versus Premier split at the tier level, which is precisely why over-purchase persists unchallenged.
Pair a feature-use audit with the tier mapping in the Cisco Secure Client migration licensing guide before you accept a renewal quantity.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
Your first five moves
- Build the four-feature checklist against named user groups, not the whole estate, because only posture assessment, the Network Visibility Module, next-generation VPN encryption (Suite B), and the Management VPN Tunnel force Premier, and every other capability you care about (per-app VPN, third-party IKEv2 headends, FIPS, the 802.1X supplicant, Umbrella Roaming) is already in Advantage.
- Pull unique-user counts from the Smart Account and HR headcount, never from concurrency dashboards, since Cisco licenses unique or authorized users rather than simultaneous sessions, and a peak-concurrency number will either understate your obligation or, more often in our experience, be quietly inflated into a full-estate Premier quantity by the account team.
- Demand a mixed Advantage plus Premier quote alongside the blanket Premier quote in the same Cisco Commerce Workspace transaction, because Cisco's own documentation confirms you can mix tiers in one environment with one license per user, and the Advantage quantity may legitimately be larger or smaller than the Premier quantity.
- Test band boundaries and term length against the ISE Premier dependency before you sign, as reseller pricing moves in user bands (25 to 99, 100 to 249, 250 to 499, 500 to 999) crossed with 1, 3, and 5 year terms, and any ISE Posture deployment carries a separate Cisco ISE Premier license on the administration node that belongs in the same business case (see the Cisco Secure licensing negotiation playbook for 2026).
- Write a re-measurement clause and an internal review date into the contract file now, ideally a true-forward-only provision plus a calendar entry 9 months before expiry, so Premier counts get retested against actual posture and NVM adoption rather than rolled forward untouched.
The five moves only work in that order. Counting first and scoping features second is how blanket Premier gets rebuilt: once a single quantity is in the quote, the burden shifts to you to prove why a user should be cheaper.
Scope first, and the burden sits with Cisco to prove why a user needs posture or NVM. Stacking rights matter here.
Cisco permits stacking Advantage and Premier terms, including with valid legacy Plus and Apex entitlements, so you can layer a smaller Premier tranche onto an existing base rather than replatform the whole estate at renewal.
Confirm your migration and tier position before the March 2027 AnyConnect deadline compresses your leverage.
Frequently asked questions
Is Secure Client Premier the same as AnyConnect Apex?
Effectively yes. Cisco's Buying Program Offer Description for the Security Portfolio states that Secure Client Premier is formerly named AnyConnect Apex, and the Secure Client Release 5 release notes confirm the Apex and Plus licenses were changed to Premier and Advantage.
The ordering guide adds that Premier is similar to the previous Apex, Premium and Premium Shared licenses, so shared-license customers consolidate into Premier as well.
Can we run Advantage and Premier licenses in the same environment?
Yes, and Cisco documents it. The Secure Client Features, Licenses and OSs guide for Release 5.x states you can mix Advantage and Premier licenses and that only one license is required per user.
Because Premier is a superset of Advantage, the two quantities are independent, so you can hold, for example, 900 Advantage and 200 Premier without any contractual issue.
Do we count concurrent VPN sessions or total users?
Total unique or authorized users who will use Secure Client, not simultaneous connections. This is the single most common sizing error, because buyers carry over concurrency thinking from older ASA-era licensing.
The only concurrent-based option is VPN Only, which is applied per individual ASA, is not portable, and cannot be combined with Plus or Apex.
What exactly does Premier add over Advantage?
Four capability groups per Cisco's ordering guide: endpoint posture (Secure Firewall Posture, or ISE Posture with Cisco ISE), the Network Visibility Module, next-generation VPN encryption including Suite B, and the Management VPN Tunnel.
Everything else in Advantage carries forward, including device and per-application VPN, third-party IKEv2 remote-access headend support, trusted network detection, FIPS compliance, the Network Access Manager 802.1X supplicant, and the Umbrella Roaming module.
Does buying Premier cover ISE Posture completely?
No. Cisco's AnyConnect 4.10 release notes state that to deploy the client from an ISE headend and use the ISE Posture module, a Cisco ISE Premier License is required on the ISE Administration node.
That is a separate product entitlement with its own cost, so any business case built only on the Secure Client per-user delta will understate the posture path.
When does VPN Only actually make sense?
Only in Cisco's own stated profile: a very large potential user population with very infrequent use, such as a university with 10,000 students but roughly 100 connected at once.
It is concurrent-endpoint based, tied to an individual ASA, not portable between devices, and explicitly incompatible with Plus and Apex, which makes it unusable in most mixed enterprise estates.
How does reseller banding affect our per-user price?
Cisco does not publish list pricing for Advantage and Premier, and resellers quote in user bands, typically 25-99, 100-249, 250-499 and 500-999, crossed with 1, 3 or 5 year terms, with a 25-user minimum at the bottom band.
Cisco's ordering guide notes that reseller orders may need to be based on the banding SKU for your specific duration and user count, so a single extra seat over a boundary can change the per-user rate. Always price at least two adjacent bands and two term lengths before signing.
