Cisco security licensing guide for 2026. Smart accounts, suites and true forward.

Cisco security licensing runs on Smart accounts, suite tiers and Enterprise Agreements. True forward bills any growth above entitlement at the next anniversary, so the count you prepare before renewal decides most of the price.

How does Cisco security licensing work in 2026?

Cisco security licensing has three layers. A Smart account holds what you own, each product counts its own metric (users for Duo and the security suites, endpoints for Secure Endpoint bought alone), and the buying path sets the price: point SKUs, a security suite, or a Cisco Enterprise Agreement.

Cisco Smart Licensing is a cloud portal that pools your entitlements and meters consumption against them. It replaced the old device locked PAK keys, and Cisco documents the model on its Smart Licensing page. If you still carry PAK licenses, our note on PAK to Smart Licensing migration risks covers the conversion.

Why does Cisco read your Smart account before you do?

The portal is also Cisco's audit instrument. Account teams read your Smart account before every renewal conversation, so the gap between what you bought and what you run is known to Cisco before you walk into the room.

On an Enterprise Agreement, Cisco names the Enterprise Agreement Workspace (EAWS) as its most accurate view of consumption. Cloud products such as Duo and Secure Access count users in their own consoles, so Cisco's number may differ from your team's. Our note on CSSM telemetry and renewal risk explains where the figures come from.

What should you check in the Smart account before renewal?

• Consumption against entitlement. Any product running above entitlement is a pending true forward charge. Price it before Cisco does.
• Dormant entitlements. Licenses with zero consumption are your cut list. Note the contract they sit under, because they can only come off at renewal.
• Expiry stagger. Scattered end dates across Duo, firewall subscriptions and endpoint licenses give Cisco several small deals to close. Co terminate them into one negotiation event.
• Virtual account hygiene. Licenses parked in the wrong virtual account look unused in one place and short in another. Move them before anyone builds a quote on the totals.

When do Cisco security suites beat point product SKUs?

Suites win when you will deploy at least two thirds of the bundle within the term. Below that, point SKUs are usually cheaper. Cisco's security portfolio page groups the offers into User, Breach and Cloud Protection suites, and a suite lists 15 to 25 percent below the sum of its point SKUs.

What is inside each Cisco security suite?

The contents change by tier, and that is where overbuying starts. Cisco's current suite packaging looks like this:

• User Protection Suite. Essentials bundles Secure Access Essentials, Duo Advantage and Secure Email Threat Defense. Advantage upgrades Secure Access and adds Secure Endpoint Advantage and ISE Premier.
• Breach Protection Suite. Essentials covers Cisco XDR Essentials, Secure Email Threat Defense and Secure Endpoint Advantage. Advantage upgrades to XDR Advantage and Secure Endpoint Premier, and adds Secure Network Analytics and Cisco Telemetry Broker. Premier adds managed XDR, Talos Incident Response and technical security assessments.
• Cloud Protection Suite. Sold as Essentials Segmentation (Secure Workload SaaS, Isovalent, Hypershield) or Essentials Gateway (Secure Firewall virtual, Multicloud Defense), both managed through Security Cloud Control.

The User Protection Suite is priced per Covered User, meaning any employee, subcontractor or other authorized person your deployment protects. Individual product meters stop applying. Cisco's packaging assumes about 2 endpoints per Covered User for Secure Endpoint, and a ratio well above that on a recurring basis can prompt Cisco to ask for more Covered User licenses.

Secure Access also includes the DNS security Umbrella sells on its own, so check that no standalone Umbrella subscription keeps running beside a new suite.

Worked example: when two thirds deployment is not enough

Treat two thirds as a screening rule, then price what you will switch on. Components are not priced equally, so which two thirds you deploy matters. Say a three product bundle lists at $100 per user per year: product A costs $50, product B $30 and product C $20. The suite is offered at $80, 20 percent below the parts.

All three bottom rows are two thirds deployments by product count. Only one of them breaks even. On 2,000 users over a 3 year term, the A and C case costs $60,000 more than buying the two products separately.

What is the suite trap to avoid?

The trap is paying for breadth you never deploy. A suite priced 20 percent below the sum of its parts is still a loss if half the components stay dormant. Ask the partner for a deployment plan by component and quarter, and price the suite only on the products that plan switches on.

What does true forward mean on a Cisco agreement?

True forward means Cisco bills consumption above entitlement at the next anniversary, going forward, with no retroactive penalty and no refund for underuse. Cisco describes the mechanism in its enterprise agreement buying guidance. It is gentler than an audit, but it only ever works in Cisco's favor.

The charge is prorated for the months left in the suite term. On a full commit suite the unit price cannot exceed your original order price, while a partial commit suite is billed at the current price less your original discount.

• Track quarterly. Review Smart account consumption every quarter, not at anniversary.
• Watch the off cycle triggers. Usage above 105 percent of entitlement in the first six months, or above 115 percent after that, can bring a true forward invoice before the anniversary.
• Negotiate a growth allowance. A contracted overage buffer of 10 to 15 percent absorbs normal drift. EA 3.0 security suites carry a one time 15 percent user based allowance, and only consumption above it is billed. Confirm in writing that it applies to every suite you buy.
• Challenge the count. Stale identities and double counted users inflate consumption data. Ask for the user level export behind any true forward figure.

Worked example: a first anniversary true forward

Say you buy a security suite for 4,000 users on a 3 year EA at a net $60 per user per year. The growth allowance lifts the ceiling to 4,600 users. At the first anniversary, the report shows 4,900.

1. Users above the allowance: 4,900 minus 4,600 gives 300.
2. Months left in the term: 24, so the charge covers 2 years.
3. True forward invoice: 300 users at $60 for 2 years comes to $36,000.
4. After cleanup: if deduplication removes 15 percent of the 4,900, the count drops to 4,165 and there is nothing to bill.

Fast growth also changes when you pay. If the count had crossed the first six month trigger, the same overage would be billed at month 6 for the 30 months left instead of 24.

Can you reduce entitlements at anniversary?

Not mid term on a standard EA. EA 3.0 does not let you scale quantities down during the term, so reductions land at renewal, and the renewal event must carry your full cut list. The one relief is value shift within a suite, where unused licenses are credited against overages in the same suite.

How do you check your own Cisco security consumption?

Pull the counts yourself from the same sources Cisco uses, then reconcile them against your directory. Each console measures a different thing, which is why duplicates build up.

• Cisco Smart Software Manager. The Licenses view in each virtual account lists purchased, in use and balance by license, and exports to a spreadsheet.
• Enterprise Agreement Workspace. On an EA, this is the consumption view Cisco will use at true forward. Save a copy every quarter.
• Duo Admin Panel. The Users page flags users not enrolled, users inactive for the past 30 days, and users waiting in the trash. Each group is a question for your identity team.
• Secure Endpoint console. The computer list shows connectors by last seen date. Retired laptops and rebuilt virtual machines often appear twice.
• Your identity directory and HR headcount. The only independent check on who should count as a user at all.

Duo, Umbrella and Secure Endpoint each count people or devices in their own way. One employee can show up as a Duo user, an Umbrella identity and two Secure Endpoint connectors. Our Umbrella, Duo and XDR licensing guide and the Duo tier and cost breakdown cover each product's metric.

What have we seen in recent Cisco security reviews?

We reviewed roughly 20 to 30 Cisco security environments between 2024 and 2025, and the most common finding was entitlement sprawl. Customers held overlapping per user products bought at different times under different metrics. Three patterns kept coming back:

• Identity overlap. Counting the same person in Duo, Umbrella and Secure Endpoint inflated seat counts by 15 to 25 percent.
• True forward surprises. Roughly 1 in 4 customers who never tracked Smart account consumption were caught out by the anniversary charge.
• Consolidation that worked. Moving point SKUs into a security suite inside an EA cut like for like spend by 15 to 25 percent, and renewals that opened with Smart account data, a rationalized identity count and a competing quote saw savings of the same order.

Why we do not put every security product into the EA by default

The usual reseller advice is to put everything into a Cisco EA because the suite discount always wins. We disagree. In roughly 8 of the 20 plus environments we reviewed in 2024 to 2025, the EA locked buyers into breadth they never deployed, and their price per used product ran 20 to 35 percent above a disciplined point SKU buyer's.

A suite discount saves money only on components you actually run. Rationalize identities and confirm a two thirds deployment plan before signing the EA, because after signature the quantities cannot come down until renewal. Products you are unsure about can stay as point SKUs on their own end dates.

A suite discount only saves money on the products you actually switch on.

How do you negotiate a Cisco security renewal?

Open with three things: your Smart account data, a rationalized identity count and a competing quote. In our reviews those three inputs produced the renewal savings described above.

Cisco's enterprise agreement page describes the EA tiers that price a consolidation. An EA 3.0 that spans security, collaboration and networking reaches the deepest tiers, and our Cisco EA buyer guide covers the EA terms in more detail.

• Rationalize first. Deduplicate identities across Duo, Umbrella and Secure Endpoint before counting seats.
• Bring competing quotes. Microsoft and CrowdStrike quotes change Cisco security pricing even when switching is unlikely.
• Co terminate. One renewal event concentrates your negotiating weight. Scattered dates dilute it.

Cisco's fiscal year ends in late July (fiscal 2026 closed on July 25, 2026), and renewals closing in Cisco's fourth quarter meet the deepest discount authority of the cycle.

What will the Cisco account team say, and how should you answer?

• "The suite is cheaper than what you buy today." Ask for the price per deployed component against your own deployment plan, as in the table above.
• "EA pricing needs an enterprise wide commitment." EA 3.0 opens at $100,000 in total contract value across full commit suites. Once you hold one full commit suite in Networking, Collaboration or Applications Infrastructure, you can add partial commit security suites without a separate minimum or enterprise wide coverage.
• "Your consumption report shows this number." Ask for the user level export and the date it was taken. Refuse to price from a total you cannot trace to names.
• "This price is only good until quarter end." Ask which quarter. Discount authority peaks at Cisco's fiscal year end, so a January or April deadline is usually softer than it sounds.

Which contract terms should you ask for?

• Growth allowance in writing. Name the allowance per suite, so a later partner cannot argue it lapsed.
• True forward price hold. Fix the true forward unit price at the original net discount for the full term.
• A user definition with exclusions. Exclude service accounts, disabled accounts and users gone for more than 30 days from the Covered User count.
• Endpoint ratio. Record the 2 endpoints per user assumption and how Cisco will measure it.
• Renewal cap. Limit the renewal uplift on the same quantities, and state that reductions at renewal carry no penalty.
• Co termination. Pull every security subscription onto the EA end date, with partial term pricing for the stubs.

Cisco EA 3.0 terms run 3 or 5 years. On a 5 year term, every weak clause above costs you for longer, so the terms deserve more time than the headline discount. Our true up and true forward guide covers the anniversary mechanics across the wider EA.

What to do next

1. Export. Pull entitlement and consumption data from your Cisco Smart account, and from EAWS if you are on an EA.
2. Deduplicate. Match Duo users, Umbrella identities and Secure Endpoint connectors to one list of people.
3. Cut. Flag dormant entitlements and build the renewal cut list.
4. Model. Price suites against your real deployment plan, not the bundle sheet.
5. Align. Co terminate scattered end dates into one renewal event.
6. Time it. If your dates allow, move the close into Cisco's fiscal fourth quarter, which runs from late April to late July. Our Cisco security licensing 2026 guide covers what changed this year.

Frequently asked questions