Cisco Secure Access

Overview

Cisco Secure Access is Cisco's security service edge (SSE) platform, launched in 2023. It delivers ZTNA, VPN-as-a-service, secure web gateway, CASB, DLP, firewall-as-a-service with IPS, DNS-layer security, and remote browser isolation from Cisco's cloud under one policy and console. It builds on Cisco's Umbrella cloud security service and uses Cisco Secure Client (the successor to AnyConnect) on Windows, macOS, Linux, iOS, and Android, with browser-based clientless access (including SSH and RDP) for unmanaged devices.

Identity is supplied by the rest of the Cisco portfolio. Cisco bought Duo in 2018 and completed its acquisition of Astrix Security in June 2026, which it is folding into Duo, Secure Access, and Cisco Identity Intelligence for non-human and AI agent identity. The Identity Consolidation Report 2026 tracks both deals.

What they are good at

Breadth under one licence. Per Cisco's data sheet, private access runs over QUIC and MASQUE on mobile, Resource Connectors deploy in AWS, Azure, VMware, or Docker, and VPN-as-a-service covers the legacy apps ZTNA cannot reach, so you can migrate without breaking anything. Secure Access customers get limited-use Duo licenses at no extra cost, which brings MFA and device trust into access policy. ThousandEyes-based Experience Insights is included, and Meraki SD-WAN integrates, which matters for Cisco network shops. A FedRAMP High authorized government edition and a China edition (operated by Digital China Cloud) cover jurisdictions many SSE rivals do not. Newer features target AI use: visibility and control over third-party AI apps, and discovery and short-lived scoped tokens for AI agents (see the Agent Identity Standards Map 2026 for how agent access is being standardized).

Where they fall short

The platform is young and assembled from older Cisco products, and in our reading the packaging takes work to decode: several capabilities are Advantage-only or sold as add-ons. Per the ordering guide, each billing SKU has a 50-user minimum and an order must use one tier across SIA and SPA, which is awkward for small or mixed deployments. Outside the Cisco estate its integration advantage largely disappears, and pure-play ZTNA products are simpler to run. Cisco is not an identity provider here: you still need Okta, Microsoft Entra ID, or similar for SSO.

Pricing

Quote-based through Cisco and partners, per covered user in tiered bands, with Essentials and Advantage packages and optional add-ons. No public list prices; see the Identity Pricing Transparency Index.

Best for, and who should look elsewhere

Choose Cisco Secure Access if you already run Duo, Umbrella, AnyConnect, or Meraki and want to consolidate SSE on one vendor contract. Organizations without that footprint should compare Zscaler, Netskope, and Palo Alto Prisma Access (see Zscaler vs Netskope); small teams wanting only VPN replacement should look at Twingate.

Bottom line

For Cisco customers, Secure Access is the shortest route to SSE: expect a migration project measured in months across web, private access, and policy, not a switch-flip. For everyone else, it is one capable SSE among several, without a decisive reason to choose it.