The Total Economic Impact™ Of Cisco Duo

REDUCED RISK OF A CREDENTIALS-RELATED SECURITY BREACH

Evidence and data. The interviewees said that by deploying Duo, their organizations reduced their risk of a credentials-related security breach. They attributed that risk reduction to Duo capabilities that go beyond the authentication method itself and to the intelligence Duo provided for each authentication, Duo’s extensive capabilities around authentication-related security and security policies, and the ease with which they could consistently and comprehensively apply authentication-related security policies across their organizations.

Specific to the Access version of Duo that all interviewees used, organizations that had a prior authentication solution did not simply change the way their end users authenticated, but also added new capabilities that reduced their risk of a credentials-related security breach. Duo enabled the interviewees’ organizations to better identify systems vulnerable to credential threat attacks (e.g., through context analysis and continuous inspection of the security posture of each device at every access attempt) and implement more granular authentication policies, such as setting up additional detail around who accessed what and how (e.g., restricting access from certain locations or limiting access from noncompliant devices).

A security technical lead at a professional services firm said: “The more data you have, the more things you can detect. We now have better intelligence around each multifactor authentication, and we leverage that. We can detect from where somebody is issuing a multifactor authentication, we can detect which device they are using, and we can detect odd behaviors — things that are not adding up.”

That security technical lead also said: “Even our service desk interactions are more secure now. If somebody contacts our service desk, we have a default procedure where the service desk will send you a Duo push and you must verify that you are you with this multifactor authentication. This wasn’t possible with our prior solution.”

An IT support specialist at an information services company said: “Now, we have a single pane of glass through which we can look at all our protected applications and monitor trends. That saves some time, but more importantly we have new relevant information that we just didn’t have before Duo and Duo has a cool feature that enables us to identify and address vulnerabilities like someone running an out-of-date operating system or using an end-of-life browser or one that needs a patch. While we have other portals that show some of that, Duo shows it all in one place.”

Interviewees partially attributed their reduced risk to other security measures they implemented simultaneous to their Duo deployment, such as better security training of end users, improved security policies and processes, and expanded use of multifactor authentication for a broader set of applications and use cases.

• Modeling and assumptions.

  For the composite organization, Forrester assumes:

  • Organizations experience an average of three security breaches each year.²
  • Thirty percent of security breaches are due to compromised credentials.
  • The estimated cost to remediate a data breach (sized to the number of end users in the composite organization) is $605,274 in Year 1 and increases by 10% each year due to new regulations and other evolving factors.³
  • After deploying Duo, the risk of a credentials-related security breach decreases by 80% in Year 1 and 90% in each of Years 2 and 3.
  • Seventy percent of that reduction is attributable to Duo.

• Risks.

  Reduced risk of a credentials-related security breach will vary based on:

  • The prevalence, nature, and average cost of data breaches in an organization’s industry
  • The volume and type of data breached.
  • The geographic scope of operations.
  • The regulatory and compliance measures an organization is required to follow.
  • An organization’s prior state and maturity level for security operations.
  • The prior authentication software.
  • The extent to which an organization has leveraged Duo’s capabilities.

• Results.

  To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $792,000.

SECURITY ANALYST PRODUCTIVITY IMPROVEMENT

• Evidence and data.

  For security analysts at the interviewees’ organizations, Duo saved time troubleshooting and investigating potential security issues around login attempts. Interviewees attributed these time savings to Duo’s easy navigation, integration with other applications, and capture of detailed information around each authentication attempt.

A cybersecurity analyst at a healthcare organization said: “Duo is a really big help for our 24/7 team because they rely on Duo to help them determine if a user has authenticated or not, if the user is actually in that certain [internet protocol] (IP) region or not, or if the user is in a certain permitted group when it comes to authentication and accessing an application. Duo is one of their primary resources for investigating authentications. Because so much is sitting in Duo and they don’t have to look at many different tools, it’s easy for them to read log activity and determine where the issue lies and then readily articulate that to other teams.”

An IT support specialist at an information services company said: “Before Duo, we had to look at the logs of individual applications to verify what was going on. Duo saves a lot of time compared to that, because we can look at all our protected applications within a single pane of glass and see when an employee accesses something, how long they were there, and what they were doing there.”

A security technical lead at a professional services firm said their security analysts saved investigation time because of the ease (via APIs) of pulling Duo logs into the organization’s security information and event management (SIEM) to provide more context for security analysts.

• Modeling and assumptions.

  For the composite organization, Forrester assumes:

  • Each year, 3,500 authentication-related alerts need investigation.
  • Before Duo, a security analyst spends an average of 90 minutes investigating each alert.
  • With Duo, a security analyst spends an average of 20 minutes investigating each alert in Year 1, and 10 minutes in each of Years 2 and 3.
  • Security analysts productively apply 90% of the time that they save.

• Risks.

  Security analyst productivity improvement will vary based on:

  • The nature of an organization’s security incidents and the resulting per-incident analyst time to address.
  • An organization’s prior state.
  • The nature of the prior authentication solution.
  • How other systems are integrated with Duo.
  • The volume of authentication alerts.
  • Security analyst experience and capabilities.
  • The maturity of an organization’s security operations.
  • The extent to which an organization has leveraged Duo’s capabilities.
  • Prevailing local compensation rates.

• Results.

  To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV of $671,000.

END-USER TIME SAVINGS FROM STREAMLINED AUTHENTICATION

• Evidence and data.

  Interviewees said their end users saved time from Duo’s streamlined authentication processes compared to what they previously used for authentication.

  A security technical lead at a professional services firm said: “With Duo, our end-users spend less time on each authentication request. They no longer need to type in numbers, and then wait for a response.”

  Modeling and assumptions.

  For the composite organization, Forrester assumes:

  • Each of its 10,000 end users authenticate an average of 500 times each year.
  • Before Duo, an end user spends 1.5 minutes on each authentication.
  • With Duo, an end user spends 0.5 minutes on each authentication.
  • End users productively apply 50% of the time they save.

• Risks.

  End-user time savings from streamlined authentication will vary based on:

  • The number of end users.
  • The average number of authentications per end user each year.
  • The nature of the prior authentication solution.
  • Prevailing local compensation rates.

• Results.

  To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV of $3.2 million.

AVOIDED COST OF PRIOR AUTHENTICATION SOLUTION

• Evidence and data.

  By moving to Duo, interviewees’ organizations that previously used another authentication solution eliminated their ongoing expenses for those solutions. This is a net benefit, however, since the organizations now pay for Duo.

  Modeling and assumptions.

  For the composite organization, Forrester assumes:

  • The prior solution provider charges a $2.50 annual maintenance and support fee for each end-user authentication device in use.
  • Each year, 25% of end-user authentication devices are replaced.
  • A new end-user authentication device costs $25.
  • The average cost to send a new device to an end user is $7.

• Risks.

  Avoided infrastructure cost of prior authentication solutions will vary based on:

  • The number of end users.
  • The organization’s prior approach to authentication.
  • Vendor fees for initial cost and subsequent maintenance and support.

• Results

  To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV of $235,000.

AVOIDED COSTS FOR MANAGEMENT AND SUPPORT OF PRIOR AUTHENTICATION SOLUTION

• Evidence and data.

  Because interviewees’ organizations found Duo simpler to manage and support than their previous solutions, they paid less to do so compared to their prior solutions. It reduced the time staff spent ensuring the solution was working, answering questions, deploying additional functionality, adding new use cases, and generally optimizing its use, and also created savings from the elimination of professional services fees formerly paid to fill internal expertise gaps.

  Management and support activities included enacting and adjusting authentication policies; adding new users and managing end-user credentials; integrating the authentication solution with other security investments and with all applications; enrolling and activating new users; and fine-tuning the user experience.

  An IT support specialist at an information services company said, “It’s your easiest option for multifactor authentication in an enterprise environment.” A security technical lead at a global professional services firm said: “Staff time savings have been a big benefit. Duo is very streamlined, and we were able to remove a lot of engineering hours that our team had spent to maintain the prior solution.”

  That IT support specialist also said: “We no longer pay for a professional services firm because we can manage Duo with our own security team. With the previous solution, we paid an external vendor on a constant basis to be available for us and help our dedicated engineers working on the solution. Now, instead of having to dedicate staff to supporting the solution, everybody on our security team is more or less trained to the level that they can operate Duo.”

  A cybersecurity analyst at a healthcare organization said: “Duo has been a great benefit to us in many ways — enrollment, provisioning, security, log activity, investigations, setting up policies, creating processes and standards to help internal teams. It’s all pretty easy. Some of the application owners I work with are not highly tech-savvy, but after working with them, explaining Duo to them, showing it to them, I don’t get a lot of them reaching out for help anymore... With our prior product, we often had to contact the vendor for support because it was such a complicated system. Duo has helped our environment a lot.”

  Duo also saved staff time because of:

  The simplicity of setting up authentication policies.

  A cybersecurity analyst at a healthcare organization said: “Duo benefits us because it’s very easy to set up a policy and implement it in one of our applications within Duo, and then everyone’s on the policy. With our prior product it was more complicated.”

  The ease of integrating Duo with other applications.

  A security technical lead at a professional services firm said: “Duo has great documentation for nearly all the [software-as-a-service] (SaaS) vendors. Whatever you need to call in the internet, you can nearly guarantee that Duo has well-documented and straightforward integration that we can just use, and the simplicity of the onboarding processes is quite good for us. … We enforce Duo authentication on all our cloud SaaS vendors and appreciate the excellent documentation that’s provided for all these integrations.”

  An IT support specialist at an information services company said: “These days, a lot of third-party applications have an integration with Duo. They already recognized Duo as one of the top MFAs. So, ‘You’re using Duo? Here’s your Duo MFA integration.’ You don’t have to go hunt and peck — it’s just right there.”

  Modeling and assumptions.

  For the composite organization, Forrester assumes:

  • To manage and support the prior authentication solution, two IT staff FTEs work a combined total of 4,160 hours each year.
  • To manage and support Duo, varied IT staff work a combined total of 312 hours each year.
  • IT staff productively apply 50% of the saved time.

• Risks.

  Avoided costs for management and support of prior authentication solutions will vary based on:

  • The nature of the prior authentication solution.
  • IT staff experience and capabilities.
  • The maturity of an organization’s security operations.
  • The extent to which an organization has leveraged Duo’s capabilities.
  • Prevailing local compensation rates.

• Results.

  To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV of $326,000.

HELP DESK AND END-USER PRODUCTIVITY IMPROVEMENT DUE TO FEWER AUTHENTICATION-RELATED CASES

• Evidence and data.

  Because Duo simplifies an end user’s authentication process and eliminates the need for a separate device, fewer authentication-related cases reached help desks at the interviewees’ organizations. This saved time for help desk staff and end users.

  A security technical lead at a professional services firm said: “We went from 20 calls each week to maybe one or two. The number of calls dropped because the app is more intuitive and less problematic for end users. The old app was not that straightforward, people sometimes missed the code, and so on. And we have very good feedback from the service desk that the Duo verification they’re doing from their end on incoming calls is working without any issues for them.”

  Modeling and assumptions.

  For the composite organization, Forrester assumes:

  • Before Duo, the help desk handles 1,500 authentication-related cases each year.
  • With Duo, 90% of those cases are eliminated.
  • Help desk staff spend 0.4 hours to resolve each authentication-related case.
  • Help desk staff productively apply 100% of the time they save.
  • End users spend 0.4 hours to resolve each authentication-related case.
  • End users productively apply 50% of the time they save.

• Risks.

  Help desk and end-user productivity improvement due to fewer authentication-related cases will vary based on:

  • The nature of the prior authentication solution.
  • Help desk staff experience and capabilities.
  • The extent to which an organization has leveraged Duo’s capabilities.
  • Prevailing local compensation rates.

• Results.

  To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV of $57,000.

UNQUANTIFIED BENEFITS

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Better end-user experience.

  End users found it easy to begin using Duo, and they subsequently saved time (on each authentication and from downtime) and frustration.

  A security technical lead at a professional services firm said: “The usability of Duo is very well accepted in our organization. With Duo, you get the push and just do a one-touch thing on your device. Compare this with the previous method, where they all had little tokens, and they needed to dial up a number within a certain amount of time. … And since we onboarded Duo, we’ve had no downtime due to authentication-related security incidents.”

  A senior director of information security at a healthcare organization said: “Moving to Duo improved the end-user experience 100%. First, you’re not having to carry a physical device and keep track of it versus a phone that I already have with me. And second, instead of having to try to read some numbers from the token and then type them into the device, I just hit ‘Accept.’” A cybersecurity analyst at a healthcare organization said, “Even our self-enrollment is pretty simple for end users.”

• Ease of further improving the user experience with Duo’s single sign-on (SSO).

  Organizations that opted to use Duo’s SSO functionality further improved the end-user experience by providing Duo users with a simplified and consistent login experience for all applications that are integrated with Duo, whether on-premises or cloud-based. Cisco’s cloud-based SSO for Duo is designed to complement the Duo multifactor authentication solution, although Duo also integrates with dozens of third-party SSO and identity provider tools.

  A cybersecurity analyst in a healthcare organization that uses Duo’s SSO said: “Duo SSO is easy to set up and manage. Most employees I’ve talked to love how easy it is to use. Duo SSO saves end users time because now after signing into one application, they don’t have to multifactor into every subsequent application.”

• Audit and regulatory compliance efficiencies.

  A security technical services lead at a professional services firm said: “With Duo’s better auditing data and user activity reports, we can run fully automated audit reports. That wasn’t possible with our prior solution.”

• Enhanced ability to acquire new customers or partners.

  An IT support specialist at an information services company said: “I think using Duo does help us acquire new customers and partners, or more revenue from our current customers, once they know we’re using Cisco Duo. It has brand recognition in some of the markets we’re in, and that gives them a comfort level.”

• Vendor rationalization.

  A senior director of information security at a healthcare organization said, “It made sense to go with a company we already worked with, so we could limit the number of people we have to pick up the phone and call.” An IT support specialist at an information services company said, “The ease of integrating Duo with our existing security products from the same vendor was attractive.”

• Duo’s moderate learning curve and the value of Duo Care premium support.

  A security technical lead at a professional service firm said: “Our learning curve was low. The product is self-explanatory, and the customer support is excellent.” An IT support specialist at an information services firm said, “Cisco made our onboarding and everything else that much easier.”

  A cybersecurity analyst at a healthcare organization said: “Our Duo Care team has been very supportive about how to do things or providing us with the resources we need to resolve our issue. Or if we’re looking to implement a certain design, they’ve been very helpful in our figuring that out.”

FLEXIBILITY

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Duo and later realize additional uses and business opportunities, including:

• Further capitalizing on Duo’s capabilities.

  Interviewees mentioned the broad scope of Duo’s capabilities and their intent to leverage more of that functionality. A cybersecurity analyst at a healthcare organization said: “There’s a lot more we can get from Duo. It definitely has more features that we can’t wait to try.”

• Protecting additional applications with Duo.

  Interviewees’ organizations typically deployed Duo initially to their top-priority applications (especially those that are frequently accessed remotely) and then continued to extend Duo to additional applications over time, including internal applications and services. An IT support specialist at an information services company said: “Adding another application doesn’t change what we pay for Duo. The more applications I can protect with Duo, the more value I’m getting from it.”

• Readily expanding Duo use to acquired entities.

  A cybersecurity analyst at a healthcare organization said, “We’ll have a lot more employees joining us soon because of an acquisition, but Duo makes that easy.”

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Appendix A).