Cisco is buying Duo Security, a vendor of cloud-based two-factor authentication services, for $2.35B in cash
Cisco today announced its intent to buy Ann Arbor, MI-based security firm, Duo Security. Under the terms of agreement, Cisco is paying $2.35 billion in cash and assumed equity awards for Duo.
Context & Ripple Effects
The Duo Security purchase is the latest step in Cisco's decade-long conversion from box-maker to security and software vendor. It follows the $635M OpenDNS deal in 2015, which added DNS-layer threat protection, and the $293M CloudLock acquisition in 2016, which brought API-based cloud app security — each one adding a subscription layer on top of Cisco's installed network base.
Duo gives Cisco what those deals did not: a cloud-native identity and multi-factor authentication franchise out of Ann Arbor, at $2.35B roughly four times the CloudLock price and in line with the scale of its $3.7B AppDynamics buy earlier that year. The pattern has proven durable — by 2026 Cisco was reportedly back in advanced talks, this time for Axonius at around $2B.
First-order effects
- Duo exits as an independent vendor: its cloud-based two-factor authentication service now ships under Cisco, giving Cisco's security portfolio an identity layer it previously had to partner or resell for.
- Cisco pays $2.35B in cash plus assumed equity awards, making this one of its largest pure-security purchases and immediately deepening its recurring-revenue mix alongside OpenDNS and CloudLock.
Second-order effects
- Standalone authentication and access-security vendors face a buyer with distribution they cannot match: Cisco can bundle Duo's 2FA with its routers, firewalls, and existing OpenDNS/CloudLock subscriptions, turning point products into attach-rate plays.
- The premium price signals to other venture-backed security startups that strategic acquirers will pay software multiples for identity assets — raising the bar for independent financing rounds and pushing more founders toward exit over IPO.
Third-order effects
- If the sequence holds — OpenDNS, CloudLock, Duo, then the reported Axonius talks eight years later — Cisco is structurally rebuilding itself as a security platform company assembled by acquisition, with identity joining network and cloud layers under one bundle.
- That consolidation points toward an industry where multi-factor authentication stops being a standalone category and becomes a feature of broader network-and-identity platforms sold by infrastructure incumbents.
The trend: Cisco is executing a serial-acquisition strategy that converts its hardware franchise into a layered security-software platform, with identity and access management as the newest stratum.