Cisco is buying Duo Security, a vendor of cloud-based two-factor authentication services, for $2.35B in cash
here's what Duo, Splunk, Tanium and the rest of those companies actually do CRN : Cisco's Duo Security Acquisition Part Of Intent-Based Networking Plan Rob Salvagno / Cisco Blog : Driving Cisco's Innovation Engine with Intent to Acquire Duo Security David Holley / Xconomy : Cisco Plans to Buy Michigan Unicorn Duo Security for $2.35 Billion Zaid Shoorbajee / Cyberscoop : Cisco to acquire Duo Security for $2.35 billion Luke Stangel / Silicon Valley Business Journal : Cisco picks up two-factor authentication startup Duo Security for $2.35B Larry Dignan / ZDNet : Cisco buys Duo Security for $2.35 billion, adds cloud-based authentication to security lineup John Leyden / The Register : Cisco drops a cool $2.3 billion on SaaSy outfit Duo Security Tweets: Bill Gurley / @bgurley : I would like to offer huge thanks and congrats to @ZUrlocker who played a key role developing the company and team at not just one but two @benchmark backed companies. First @Zendesk, second @duosec. One time might be luck. This feels like all skill. http://twitter.com/...
Context & Ripple Effects
Duo Security is the fourth security or software company Cisco has bought in three years, following the $635M OpenDNS deal in 2015, the $293M CloudLock acquisition in 2016, and last year's $3.7B purchase of AppDynamics on the eve of its IPO. The through-line, as trade coverage framed it, is intent-based networking: Cisco wants authentication, DNS-layer security, and app security sold as parts of its network platform rather than as standalone products.
The $2.35B all-cash price makes Duo one of the largest pure-identity acquisitions by a networking vendor, and it lands while Cisco is simultaneously converting itself into a software-and-subscriptions business via deals like BroadSoft.
First-order effects
- Duo's cloud-based two-factor service joins Cisco's security portfolio alongside OpenDNS and CloudLock, giving Cisco an identity layer to bundle with its network hardware and software subscriptions.
- Duo's investors and employees take a cash exit at $2.35B rather than testing the public markets, the same pre-IPO outcome AppDynamics' backers accepted a year earlier.
Second-order effects
- Standalone MFA and identity vendors now compete against a buyer that can give away or discount authentication as an attach to network contracts, pressuring their pricing and forcing them toward broader zero-trust suites.
- Cisco's enterprise customers get one procurement path for network plus identity, raising the switching cost of leaving Cisco's stack and squeezing resellers who currently stitch these products together.
Third-order effects
- If the pattern holds — OpenDNS, CloudLock, Duo, and reportedly the advanced talks for Axonius — identity and access management consolidates into infrastructure vendors, shrinking the market for independent security point products.
- Authentication becomes a platform feature rather than a product category, pushing regulators and buyers to evaluate vendors on integrated trust architectures instead of best-of-breed tools.
The trend: Networking giants are acquiring security point products to fold identity into their platforms, turning standalone categories like two-factor authentication into bundled subscription lines.