Reduced Costs Of A Credentials-Related Security Breach

Evidence and data. Although interviewees came from organizations across industries, all found significant value in using Cisco Duo to reduce the risk and potential cost of a material data breach. Duo’s threat detection capabilities leveraged machine learning to improve security teams’ ability to spot potential ongoing attack attempts. Furthermore, by blocking lateral movement and securing sensitive systems, Duo effectively disrupted the attack chain and enhanced overall cyber resilience. Interviewees shared how Duo decreased the likelihood of credentials-related cyberattacks by helping their organizations:

• Combine user and device authentication for layered protection. Interviewees discussed how Duo’s layered defenses helped prevent unauthorized access to critical resources. These defenses included adaptive, phishing-resistant MFA using FIDO2 (WebAuthn); SSO; Passwordless; risk-based authentication; device verification; and conditional access policies. Duo helped interviewees’ security teams protect against stolen credentials and account takeovers by enforcing strict access controls and allowing only secure, authorized devices to reach sensitive systems. Interviewees reported an estimated 60% improvement in their organizations’ ability to mitigate these threats, while Duo’s detailed logging enabled rapid detection of identity-based attacks, accelerating response to these incidents.

  • The cybersecurity engineer in the real estate industry said that Duo significantly strengthened identity security for their organization by drastically reducing the likelihood and potential impact of a breach. Its MFA made unauthorized access far less likely, even if credentials were compromised. This not only improved internal security assessments but also helped minimize potential breach-related costs like legal fees, data recovery, and reputational damage. They told Forrester: “With Duo, I estimate the probability of a successful breach has decreased substantially … [and] the cost of a potential breach would be significantly lower. Duo’s MFA adds a strong layer of defense, making it much harder for attackers to gain unauthorized access, even if passwords are compromised. This is particularly crucial for our administrative accounts, which would be the most attractive targets for attackers.”

• Reduce their attack surface. The interviewees discussed how Duo helped their IT team reduce the number of apps that were unmanaged or failing to meet security policies and standards.

  • The CISO at the technology services company highlighted how managing developer tools through the Duo environment helped ensure login security best practices, compared to the prior environment when they were managed outside of the IT organization: “From a security standpoint, Duo allows us to have some strict posture checks for some of our most sensitive systems. We can guarantee that only compliant company devices can access the things that touch source code or build systems.”

• Eliminate key attack vectors and prevent lateral movement. The interviewees noted that Duo helped prevent attacks and privilege escalation from common vectors by only allowing users with trusted endpoints to authenticate. It also played a critical role in defending against sophisticated threats like business email compromise and man-in-the-middle attacks, making it significantly harder for attackers to impersonate users or hijack sessions, even in scenarios involving help desk interactions or stolen tokens.

  • The cybersecurity engineer in the real estate industry explained that, by blocking privilege escalation from regular user accounts, Duo significantly disrupted the typical attack path. This made it much harder for attackers to reach sensitive systems and greatly reduced the likelihood of serious threats like ransomware or major breaches stemming from compromised user credentials.
  • The CISO at the technology services company explained how Duo automated critical identity security processes to prevent attacks from a variety of sources. By implementing SSO during onboarding, they reduced the likelihood of users reusing the same password for multiple applications. Their organization also implemented a 30-day patch cycle, blocking users who missed updates until they achieved compliance and ensuring all devices met security standards efficiently.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Based on Forrester Research’s data for organizations with $2 billion to $5 billion in revenue, the average breach cost for the composite organization is $3.27 million.

• The estimated likelihood of experiencing a breach is 68%.

• Seventy percent of breaches are considered addressable by Cisco Duo.

• The reduction in risk exposure due to Duo improves from 45% in Year 1 to 60% in Year 3.

Risks. The following risks may impact this benefit:

• The prevalence, nature, and average cost of data breaches in an organization’s industry.

• The volume and type of data breached.

• The geographic scope of operations.

• The regulatory and compliance measures an organization is required to follow.

• An organization’s prior state and maturity level for security operations.

• The prior authentication software.

• The extent to which an organization leverages Duo’s capabilities.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.6 million.

Improved End-User Productivity

Evidence and data. Across the interviewees’ organizations, Cisco Duo emerged as a key enabler of smoother, faster end-user experiences. Rather than slowing users down with cumbersome login processes, Duo helped mitigate friction and streamline authentication in ways that directly improved productivity. This not only saved end users time but also reduced cognitive load and frustration. Whether it was reducing the time it took to log in, simplifying access across multiple applications, or minimizing disruptions during the workday, Duo allowed users to focus more on their tasks and less on navigating security barriers. This benefit had multiple value drivers, including:

• Ease of use with SSO and other features. The implementation of SSO, Duo Desktop, and passwordless authentication allowed users to access multiple applications with a single set of credentials and ensure quicker subsequent logins. Passwordless authentication provided additional savings and convenience, reducing the time spent on login processes. Duo’s passwordless access eliminated the need to repeatedly enter credentials. Passport and Duo Desktop features also helped reduce repeated authentication prompts by leveraging secure tokens.

  • The cybersecurity engineer in the real estate industry shared that, following the Duo investment, end users experienced smoother, more efficient workflows, thus accumulating incremental time savings throughout the day.

• A significant reduction in login time. One of the most immediate Duo benefits reported was optimizing a secure end-user experience, which streamlined daily operations and enhanced productivity. Previously, users faced cumbersome login procedures that required multiple steps and considerable time. With Duo, the authentication process became swift and seamless, reducing the time spent on logins by 75%. This efficiency allowed users to remain focused and eliminated the need to leave their workspace to retrieve authentication codes; thus, they could focus more on their tasks.

  • The information security leader in the retail industry said that their organization’s end users previously spent 2 to 3 minutes authenticating in the prior environment. With Duo’s push-based authentication, that time had dropped to just 30 seconds, allowing users to stay focused and get to work without unnecessary delays, even when multiple authentications were required throughout the day.
  • The CISO at the technology services company noted that their organization’s prior login procedures were excessive and clunky. After deploying Duo, the interviewee shared that their organization experienced fewer disruptive authentications required of users and shorter login periods overall: “The logins would be [several steps totaling] 30 seconds in some cases, and [now with Duo,] they just go down to one click and 2 seconds. … I would say most people were signing in to anywhere from six to 20 applications a day. That just becomes one click: With SSO, you just click on your tile and it launches; you don’t have to type anything. There are all these little things that add up.”

• Improved time to productivity for new users. Duo also accelerated the onboarding period by decreasing the time it took for newly onboarded employees to become productive. The consistent onboarding experience across applications became a key enabler of business agility for the interviewees’ organizations.

  • The CISO at the technology services company explained that implementing SSO simplified onboarding by reducing the need to set multiple passwords, making the process less daunting for new hires: “Now, even if we have to manually create the user accounts in some situations, on your first day, you get granted access to SSO, you set up your touch ID … and that’s basically it. … A new hire doesn’t have to set up 20 passwords.”
  • The senior VP of IT at the healthcare organization noted that productivity for new users improved significantly, reducing the onboarding time from multiple weeks to just a few days. They also managed to cut down service desk hold times from 30 minutes to 2 minutes, enhancing user satisfaction. Additionally, the automated enrollment process for new devices and users streamlined workflows and reduced errors, making it easier for employees to get started: “The enrollment process is automated so that it is all self-service. … Every application that we deploy has the exact same login process. ... As we bring on these new users, ... it’s very easy to get them trained and using applications over that authentication barrier.”

• Less end-user time spent waiting for support. Interviewees described how Duo helped automate the user provisioning lifecycle (see IAM Efficiencies) leading to fewer manual errors in the process. This meant that new and existing users had fewer authentication-related issues requiring support, while improved authentication-related context meant support staff were able to shorten the time end users spent waiting for support.

  • The senior VP of IT at the healthcare organization explained that implementing Duo significantly reduced the need for extensive training and decreased service desk calls related to login issues. This streamlined approach allowed new users to access applications easily, improving overall efficiency and user satisfaction: “In the past, users would have 30-minute hold times, potentially longer. Now, we can keep those hold times down to 2 minutes or less.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The model assumes between 10,000 and 12,000 users, each performing 500 authentications per year.

• Before Duo, each authentication took 1.5 minutes; with Duo, this time drops to 0.5 minutes.

• End users recapture 50% of these time savings for productive work.

• The average fully burdened hourly rate for an end user is $48.

Risks. The following risks may impact this benefit:

• The number of end users.

• The average number of authentications per end user each year.

• The nature of the prior authentication solution.

• Prevailing local compensation rates.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $4.4 million.

Incident Response Time Savings

Evidence and data. Organizations across industries reported that Cisco Duo significantly enhanced the productivity and responsiveness of their security operations teams. By improving visibility, reducing investigation time, and streamlining authentication processes, Duo enabled teams to act faster and more effectively when incidents occurred. In particular, interviewees reported how Cisco Duo helped their organizations:

• Automate critical security steps. Interviewees described how Duo significantly reduced the time required for security investigations by automating risk-based authentication assessments and providing better visibility into login activities. These automations allowed security teams to skip unnecessary steps and focus on critical issues, saving valuable time. Overall, these time-saving automations enabled security operations teams to work more efficiently and effectively, focusing on genuine threats and improving the organization’s security posture.

  • The senior VP of IT at a healthcare organization described how Duo’s automated escalation — such as flagging impossible logins from two distant locations — allowed their team to step up authentication requirements in real time. This proactive approach helped prevent unauthorized access and reduced the burden on analysts to detect anomalies manually.

• Risk-based authentication. Duo’s risk-based authentication and visibility features were repeatedly highlighted as key enablers of faster, more confident decision-making based on rapidly changing risk factors.

  • The cybersecurity engineer in the real estate industry noted that Duo’s risk-based assessments allowed their team to ignore low-risk logins and focus only on meaningful alerts, saying: “We could take off several people hours a month in terms of wasted time on looking at reports in areas that we didn’t need to.”

• Lower false positives. Another major area of improvement was reducing false positives and unnecessary escalations. With Duo’s detailed authentication logs and integration with Cisco Identity Intelligence, service desks and SOC teams could quickly determine whether login issues were authentication-related or due to other system problems. The streamlined authentication process also minimized the occurrence of false positives, reducing the time spent on investigating nonissues.

  • The information security leader in the retail industry said: “Beforehand, we would have to manually look at logins and just see if there was anything suspicious, whereas now we can look at that risk-based assessment. … For us, that saves us time looking at detections and reports that are … just false positives in the end, helping us to improve the efficiency of the team when looking at investigations of different alerts.”

• Decrease investigation times. Together, the impacts above led to a significant reduction in security investigation time. Teams that previously had to perform multiple manual steps to verify user activity — such as checking device logs or querying security information and event management (SIEM) systems — found that Duo provided near-instant answers.

  • The senior VP of IT at the healthcare organization shared how Duo reduced the time to investigate incidents by 50%, from 1 hour in the prior environment to 30 minutes with Duo. They added: “Cisco Identity Intelligence is an enhancement to that [time savings]. It gives us a lot more visibility into those identity incidents for sure.”

• Reduce account takeovers. Interviewees shared that their teams also reported a significant drop in account takeover incidents. In their prior environment, their SecOps teams were handling a significant daily volume of account takeovers. With Duo’s SSO, MFA, and other capabilities, however, account takeovers required minimal effort, if any at all.

  • The IT security manager in the transportation industry shared that before Duo, compromised accounts were a regular occurrence, often taking half a day to resolve. Since implementing Duo, they have had no successful account takeovers, even when credentials were phished — saving hours of work each week and reducing stress on a small security team. They told Forrester: “We went from pretty regularly having to deal with compromised accounts to none at all. We still have reports once in a while where we find out that somebody entered the username and password at a phishing site, but no bad guy has ever been able to take that account and do anything with it.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization dedicates 4,992 hours per year to incident response.

• With Duo, the composite reduces its incident response effort by 40% in Year 1, increasing to 55% in Year 3.

• Technical resources recapture 80% of time savings for productive work.

• The average fully burdened hourly rate for a technical resource is $72.

Risks. The following risks may impact this benefit:

• The nature of the prior authentication solution.

• IT staff experience and capabilities.

• The maturity of an organization’s security operations.

• The extent to which an organization leverages Duo’s capabilities.

• Prevailing local compensation rates.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $276,000.

IAM Efficiencies

Evidence and data. Interviewees reported that their organizations had inconsistent, often manual IAM practices in their prior environments. They often distributed user management responsibilities across business users who were also app owners, rather than consolidate them through a secure IT function. Deploying Cisco Duo significantly streamlined their IAM processes, particularly in the areas of user provisioning, scalability, and administrative control. These efficiencies not only saved time but also improved security posture and operational agility. Interviewees pointed out how Duo IAM automations helped:

• Improve administrative control and visibility. Interviewees described how Duo’s adaptive access policies gave IAM teams the ability to manage access privileges with newfound granularity based on role, device, location, and many other contextual factors.

  • The information security leader in the retail industry shared: “Duo has such a clean user interface. It really helps us to streamline our user enrollment, and I think that’s been a big factor for us. … Setting up a new user in an application that’s already in Duo could save 15% of your time just by putting them into one Duo group, and then boom, they have access.”

• Optimize user provisioning lifecycle. Interviewees described how adding a user to a Duo group could instantly provision access to applications, eliminating the need to create and manage separate credentials, saving on per-user setup time and reducing the risk of forgotten passwords and the need for ongoing maintenance.

  • The information security leader in the retail industry said that Duo’s integration with SSO and group-based access controls simplified the process of granting application access. The process of setting up authentication for a new employee decreased by 50% or more, from 20 minutes to just 5 to 10 minutes.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization dedicates 3,328 hours per year to IAM.

• Effort reduction improves from 40% in Year 1 to 55% in Year 3.

• Technical resources recapture 80% of time savings for productive work.

• The average fully burdened hourly rate for a technical resource is $72.

Risks. The following risks may impact this benefit:

• The nature of the prior authentication solution.

• IT staff experience and capabilities.

• The maturity of an organization’s security operations.

• The extent to which an organization leverages Duo’s capabilities.

• Prevailing local compensation rates.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $205,000.

GRC Optimization

Evidence and data. Interviewees noted how their organizations were under increasing pressure to demonstrate compliance with regulation requirements and governance policies. As cyber threats evolved, breaches occurred for some organizations in their prior environments, and insurers raised their standards across sectors. Interviewees shared that Cisco Duo played a critical role in helping their organizations meet these rising expectations. They reported a range of ways in which this manifested, particularly in the areas of cyber insurance eligibility, cost savings, and compliance reporting, as well as meeting customer expectations on security. In particular, they highlighted their organizations’:

• Improved ability to provide evidence and reporting. Duo helped organizations demonstrate compliance and provide evidence of security controls — a growing requirement as they noted insurers, regulators, and even customers were raising the bar on their standards. Compared to their prior environments, where gathering evidence and reporting was overly burdensome, interviewees noted how Duo made it easier to share SOC evidence on MFA.

  • The CISO at the technology services company shared that, prior to Duo, their teams would have to periodically audit out-of-date patches for users missing endpoint protection. They noted that Duo enabled real-time compliance enforcement, which mitigated the need for manual checks: “[Duo saves us] 2 hours per week [of] tedious, manual spreadsheet comparison and outreach to the help desk and … users. It allows us to enforce the major compliance bullet points in real time, so we don’t have to try to figure out which laptops are missing [endpoint security agents].”
  • The senior VP of IT at the healthcare organization shared how their organization achieved regulatory and audit efficiencies: “We are spending less time [on reporting with Duo. It gives us] the ability to rapidly demonstrate how MFA is enabled for every user, for every authentication, both on the server side and the application side, which is our HIPAA regulatory requirement. We couldn’t even produce a report [like that before], but in Duo we have it.”
  • The IT security manager in the transportation industry said that having Duo at the center of their organizations’ identity security strategy helped meet growing customer expectations on security: “Customers … were [always] very interested in what we had from a security standpoint, but nowadays we just get this long questionnaire with hundreds of questions that I have to fill out every year. … On the PCI side, I can just say ‘not an issue; we’re using Duo MFA.’”

• Better standing with cyber insurers. Although interviewees saw Duo as foundational to qualifying for cyber insurance, one of the most striking outcomes was its direct financial impact on cyber insurance premiums. Duo contributed to maintaining insurer confidence, and in some cases led to more favorable rates.

  • The cybersecurity engineer in the real estate industry reported that their organization saved 45% on cyber insurance costs after implementing Duo. Without Duo’s MFA and privileged access controls, they were at risk of losing coverage altogether. Duo not only helped them retain coverage but also expanded it, making it a key factor in their insurance strategy. They told Forrester: “Through the Duo implementation, we were able to save 45% on the insurance cost, and we were going to lose some coverage without all the MFA and privileged access management, that ultimately, we were able to keep.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Cyber insurance premiums are set at $150,000 annually, with savings increasing from 10% to 20% over three years.

• GRC efforts total 1,664 hours annually, with a 15% to 25% reduction in effort for the composite.

• Technical resources recapture 80% of time savings for productive work.

• The average fully burdened hourly rate for a technical resource is $72.

Risks. The following risks may impact this benefit:

• The nature of the prior authentication solution.

• IT staff experience and capabilities.

• The maturity of an organization’s security operations.

• The extent to which an organization leverages Duo’s capabilities.

• Prevailing local compensation rates.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $90,000.

IT Help Desk Optimization

Evidence and data. Interviewees detailed how their IT help desk functions gained better visibility and clarity into authentication issues after adopting Duo. This lowered support costs and optimized productivity for end users and IT staff alike. Automated workflows in the provisioning lifecycle reduced the potential for errors and misconfigurations that often served as the bulk of support requests in the prior environment. Key value drivers for this benefit included:

• Reduction in credentials-related support issues. Organizations saw a reduction in the number of IT tickets related to authentication issues, with monthly ticket volumes dropping significantly.

  • The information security leader in the retail industry said that their organization reduced credentials-related ticket volume by up to 70%: “Per month, we’d have anywhere from 15 to 20 tickets in terms of authentication issues. Now [with Duo], we are down to maybe six [credentials-related tickets].”

• Faster troubleshooting and resolution times. Another key area of improvement was in the time taken to resolve IT tickets. The ability to check and unlock accounts quickly through Duo streamlined the process, reducing the burden on IT staff and minimizing downtime for users.

  • The CISO at the technology services company highlighted that their help desk saved half a day each week by streamlining user access to applications: “Not only is it easier [for the help desk] to give people access to applications, but they’re also not having to do password resets or unlock accounts across these dozens of SaaS applications. … No one’s getting locked out [and] the whole process is streamlined.”
  • The information security leader in the retail industry said that their organization’s support team took 15 to 20 minutes to resolve a credentials-related user issue in the prior environment. With Duo, the interviewee said that resolution time decreased by more than 67%, down to 5 minutes. The interviewee said that Duo helped support teams triage user issues better than in their prior environment: “We can immediately check Duo straight away to see if a user is locked out. … [Then,] we can just press a button, [and] they’re unlocked; they can log in. That’s definitely helped us decrease the amount of time that our IT help desk spends on these tickets and that our users are waiting to get on to the systems as well.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• In the prior environment, the composite addresses 1,200 authentication-related help desk tickets per year, each taking 15 minutes to resolve.

• With Duo, the composite reduces ticket volume by 40% to 60% and reduces resolution time by 25% to 50%.

• The average fully burdened hourly rate for a help desk resource is $50.

Risks. The following risks may impact this benefit:

• The nature of the prior authentication solution.

• Help desk staff experience and capabilities.

• The extent to which an organization leverages Duo’s capabilities.

• Prevailing local compensation rates.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $28,000.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Simplified identity and security environment. Duo simplified the technology stack for the interviewees’ organizations by centralizing and streamlining authentication and log management technology. Duo replaced a fragmented mix of managed authentication tools and other unmanaged free solutions. This consolidation eliminated the complexity of supporting multiple tools and improved manageability and auditability.

  • The CISO at the technology services company highlighted how their IT teams consolidated a dozen on-prem services that were previously managed through their development organization. This allowed developers to focus on product innovation and gave IT more visibility and control over authentication.
  • The cybersecurity leader in the healthcare industry reported that, by consolidating authentication logs through Duo, organizations avoided needing to collect and manage logs from multiple disparate systems. This significantly reduced the volume of data sent to their SIEM, which is typically priced based on data ingestion volume. As a result, they achieved notable cost savings.

• An identity-first security culture. Interviewees described how their organization’s underlying growth strategy and security culture reoriented around identity security following Duo adoption.

  • The information security leader in the retail industry said that Duo shifted their organization’s culture toward a higher level of security maturity with identity and credentials at the center: “Using Duo has ingrained that mentality of checking for authentication issues upfront [as we scale], so it’s ingrained within our teams.”

• Time savings reallocated to higher-value activities. By recentering identity security and management with IT, business and technical users often applied the productivity gains to higher-value activities.

  • The information security leader in the retail industry indicated that Duo obviated a significant volume of incidents, thus reducing the time security teams spent reviewing logs (see Incident Response Time Savings). They said that their teams reattributed these time savings to focusing on critical threats.
  • The cybersecurity leader in the healthcare industry noted that the improved context from Duo provided upskilling opportunities for IT help desk staff. They noted that it empowered the teams with valuable knowledge about authentication processes to help further accelerate issue resolution.

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Cisco Duo and later realize additional uses and business opportunities, including:

• Secure scalability and growth. Duo’s robust support and roadmap guidance helped organizations deploy adaptive security models, allowing them to scale users and applications. Duo also enabled quick and secure user onboarding while maintaining compliance with MFA policies. This approach offered greater administrative control and visibility, standardized SSO and MFA processes, and reduced MFA fatigue, making it easier for IT teams to manage credentials, enforce security policies, and monitor access effectively as their organizations experienced rapid organic growth via mergers and acquisitions.

  • The infrastructure and security manager at a financial services firm shared how their organization grew from 750 to 2,700 FTEs during their investment period. They emphasized how Duo’s support and roadmap guidance helped them stay ahead of their expanding needs. The interviewee noted that Duo gave their firm the ability to quickly and securely onboard users while maintaining compliance with MFA policies, which made growth more manageable and secure.
  • The CISO at the technology services company described how Duo helped their organization scale securely by offloading authentication management to IT, allowing technical teams to focus on development rather than maintaining infrastructure. With just-in-time provisioning, they could dynamically create new developer users and grant access through SSO, streamlining the onboarding process and enhancing scalability.

• Faster time to value with mergers and acquisitions. Multiple interviewees shared how the enhanced scalability and growth described above streamlined and accelerated their organizations’ mergers and acquisitions activities. By implementing MFA for their VPNs and traditional logins, IT staff could onboard users faster and with more secure authentication.

  • The senior VP of IT at the healthcare organization shared how Duo enabled faster onboarding and smoother integration during rapid growth by standardizing the login process across all applications. This consistent SSO experience improved user adoption and supported business agility: “We’re very much in growth mode. We just finished multiple acquisitions last month [and] have mandated everyone log in through this SSO method. …That leads to that business agility [because] every application that we deploy has the exact same login process.”

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).