Head to head · 2026

Duo secures the login.
Authnull secures everything behind it.

Duo is excellent MFA for cloud apps and the perimeter. The paths that fail an audit - Active Directory, Windows logon, RDP, RADIUS, network gear, databases - sit below that line, billed per seat, one add-on at a time.

Cisco Duo
MFA you assemble by tier
VS
Authnull
Leads 12 of 16
One layer, everything included
$9/user/mo
Premier · billed per identity, every month
price
$499/mo
Flat band · same price at 100 or 500 identities
Agents you run
Windows Logon + RADIUS Proxy, self-hosted & patched
on-prem effort
Agent-optional
One policy plane, nothing extra to operate
IT + security ops
Editions, agents, and the proxy, managed by you
who runs it
Nobody dedicated
Set the policy once and move on
Cloud MFA + AD add-ons
Databases and governance sit outside entirely
scope
+ DB · IGA · TACACS+
Enforcement and governance, one flat band
Compare the costWalk it with an engineer
No forced cutoverNo rip-and-replaceCoexists with Duo
Key areas where Authnull is better

Five places a focused layer beats a per-seat platform - pick one and see the difference.

Active Directory & RDPKerberos · Windows logon
VPN & RADIUSRADIUS · 802.1X
Network gear & firewallsTACACS+ · device admin
DatabasesMySQL · PostgreSQL
Identity governancereviews · lifecycle
Needs an edition and an agent

A factor at the domain controller and every Windows RDP session - no edition to climb.

Duo's AD Defense detects attacks against Active Directory, but actually enforcing a factor at domain logon means installing the Windows Logon agent - and AD Defense itself doesn't start until the Advantage edition. Authnull challenges the domain-controller logon path directly, included by default, with local and break-glass accounts in the same policy.

Domain-controller logonRDP & interactive sessionsLocal & break-glass accountsIncluded by default
Cisco Duo
AD Defense detects attacks against AD, but enforcing a factor at domain logon needs the Windows Logon agent - and AD Defense itself starts at the Advantage edition.
Authnull
A factor challenged at the domain-controller logon path itself, included by default - local and break-glass accounts too.
Authnull vs Cisco Duo · full comparison

A complete, dimension-by-dimension comparison.

A capability-by-capability breakdown across architecture, coverage, product category, and positioning - 16 dimensions in total, including where Duo leads.

Capability
Cisco Duo
Authnull
Core architecture
3 of 4
Approach
architecture model
Agent/app-based
Agent/app-based MFA - Duo Mobile app, Duo Auth Proxy, browser/endpoint integrations.
Enforcement layer
Agentless MFA, access policy and session control for every login your IdP can't see.
Duo and AuthNull together
factor vs enforcement
The factor
Duo Mobile delivers the push or passcode the user approves.
The enforcement layer
AuthNull holds the login at the DC, gateway or DB agent and sends the push to Duo. Keep Duo as the factor - the two run together.
Deployment
footprint
Auth Proxy + Duo Mobile
Requires Duo Auth Proxy for on-prem integrations (AD, RADIUS, LDAP); Duo Mobile app for push.
No endpoint agents
No endpoint agents; integrates at the protocol/directory level (AD, RADIUS, RDP, SSH, VPN).
Standing access
who holds the credential
Layered on credentials
MFA layered on top of existing credentials (password + push/OTP).
No standing access
Just-in-time access plus the gateway: people never hold a long-lived credential. The vault holds it and rotates it.
Coverage
6 of 7
Active Directory
Kerberos · NTLM · LDAP
Via Auth Proxy
Yes, via Duo Auth Proxy.
Native MFA
Yes - native MFA.
RADIUS
802.1X
Well-established
Yes, well-established via Duo Auth Proxy.
Yes
Full support.
RDP
3389 · interactive
Yes
Supported.
Yes
Full support.
Linux SSH
PAM
Via Duo Unix
Yes, via Duo Unix.
Yes
Full support.
VPN
gateway access
Strongest use case
Yes - one of Duo's strongest historical use cases.
Yes
Full support.
Service accounts
NHI · machine identities
Not primary focus
Not a primary focus - Duo is largely human-user MFA.
Excluded from push
Detected and excluded from push, so jobs keep running; fenced by policy to the hosts they run on, where supported.
Cloud / SaaS apps (SSO)
SAML · OIDC
Leads
Strong - Duo integrates broadly with cloud apps and SSO, and is backed by Cisco's broader identity/security stack.
Less emphasized
Less emphasized - the product is on-prem focused.
Product category
1 of 3
Primary category
positioning
MFA + access security
MFA and access security platform, part of Cisco's identity portfolio.
MFA + policy + sessions
MFA, conditional access, just-in-time access and privileged session management for on-prem infrastructure.
PAM
privileged access mgmt
Not core
Not Duo's core focus - Duo is MFA/access-first, not PAM.
Sessions, JIT, vault
Session gateway and recording, just-in-time access, vault and rotation, SSH keys and sudo step-up. Not Windows PEDM, app secrets or CIEM.
Risk-based / adaptive auth
device trust · policy
Leads
Yes - device trust, risk-based policies, and endpoint visibility are core features.
Policy, not device trust
Conditional access by user, group, OU, source, time and machine. Duo goes further on device trust.
Positioning & target buyer
2 of 2
Core pitch
the one-line pitch
Easy MFA everywhere
“Easy-to-deploy MFA everywhere” - broad app/device ecosystem, strong brand trust via Cisco.
Logins your IdP can't see
“MFA, access policy and session control for every login your IdP can't see.”
Best fit for
ideal buyer
Broad, mature MFA
Orgs wanting broad, mature MFA across both cloud and on-prem with minimal friction, backed by an established vendor.
Heavy legacy/on-prem footprint
Orgs with a heavy on-prem footprint - AD, Linux, databases, network gear - wanting MFA, JIT and recorded admin sessions.

Authnull leads on 12 of 16 dimensions and ties on 2. The remaining 2 - Cloud / SaaS apps (SSO) and Risk-based / adaptive auth - are areas where Duo leads. Duo is the factor; AuthNull is the enforcement layer. Most teams run both.

Get this as a scorecard
Pricing worksheet

Do the math with your own numbers.

Duo bills per seat, so the cost climbs with every identity you add - and the on-prem coverage you're here for lives in its higher editions. Authnull is a flat price per band: the same bill at 100 identities or 500, every protocol and governance included. Set your headcount and the Duo edition that covers your gap.

Sticker priceAuthnullCisco Duo
Entry tierStandard - $499/mo flat (up to 500 identities)Free - $0/user/mo (≤10 users only)
Mid tierGrowth - $900/mo flat (up to 1,000 identities)Essentials - $3/user/mo
Advanced tier—Advantage - $6/user/mo ("Most Popular")
Top tierEnterprise - Custom (1,000+ identities)Premier - $9/user/mo
Pricing modelFlat-rate band - same price whether you have 50 or 500 usersPer-user - cost scales linearly with headcount
Being upfront: below roughly 80 identities, Duo's per-seat pricing - or its free tier for 10 users or fewer - can undercut Authnull's flat $499/mo floor. The math below favors Authnull at higher headcounts; drag the slider down to see where that crosses for your own team.
Identities250
Duo edition to compare

Advantage adds AD Defense and risk-based auth. VPN-less remote access still requires Premier, and you still install and run the Windows Logon agent and the RADIUS Authentication Proxy yourself - across every user, at this per-user rate.

Line itemCisco Duo · AdvantageAuthnull · Standard
Billing model$6/user/mo × every identityFlat band · ≤ 500 identities
Monthly total$1,500/mo$499/mo
Annual total
at 250 identities
$18,000 /yr$5,988 /yr
On-prem components you operateWindows Logon agent + RADIUS Auth Proxy - self-hosted & patchedSelf-hosted in your environment, agent-optional
AD · RDP · RADIUS · firewalls Add-ons, higher editions Included
Databases (MySQL · PostgreSQL) Not offered Included
Identity governance (IGA) Not offered Included
$12,012/yr less than Duo Advantage - one flat band, everything included.

Duo figures use publicly published list prices ($3 / $6 / $9 per user / month, Essentials / Advantage / Premier) and don't include the Authentication Proxy and Windows Logon components you self-host and maintain. Authnull bands ($499/mo Standard ≤ 500, $900/mo Growth ≤ 1,000, custom above) include every protocol, factor, and governance. Confirm everything against your quote - this worksheet is for scoping, not a contract.

How teams switch

Coexist, consolidate, replace - at your pace. No forced cutover.

01 / start here
Coexist

Keep Duo exactly as-is on cloud apps. Drop Authnull onto the unprotected paths - AD logon, RDP, RADIUS, firewalls, databases - with governance over all of them. Nothing you rely on changes.

No disruption to users
Closes the audit finding in days
02 / save on ops
Consolidate

Move overlapping paths - RDP, VPN - onto one policy plane. Retire the Duo components you were self-hosting and drop down a Duo edition you no longer need.

Fewer components to operate
One log stream, one policy model
03 / your call
Replace (optional)

When you're ready, Authnull co-exists on cloud SSO too - so you can retire Duo entirely, or keep it for the device-trust features you like. Your call, not a forced cutover.

No deadline imposed by us
Keep what works for you

Bring your Duo setup. We'll show you exactly what's still uncovered.

Twenty minutes, your real environment, no slides - we'll show you which flagged paths we close today, and be honest about the ones we don't.

Book a comparison call