Duo secures the login. Authnull secures everything behind it.
Duo is excellent MFA for cloud apps and the perimeter. But the access paths that fail your audit — Active Directory, Windows logon and RDP, RADIUS, network gear, databases — sit below that line, and governance over who has access to them sits nowhere at all. Duo bills every identity, every month. Authnull covers all of it as one enforcement layer with governance built in — at one flat price per band.
Already running Duo? Keep it. This page is about the gap it leaves below the cloud login — and how to close it without a rip-and-replace.
We're not going to pretend Duo is a bad product. It isn't.
If your problem is multi-factor for cloud applications and a clean end-user experience, Duo is one of the best choices on the market. Here's what it does well — and we mean it.
So why do teams still call us? Because the finding on their audit isn't about cloud apps. It's about the domain controller, the jump host, the firewall, and the database — the surfaces underneath the IdP — plus proving who (human, service account, or AI agent) has access to them. That's a different shape of problem, and it's where the architecture starts to matter.
Same paths, two shapes: a patchwork of components, or one enforcement layer.
Duo can reach Active Directory, RDP, and VPN — through a separate add-on for each, installed and licensed on its own, several gated to higher editions. Authnull treats every one of those paths as the same enforcement decision, from a single policy plane.
How each one actually covers the gap.
Not a checkmark contest. Where Duo covers a path, we say so — and say how, because the “how” is the cost and the operational load.
Cloud SSO is Duo's home turf — Authnull co-exists there rather than competing. The rows that move an audit are the ones below it.
Do the math with your own numbers.
Duo bills per seat, so the cost climbs with every identity you add — and the on-prem coverage you're here for lives in its higher editions. Authnull is a flat price per band: the same bill at 100 identities or 500, every protocol and governance included. Set your headcount and the Duo edition that covers your gap.
Duo figures use publicly published list prices ($3 / $6 / $9 per user / month, Essentials / Advantage / Premier) and don't include the Authentication Proxy and Windows Logon components you self-host and maintain. Authnull bands ($499/mo Standard ≤ 500, $900/mo Growth ≤ 1,000, custom above) include every protocol, factor, and governance. Confirm everything against your quote — this worksheet is for scoping, not a contract.
Coexist → Consolidate → Replace (at your pace)
No forced cutover. The path looks different for every team.
Coexist
Keep Duo exactly as-is on cloud apps. Drop Authnull onto the unprotected paths — AD logon, RDP, RADIUS, firewalls, databases — with governance over all of them. Nothing you rely on changes.
Consolidate
Move overlapping paths — RDP, VPN — onto one policy plane. Retire the Duo components you were self-hosting and drop down a Duo edition you no longer need.
Replace (optional)
When you're ready, Authnull co-exists on cloud SSO too — so you can retire Duo entirely, or keep it for the device-trust features you like. Your call, not a forced cutover.
Bring your Duo setup. We'll show you exactly what's still uncovered.
Twenty minutes, your real environment, no slides. Or start free and enforce MFA and governance on AD, RADIUS, Windows, and databases this week.