Identity migration failures
Admins often overlook specific configuration requirements for Microsoft Entra ID. If you use Duo through the Conditional Access Custom Controls preview, the configuration fails to satisfy mandatory MFA requirements. You must migrate to the External Authentication Methods preview to maintain access. Cisco also transitioned users from Verified Duo Push to mobile inline authentication for a different mobile experience. New Duo customers also cannot configure admin role permissions; they must create a custom admin role instead. Duo customers also see a "Maximize your edition" tab on the Admin Panel "Home" page to review subscription suggestions. AI Assistant now resides in custom admin roles. Admins can now mark default and custom attributes as private to protect sensitive information from specific administrator roles. Android users see a link to the Play Store to copy and paste into the mobile browser, whereas iOS users see a download button. If you manage Cisco.com accounts, you must follow specific backup and restore steps for third-party accounts to avoid losing MFA settings during a phone migration.
| Feature | Cisco Secure Access (Essentials) | Cisco Secure Access (Advantage) | Zscaler Internet Access |
|---|---|---|---|
| Primary Scope | Core internet and cloud security | Advanced cloud security | Cloud-native SWG |
| Key Capabilities | DNS security and SWG | Advanced DLP and Layer 7 firewall | Full TLS/SSL inspection |
| Pricing | Contact for pricing | Contact for pricing | Contact for pricing |
Critical vulnerability exposure
Critical vulnerabilities in Cisco management tools undermine the security of a new SSE rollout. The CVE-2026-76460 vulnerability in Cisco Identity Services Engine (ISE) carries a 10.0 CVSS score and allows unauthenticated remote attackers to gain root privileges via an API endpoint. Because attackers can remove or hide evidence after gaining access, the ISE authentication bypass presents a massive risk. The CVE-2026-76504 flaw in Cisco Catalyst SD-WAN Manager also permits unauthenticated remote attackers to access the API with admin privileges through improper URI encoding. Because the ArcaneDoor campaign attackers specifically target older ASA models lacking Secure Boot and Trust Anchor support, they can maintain persistence across restarts and software updates through malicious and persistent firmware tampering. This exploitation of the VPN web server component allows remote code execution with root privileges when attackers use valid VPN credentials. CISA added the CVE-2025-20333 and CVE-2025-20362 flaws to its Known Exploited Vulnerabilities catalog. The CVE-2025-20363 bug affects ASA, FTD, IOS, IOS XE, and IOS XR software and carries a CVSS score of 9.0. Attackers in the ArcaneDoor campaign compromised ASA 5500-X devices with VPN services enabled, deploying malware and even crashing devices to prevent forensics.
SSE deployment strategy
Transitioning from Cisco Umbrella to Secure Access requires a phased approach to avoid massive service disruptions. Use the migration tool to move a subset of devices at a time. This approach allows you to test policies and confirm integration before you expand to a full rollout. You should also redirect a subset of identities at a time using the Redirecting Traffic feature. Do you have the capacity to re-image affected nodes if attackers gained access during the patching process?
Zscaler Internet Access provides fast internet and SaaS access, but it requires constant internet connectivity. Users often complain about the complex initial setup and the need for specialized expertise to fine-tune policies. Cisco Secure Access eliminates the need for separate VPN, proxy, firewall, and CASB products by consolidating these functions. Cisco Umbrella combines DNS-layer security and a secure web gateway to simplify cybersecurity. Cisco Umbrella users might face a steeper learning curve when moving into the Cisco ecosystem.
