Duo Security

Security researchers Dug Song and Jon Oberheide founded Duo Security in Ann Arbor in 2010 around a counterintuitive goal: make strong two-factor authentication easy enough that ordinary organizations and users would adopt it. Duo's mobile push approval and simple cloud integrations expanded into device-health visibility, adaptive/risk-based access, passwordless authentication, SSO and zero-trust private access. The company was notably capital efficient: it raised about $119m across five rounds, but founders later said less than $20m—roughly $14m—was net burned before reaching more than $100m ARR. Benchmark led/participated in the early institutional scaling alongside True Ventures and GV; Redpoint/Index led the $30m Series C, and Meritech/Lead Edge led the $70m Series D at about $1.17b. Cisco agreed to acquire Duo in August 2018 and closed October 1 for $2.35b cash plus assumed equity awards. Duo remains an active Cisco product/brand rather than an independent company. Current editions range from free for up to 10 users to $3/$6/$9 per user per month for Essentials/Advantage/Premier, progressively adding directory/SSO/passwordless, identity intelligence/risk controls, and device trust/VPN-less access. The platform serves organizations from small teams through enterprises and is integrated across Cisco Security. In March 2024 a phished employee at a third-party telephony provider enabled theft of SMS/VoIP MFA message logs containing phone/metadata; Cisco said Duo's own systems and message contents were not breached, but customers faced follow-on phishing/social-engineering risk. Major structural risks include reliance on push/telephony factors, MFA-fatigue/social engineering, identity-provider dependencies, high-availability requirements and Cisco portfolio integration.

Founding story

Song and Oberheide drew on offensive/defensive security research and Arbor Networks experience to remove the usability and deployment barriers that kept two-factor authentication out of mainstream organizations.

Business model

Cloud identity-security SaaS sold per protected user, now a product business within Cisco Security.

Monthly/annual per-user subscriptions across Free, Essentials, Advantage and Premier; enterprise/channel discounts and add-on telephony credits; cross-sell within Cisco suites.

Traction

At acquisition Duo had reportedly passed $100m ARR, served roughly 14,000 customers and employed about 700 people. Cisco does not separately publish current audited Duo revenue, users or customers; later $1b ARR claims are anecdotal and not recorded as verified.

Latest developments

Cisco integrated cross-identity visibility, identity security posture/threat detection, session-theft protection, Duo Passport and VPN-less private access into refreshed Essentials/Advantage/Premier editions.