Security incident on record — April 2024 — third-party telephony provider breach exposed Duo MFA SMS logs for ~46k customers
▪ Editorial verdict
Cisco Duo has earned 97% willingness to recommend and Gartner Customers Choice recognition in both 2025 and 2026 by delivering the most balanced MFA in the market: strong security through Device Trust and Risk-Based Authentication, combined with the widest factor breadth and genuinely low deployment friction. For organisations that want the most validated MFA with the lowest resistance from end users, Duo is the default choice.
The April 2024 telephony provider breach that exposed SMS logs for 46,000 customers is worth noting, though it reflects a third-party provider compromise rather than Duo's own systems. The scope is also MFA and device trust, not a full IAM platform.
The verdict: Cisco Duo is right for organisations of any size wanting the most validated, most user-accepted MFA with the strongest device trust enforcement. Organisations needing full lifecycle management and IGA should pair Duo with Okta or Microsoft Entra.
Last reviewed: May 2026
G2
4.5395 reviews
Gartner
4.7698 reviews
PeerSpot
8.4150 reviews
Gartner MQ: Customers' Choice — User Authentication (2026)
MFA / Passwordless Authentication assessment
PROTECTIONStrong
Phishing-resistant factors
4 / 5
Duo supports FIDO2/WebAuthn, passkeys, and Duo Verified Push (number matching). Scored 4 because phishing-resistant options are available but TOTP (Duo Mobile) remains widely deployed and is not phishing-resistant.
Sources: Cisco Duo documentation, CISA MFA guidance
Factor breadth & fallback
5 / 5
TOTP, push, biometric, hardware key, SMS (legacy), voice call. Widest factor breadth in the category. Scored 5.
Sources: Cisco Duo documentation
OPERATIONSStrong
Adaptive & risk-based policies
5 / 5
Adaptive MFA with device trust, location, network, and role-based risk signals. Scored 5 for the most mature adaptive policy engine in the category.
Sources: Cisco Duo documentation, Gartner Customers Choice User Authentication 2026
Device posture integration
5 / 5
Trusted Endpoints policy verifies device health before authentication — MDM and EDR posture signals included. Scored 5 for best-in-class device posture integration.
Sources: Cisco Duo Trusted Endpoints documentation
ANALYTICSStrong
Authentication telemetry
4 / 5
Authentication logs, device health events, and policy decision logging. Scored 4 because telemetry depth for compliance workflows is good but less comprehensive than Microsoft Entra.
Sources: Cisco Duo documentation
TRUST & ECOSYSTEMStrong
Admin & privileged protections
4 / 5
Duo Access Gateway and strong admin MFA enforcement. Scored 4 because while admin protection is strong, dedicated privileged access MFA enforcement is less developed than Microsoft Entra PIM integration.
Sources: Cisco Duo documentation
Strongest: Factor breadth & fallback
Watch out for: Admin & privileged protections
Strengths & limitations
Strengths
●97% willingness to recommend — Gartner Customers' Choice User Authentication 2025 and 2026
●Simplest MFA deployment — working in under an hour
●Device Trust — unique capability verifying device health before login