In short: Cisco Identity Intelligence is the identity threat detection and response (ITDR) and identity security posture management (ISPM) capability in Cisco Duo Advantage and Premier. It pulls identity data from Duo, Entra ID, Okta, Google Workspace, Active Directory and other sources, flags risky accounts and attacks, and replaces Duo Trust Monitor, removed from the Admin Panel in July 2026.
What is Cisco Identity Intelligence?
Most organisations have identities scattered across several systems: Active Directory, Entra ID, Google Workspace, an HR system, AWS, perhaps Okta or Salesforce. Each system knows a little about each person. None of them sees the whole picture, and attackers exploit the gaps, such as a forgotten account with no MFA or an admin role nobody remembers granting.
Cisco Identity Intelligence (CII) brings that data together. It is not limited to Duo: it analyses identities from Duo and from your other identity sources, builds a single view of each person and their accounts (Duo calls this User360), and uses it for two jobs: posture (what is weak) and detection (what is happening now). It is included in Duo Advantage and Duo Premier and is opened from the Duo Admin Panel.
Identity security posture management (ISPM)
ISPM looks for weaknesses before anyone exploits them. The kinds of question it helps you answer include:
- Which old accounts should go? Accounts that are no longer used but still exist in one or more systems
- Where is MFA coverage missing? Accounts that are not protected by MFA, including identities that rely on legacy authentication
- Who holds privileged access? An inventory of administrator, guest and service accounts, which is a common blind spot in Active Directory
- Does one person look the same everywhere? A combined view of each person's accounts across your connected sources
Each Duo user also gets a CII trust level: Trusted, Favorable, Neutral, Questionable, Untrusted or Unknown. It appears as a column you can sort and filter in the Duo user list and on each user's page, which makes it practical to fix the riskiest accounts first rather than reading through thousands of log lines.
Identity threat detection and response (ITDR)
ITDR watches sign-in and identity activity across your connected sources for signs that an account is being attacked or misused, using the combined identity context rather than one system's logs on their own.
When an administrator grants CII write access to Duo, it can take action as well as alert, for example disabling a compromised user or removing a suspicious phone from their account. Notifications and tickets can go to Microsoft Teams, Slack, ServiceNow, Jira or Microsoft Sentinel, so they land where your team already works. Pair this with risk-based authentication, another Advantage feature, which adjusts Duo's own login checks when a sign-in looks risky.
Data sources and integrations
CII builds its picture from data ingestion integrations. At the time of writing these include:
| Category | Sources |
|---|---|
| Identity providers and directories | Duo, Microsoft Entra ID (including an Entra ID Event Hub option), Microsoft Active Directory, Okta, Google Workspace, Auth0 |
| Cloud and developer platforms | AWS, GitHub |
| Business systems | Salesforce, Workday |
| Notifications, ticketing and SIEM | Microsoft Teams, Slack, ServiceNow, Jira, Microsoft Sentinel |
If you sync users from Active Directory or Entra ID, CII matches accounts using the directory's own identifiers; otherwise it relies on matching email addresses, so tidy user data pays off.
Trust Monitor has been replaced
Older Duo customers will remember Duo Trust Monitor, which flagged unusual authentications. Duo removed Trust Monitor from the Admin Panel in July 2026, and the Trust Monitor API reaches end of support on 31 January 2027. Cisco Identity Intelligence is its successor, and for new customers it is now Duo's only user threat detection option.
If you have scripts, SIEM feeds or playbooks that read the Trust Monitor API, plan to move them before the end of January 2027. We can review what you have and repoint it to Identity Intelligence.
Active Directory Defense and AI agents
Active Directory Defense, listed on Duo's Advantage edition and therefore also in Premier, extends this protection to on-premises AD: posture management and threat detection for your domain, an inventory of admin, guest and service accounts, reporting for audits, and MFA inserted into legacy authentication.
The MFA part is documented as Duo Legacy AD Protection. It installs a filter on your domain controllers that adds Duo MFA at the initial Kerberos or NTLM logon, without schema changes or agents on each application. It supports Duo Push and phone callback as factors, and does not re-check activity inside an established session, such as ticket renewals. The installer starts in a log-only mode, so you can see which logons would be affected before enforcing anything. Because a mistake here can stop people logging on to the domain, we always pilot it carefully.
Duo also describes Identity Intelligence as providing a real-time inventory of AI agents and other non-human identities, including shadow agents running without IT's knowledge, alongside its agentic identity features such as Duo SSO for AI tools. This is a fast-moving area: ask us what is available on your plan today.
Who it suits, and how we help
Identity Intelligence is most valuable if you run more than one identity system, have a hybrid Active Directory and cloud estate, or need evidence for auditors and cyber insurers that you monitor identity risk. It also suits organisations without a 24/7 security team, because it prioritises the handful of issues that matter.
We connect your data sources, review the first findings with you, fix the quick wins (unused accounts, MFA gaps, stale admin rights), and set alerting that matches how your team works. Contact us to start, or ask us for a quote to move from Essentials to Advantage.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Cisco Identity Intelligence?
Cisco Identity Intelligence is an identity security capability that combines data from Duo and your other identity systems to find weak accounts (ISPM) and detect identity attacks (ITDR). It is included in Duo Advantage and Duo Premier.
Is Duo Trust Monitor being retired?
Yes. Duo removed Trust Monitor from the Admin Panel in July 2026, and its API reaches end of support on 31 January 2027. Cisco Identity Intelligence replaces it.
What is ITDR?
Identity threat detection and response is a category of security tool that watches identity systems for signs of attack, such as stolen sessions, MFA push fatigue attacks or misuse of unused accounts, and helps you respond, for example by disabling an account. ISPM is the preventive side, finding weaknesses before they are exploited.
What is Duo Legacy AD Protection?
It is the part of Duo's Active Directory Defense that adds Duo MFA to initial Kerberos and NTLM domain logons through a filter on domain controllers. It is included in Duo Advantage and Premier, supports Duo Push and phone callback, and starts in a log-only mode.
Does Cisco Identity Intelligence work with Microsoft Entra ID and Okta?
Yes. Entra ID, Active Directory, Okta, Google Workspace, Auth0, AWS, GitHub, Salesforce and Workday are among its data sources, so it can cover identities that Duo does not protect directly.
Do I need Duo Advantage for Identity Intelligence?
Yes. Identity Intelligence is included in Duo Advantage and Duo Premier. It is not part of Duo Free or Duo Essentials.