Cisco Secure Client Review: The AnyConnect Rename, Explained

Short answer: Cisco Secure Client is Cisco's current name for AnyConnect, rebranded in 2022 and rolled out from mid-2023, bundling VPN/ZTNA access with optional posture checking and telemetry. It fits organizations already running Cisco ASA, Firepower Threat Defense or ISE that want one endpoint agent. It does not fit teams without existing Cisco gear, since Cisco publishes no per-user or per-connection price anywhere.

Cisco Secure Client at a glance

Who Cisco Secure Client is for

Cisco Secure Client fits a 2,000-employee manufacturer already running Cisco ASA or Firepower Threat Defense firewalls that wants one client for remote-access VPN and endpoint posture checking instead of bolting on a separate NAC agent. Posture assessment through ISE Posture or the Secure Firewall Posture Engine is a Premier-tier feature, so the fit assumes budget for the higher license (Cisco Secure Client ordering guide).

It also fits a government contractor or regulated enterprise that needs a VPN client with FIPS 140-2 Level 2 compliance built in, subject to the platform, feature and version restrictions Cisco documents (Cisco Secure Client data sheet).

A third fit is an organization already partway through migrating off Cisco ASA hardware toward Cisco Secure Access, Cisco's cloud-delivered SSE platform. Cisco markets Secure Access as a VPN replacement built around the same client app, which limits end-user retraining across the transition (Cisco Secure Access product page).

Who should not buy Cisco Secure Client

Small businesses without existing Cisco ASA, FTD or ISE infrastructure and no established reseller relationship should look elsewhere. Advantage and Premier license minimums start at 25 users with no published self-serve purchase path, and every price requires a quote (Cisco Secure Client ordering guide).

Teams that want to compare prices the way they can with SaaS-style competitors should also look elsewhere. NordLayer, for example, publishes per-seat pricing directly on its site; Cisco's Global Price List exists internally but is not public, so every deal starts as a reseller negotiation (SoftwareOne marketplace listing, "Enquire now").

Organizations that specifically want the WireGuard protocol should not shortlist Secure Client on that basis: Cisco's documented protocol set is SSL/TLS, DTLS and IPsec/IKEv2, not WireGuard (Cisco Secure Client features, licenses and OSs guide).

Anyone budgeting for the license alone should read The fine print below before committing: the licensing unit and registration rules change by tier and by hardware type (Cisco Secure Client ordering guide).

Features that matter

VPN protocols and encryption

Secure Client supports SSL/TLS (1.2 and 1.3), DTLS (1.0 and 1.2) and IPsec/IKEv2 with AES ciphers; it does not support WireGuard. FIPS 140-2 Level 2 compliance applies with documented platform, feature and version restrictions. Cisco's current data sheet does not mention post-quantum or quantum-safe key exchange. Always-on VPN with Trusted Network Detection auto-connects off a trusted network and disconnects on one; split tunneling is admin-controlled by network, by dynamic domain, or set to full-tunnel (Cisco Secure Client data sheet).

Network topology and site-to-site

Site-to-site and gateway architecture live on the ASA, FTD or Secure Access side, not in the Secure Client license itself: Secure Client is the endpoint agent, not the headend. On-premises deployments inherit whatever gateway regions and throughput the customer's own ASA or FTD estate provides. Cisco Secure Access, the cloud option, publishes its own regional data centers and added new US locations in San Jose, Los Angeles, Miami and Reston during 2025 (Cisco Secure Access community announcement).

Identity, SSO and provisioning

SSO (SAML) is configured on the VPN headend, ASA or FTD, or within Cisco Secure Access, rather than gated by an Advantage or Premier Secure Client license. Legacy RADIUS or LDAP authentication against Active Directory is also handled at the headend. MFA enforcement typically layers in through Cisco Duo or a third-party identity provider at that same headend layer. No native SCIM-based directory provisioning for Secure Client itself is documented in the sources reviewed.

Security assurance

FIPS 140-2 Level 2 compliance is built in, with restrictions by platform, feature and version. Cisco publishes SOC 2 and ISO 27001 materials through its Trust Portal, but access requires an account and the certifications this research could confirm (Meraki, Duo, Catalyst Center) are for other Cisco product lines, not a Secure-Client-specific public certification. Five publicly disclosed Secure Client advisories span March 2024 through March 2025; see Security and reliability record below for the full list.

Admin controls and network policy

Policy is pushed from ASA, FTD or ISE for on-premises deployments, or from the Secure Access cloud dashboard for the cloud option. Per-user and per-group network segmentation and ACLs live on that same management platform rather than inside Secure Client. Device posture checks, through ISE Posture or the Secure Firewall Posture Engine (formerly HostScan), are Premier-only. Trusted Network Detection auto-connects the VPN on untrusted Wi-Fi. Device limits per user and admin role delegation are set on the management platform; Secure Client's own documentation does not state a fixed per-user device cap.

Deployment model and platform coverage

Secure Client ships in two deployment shapes: a traditional on-premises VPN headend (ASA or FTD hardware or virtual appliance) or Cisco Secure Access, a cloud-delivered SSE platform. The client itself runs on Windows 10 and 11 (plus Windows Server 2022 for select modules), macOS, Linux (Red Hat, Ubuntu and SUSE, on x86_64 and ARM64), iOS and Android; ARM64 Windows carries documented limitations. ChromeOS support is not confirmed in the documentation reviewed for this article (Cisco Secure Client features, licenses and OSs guide).

ZTNA migration path

Cisco positions Secure Access, its cloud-delivered SSE platform, as the ZTNA successor to standalone VPN: it bundles ZTNA, VPN-as-a-service, secure web gateway and SaaS protection behind the same Secure Client endpoint app. Cisco's own case studies describe replacing legacy VPN with Secure Access, but the sources reviewed for this article did not surface a documented, step-by-step technical migration runbook from ASA or FTD VPN licensing to Secure Access. Secure Access is licensed and sold separately from Secure Client Advantage and Premier (Cisco Secure Access product page).

Activity logs, monitoring and audit retention

The Network Visibility Module, a Premier-only feature, streams endpoint telemetry, including flow data, users, applications, devices and destinations, for on- and off-network monitoring (Cisco Secure Client data sheet). Session and connection logging otherwise lives on the ASA, FTD or ISE management platform rather than as a Secure-Client-level retention setting, and no distinct SIEM export capability at the Secure Client layer is documented in the sources reviewed.

Day-to-day admin and scale

Rollout depends on the headend. With ASA or FTD, Secure Client can auto-download to endpoints on first VPN connection or be pushed through Intune, SCCM or GPO for managed devices. Profiles, XML files that define split-tunnel behavior, always-on settings and which modules are active, are built with the Secure Client Profile Editor and pushed from the ASA, FTD or ISE console rather than set by end users (Cisco Secure Client Administrator Guide, Profile Editor).

Bulk changes, such as a mass profile update or a new posture policy, go through Firepower Management Center or ISE, not a single Secure-Client-level toggle. Moving VPN configuration from one ASA to another carries over rules but does not automatically bring flash contents like profiles, customizations or bookmarks along with it (Cisco Secure Client Administrator Guide).

Licensing math is a documented source of admin friction, since the license unit and registration method change by tier and hardware type (see The fine print below). No published API rate limit or bulk-provisioning limit for Secure Client itself was found in the documentation reviewed.

The fine print

Licensing tiers and feature gates: VPN Only (perpetual only, remote-access VPN only, licensed per concurrent connection, 25-connection minimum); Advantage, formerly AnyConnect Plus (device and per-application VPN including third-party IKEv2 headend support, Trusted Network Detection, basic device context, FIPS compliance, the Network Access Manager 802.1X supplicant, Cisco Umbrella Roaming; licensed per Unique User, 25-user minimum); Premier, formerly AnyConnect Apex (everything in Advantage, plus endpoint posture assessment, the Network Visibility Module, Suite B encryption and Management VPN Tunnel; also per Unique User, 25-user minimum).

SSO/SCIM plan requirements: SSO is configured at the VPN headend (ASA, FTD or Secure Access), not gated by Secure Client license tier. No native SCIM-based provisioning for Secure Client is documented.

Agent or extension footprint: A single unified Secure Client application with optional modules (VPN, posture, Network Visibility Module, Umbrella Roaming, Network Access Manager) enabled per license and admin policy.

API access by plan: Not documented as a Secure-Client-level, plan-gated capability in the sources reviewed.

Key integrations: Cisco ISE, ASA, Firepower Threat Defense/Secure Firewall, Cisco Duo, Cisco Umbrella, third-party IKEv2 VPN headends (Advantage and Premier); managed deployment through Intune, SCCM or GPO.

Data residency and hosting regions: On-premises deployments keep VPN traffic and configuration on the customer's own ASA or FTD. Cisco Secure Access publishes specific regional data centers and added new US locations (San Jose, Los Angeles, Miami, Reston) during 2025; Secure Access in China is operated separately by Digital China Cloud Technology under a distinct subscription (Cisco Secure Access community announcement).

Compliance reports: FIPS 140-2 Level 2, with platform, feature and version restrictions. Broader SOC 2 and ISO 27001 materials are available through Cisco's Trust Portal behind an account login; this research did not find a public, Secure-Client-specific compliance page.

MSP multi-tenancy: Not published. Secure Client licenses tie to a single organization's ASA, FTD, ISE or Smart Account rather than a documented multi-tenant MSP program comparable to SaaS competitors.

Trial realities: No published self-serve free trial. Evaluation typically runs through a Cisco partner or account team proof-of-concept, with no publicly stated length or feature limits.

Contract terms: Subscription terms run 12 to 60 months, 36 months by default. Advantage is also available as a perpetual license with a separate Cisco Software Support Service (SWSS) contract. VPN Only is perpetual only. Minimum order is 25 users or connections, with no published maximum for Advantage or Premier (Cisco Secure Client ordering guide).

Support

Cisco TAC access requires a Smart Net Total Care or Solution Support contract, with 24/7 phone and online access and a 30-minute response target for Severity 1 and 2 cases, per Cisco's published support service description. Solution Support adds coverage across a broader Cisco and third-party solution stack; elements not covered by Solution Support can fall back to a reduced, product-level support tier. No self-serve community-only support tier is documented for licensed Secure Client deployments, unlike the free community forums some SaaS competitors offer alongside paid support.

Exit and lock-in

VPN profiles are Cisco's own XML format, edited with the Secure Client Profile Editor. No documented export or conversion path moves a Secure Client profile into a non-Cisco VPN client; practitioner reports on migrating to other clients describe manual reconfiguration rather than a data export (Cisco Secure Client Administrator Guide; Cisco Community migration discussion).

There is no self-hosting concept in the SaaS sense, since the VPN headend is Cisco hardware or software the customer already owns or licenses. The practical exit cost is the sunk investment in the ASA, FTD or ISE estate plus manual reconfiguration of VPN policy, posture rules and profiles on a new vendor's client and headend.

Cisco Secure Client pricing

Pricing note: Cisco does not publish a per-user or per-connection price for Secure Client on its own site. The figures below reflect the published license structure only, checked September 29, 2026.

What Cisco Secure Client costs for your team

Cisco does not publish a price, so a seat-math table cannot be computed or verified for this article; any total requires a reseller or Cisco account team quote. This is a real difference from SaaS-style competitors: NordLayer, for example, publishes per-seat pricing directly (see Cisco Secure Client vs the alternatives below).

Costs beyond the license

TAC support under Smart Net Total Care or Solution Support is a separate, also quote-only, line item. Posture checking and the Network Visibility Module require the Premier tier. Existing ASA, FTD or ISE hardware or virtual-appliance costs sit outside Secure Client licensing entirely. FTD 6.2.1 and later requires linking to a Cisco Smart Account to share licenses across the fleet (Cisco Secure Client ordering guide).

Free plan and trial

There is no self-serve free tier and no published trial length or feature limits. Onboarding typically assumes an existing ASA, FTD or ISE deployment, or a reseller-arranged evaluation.

Renewal pricing

Cisco's ordering guide does not publish a first-year promotional rate distinct from renewal pricing. Existing term-license customers, and perpetual-license customers with an active SWSS contract, upgrade to the current Secure Client release at no additional charge (Cisco AnyConnect 4.x end-of-life announcement). Cisco's public documentation does not state whether per-unit renewal prices differ from initial-term prices.

Security and reliability record

Cisco does not publish an uptime figure for Secure Client on the pages reviewed for this article. On-premises deployments inherit the uptime of the customer's own ASA or FTD estate; Cisco Secure Access is a cloud service with its own regional data centers, but no public uptime commitment for it was found in this research.

Cisco Secure Client vs the alternatives

Cisco Secure Client's closest architectural peer is GlobalProtect: both are quote-only, appliance-anchored VPN clients sold through an existing firewall relationship rather than as standalone SaaS. Teams without that existing hardware relationship, or that want a public price before a sales call, tend to look at NordLayer or Check Point Harmony SASE instead. For the wider VPN software field, see the VPN software category hub.

Bottom line

Choose Cisco Secure Client Advantage if you already run Cisco ASA or FTD and need remote-access VPN plus basic device context without posture checking. Choose Premier if device posture assessment, network telemetry or Suite B encryption are requirements, and budget for the higher, still-unpublished price. Look elsewhere, including at Palo Alto Networks GlobalProtect if you are already standardized on that firewall line, or at a published-pricing option like NordLayer if you have no existing Cisco hardware and want a price before a sales call. Start from the VPN software category hub or the shortlist builder to weigh Cisco Secure Client against the rest of the category.