Duo Security

Authentication validates a user’s established digital identity and credential before granting access to applications or resources. Trust in a credential is measured by Level of Assurance (LoA), which increases as more independent authentication factors are added: something you know (password), something you have (phone receiving out-of-band push approvals), and something you are (biometrics like fingerprints, retina scans, or voice recognition). Single-factor password authentication is portrayed as the weakest approach and is discouraged for sensitive access, while 2FA is positioned as sufficient for most organizations.

As security shifts from perimeter-based to perimeterless models, the text argues that organizations must better understand not only users and their identity metadata, but also the security state of user devices, since outdated software exposes attack surfaces. Desired 2FA features include multiple form factors, simple onboarding and administration, integration tools, user/device reporting, risk-reduction capabilities, and improved user experience.

Duo Security’s Trusted Access is presented as a multi-tenant SaaS platform that verifies the second factor after an organization validates the first factor (typically a password). Product tiers range from Duo Free (up to 10 users) through Duo MFA, Duo Access, and Duo Beyond, adding progressively richer policy controls, device trust/management distinctions (corporate vs. BYOD), role-based policies, and phishing-vulnerability identification. Duo supports many authentication options (push, passcodes, SMS, callbacks, FIDO U2F, third-party HOTP tokens, wearables, biometrics), multiple enrollment methods, identity integrations (AD, OIDC, LDAP, Azure AD, SAML) and username aliasing.

Administrative dashboards, logs, Splunk integration, and PDF/CSV exports support operations and reporting. Risk reduction centers on agentless device checks and self-remediation prompts. Duo Beyond’s device binding limits account takeover by restricting access to registered trusted devices. The platform claims 99.99% uptime and strong user satisfaction, while notable limitations include reliance on third-party hardware tokens, lack of TOTP drift/resync support (making TOTP not recommended), and validation of only the second factor by Duo.

• Multi-Factor Authentication uses more than one authentication factor.
• Password-only authentication is described as the weakest form of authentication and is discouraged for sensitive resources.
• Duo Security was founded in 2010 and is based in Ann Arbor, Michigan, with offices in San Mateo, Austin, and London.
• Duo Security employs over 500 team members.
• Annual recurring revenue more than doubled for four consecutive years.
• Duo products are used by more than six million users across over 100 countries.
• Duo has over 10,000 customers across sectors including finance, government, security, travel, consumer, TV/mobile, and cloud technology.
• Duo Free supports 2FA for up to 10 users.
• The Trusted Access platform is a fully multi-tenant SaaS 2FA solution.
• The platform reports 99.99% uptime.

• “Using only a single factor such as a password is the weakest form authentication and is strongly discouraged from use when accessing more sensitive resources.”
• “Two-Factor Authentication (2FA) can provide the LoA for most organizations authentication needs.”
• “As organizations start to move from a perimeter-based security model to a perimeterless one, greater emphasis will be placed on what you know about the user and the devices they use.”
• “Gaining better insight into a user’s device is needed to reduce the risk of attacks through the vulnerabilities exposed by out-of-date versions of software, as an example.”
• “Duo doesn’t change user identity information in any way and relies on customers to provide the identity information it needs to verify the second authenticating factor.”
• “Device metric reports can provide information such as the security health of user devices by reporting the number of out-of-date OSs, browsers, plugins, as well as the versions of commonly used software like Flash & Java.”
• “Through self-remediation, Duo encourages users to keep their own devices up to date by notifying them at login if their device software is out-of-date, then providing them with clear directions on how to update the software on their device.”
• “By keeping user devices up-to-date is a sure way to mitigate this type of vulnerability.”
• “Only the user’s registered device, together with the combination of that user’s login and MFA, can enable access.”
• “Organizations looking for a solution that validates both 2FA factors will need to take into account that Duo’s Trusted Access SaaS platform only validates one of the two factors and plan accordingly.”