Skip to content
HOMETECH DIRECTORYNEWS & DEVELOPMENTSRELOCATEEMPLOYERSNEIGHBORHOODSABOUTSchedule a Call

Duo Security (Cisco)

Duo Security was founded in Ann Arbor in 2010 and sold to Cisco for $2.35B in 2018. It remains the largest cybersecurity employer in downtown Ann Arbor.

A2Hub Editorial· Rusty Roof Media· Updated May 4, 2026

Duo Security (Cisco)

Duo Security is the single largest technology exit Ann Arbor has ever produced. Cisco announced a $2.35 billion all-cash acquisition on August 2, 2018 and closed it that October. The company was founded in 2010 by Dug Song and Jon Oberheide, kept the office under Cisco, and still anchors downtown Ann Arbor's cybersecurity cluster.

Quick facts

  • Founded: 2010
  • Founders: Dug Song, Jon Oberheide
  • HQ / Ann Arbor office: Originally 123 N. Ashley Street; later anchored at the Liberty Square building off Liberty Street, downtown Ann Arbor
  • Headcount: Approximately 740 employees at time of acquisition, with roughly 350 Michigan-based. Current 2026 Cisco-internal headcount not publicly disclosed.
  • Funding raised pre-exit: $121 million across five rounds
  • Key investors: True Ventures, Benchmark, Redpoint, Meritech, Lead Edge Capital, Index Ventures, Radar Partners, Geodesic Capital
  • Acquirer: Cisco Systems
  • Deal value: $2.35 billion cash, announced August 2, 2018, closed October 2018
  • Current status: Operates as Cisco Duo inside Cisco's security portfolio
  • Current leadership: Rotates within Cisco's security organization. Dug Song served as Cisco Chief Strategy Officer post-acquisition and has since shifted to civic and investing work.
  • Sector tags: cybersecurity, identity, MFA, zero-trust access
  • Careers: jobs.cisco.com (filter Ann Arbor, MI)
  • Website: duo.com
  • LinkedIn: linkedin.com/company/duo-security

What Duo makes

Duo is an identity and access security product. Three jobs in one.

Multi-factor authentication. The Duo Mobile push is the product most people know. A user logs into an app, their phone buzzes, they tap Approve, and they are in. Underneath that is a policy engine that checks device posture, network, geography, and risk signals before deciding whether to even offer the push.

Device trust. Duo inspects the device making the login request. Operating system version, disk encryption, browser version, whether the device is managed by the organization. If the device does not meet policy, access is denied, or the user is forced into a remediation flow. This is the part of the product that matured dramatically after Cisco bought the company.

Zero-trust and single sign-on. Duo now sits at the front door of most of its customers' SaaS estates, acting as both the SSO provider and the policy decision point for zero-trust access. The evolution from "MFA vendor" to "access fabric" is what justifies Cisco keeping Duo as a standalone brand inside its security portfolio.

The product runs at large scale. Cisco has reported Duo surpassing the 1 billion monthly authentication threshold, though the company does not break out current annual recurring revenue at the Duo-product-line level. Reports tying Duo to $1B+ ARR inside Cisco remain unconfirmed at Cisco's disclosure level.

The technical insight at the start was simple and has aged well. Passwords alone are a broken primitive. Hardware tokens are friction. Push MFA through a phone app is the right UX compromise between security and user tolerance. Duo productized that idea before Okta had folded MFA deeply into its platform, before Microsoft shipped Authenticator as a mature product, and before most mid-market CIOs understood that MFA was something every company needed rather than a compliance checkbox for regulated industries.

The Ann Arbor story

Duo Security was founded in 2010 by Dug Song and Jon Oberheide. The pedigree is load-bearing.

Dug Song spent seven years as chief security architect at Arbor Networks, the U-M DARPA spinout that pioneered carrier-grade DDoS protection and was later acquired into NETSCOUT. Before Arbor, he belonged to the w00w00 hacker collective, the same late-1990s research community that produced Jan Koum of WhatsApp and Shawn Fanning of Napster. w00w00 was the kind of place where security primitives were written for fun and bug-chains were passed around like trading cards. When Song left Arbor, he carried both the technical credibility and the network that lineage implies.

Jon Oberheide grew up in Troy, Michigan, and earned his PhD in computer science and engineering at U-M, working on mobile and kernel security. His dissertation-era research exposed weaknesses in how phones handled cryptographic identity, which is exactly the problem Duo set out to solve in product form.

The pair started Duo in a small office at 123 N. Ashley Street on the western edge of downtown Ann Arbor, with a thesis that felt contrarian in 2010: multi-factor authentication did not have to be a pain in the neck. Every enterprise MFA deployment at the time ran on hardware tokens, janky SMS, or desktop smart-card readers. Duo bet that a push notification to a phone could replace all of it, that the entire system could be delivered as SaaS, and that small and mid-market IT teams would adopt it before Fortune 500 CISOs ever did. They called the approach "democratizing security." It worked.

Duo raised $121M across five rounds before the Cisco acquisition. Seed (2010, $1M, True Ventures). Series A (2012, $5M, True Ventures). Series B (2014, $12M, Benchmark). Series C (2015, $30M, Redpoint). Series D (2017, $70M, Meritech and Lead Edge Capital, at a $1.17B valuation, the unicorn-minting round).

Cisco announced the deal on August 2, 2018. Closed in October. At $2.35B cash, it was not just Michigan's first tech unicorn outcome, it reset expectations about what a B2B SaaS exit from Ann Arbor could look like. Post-acquisition, Cisco did the thing most acquirers do not do: it kept the Ann Arbor office, kept the brand, kept the product culture mostly intact, and kept hiring locally. The Liberty Square headquarters grew. The downtown cybersecurity talent cluster that Duo had built consolidated further rather than scattering.

Dug Song and Jon Oberheide both stayed engaged with the ecosystem after the exit. Song co-founded the Song Foundation with his wife Linh Song and co-chairs the Michigan Founders Fund, a 501(c)(3) where Michigan founders pledge 1% of equity, profit, or carry back into state-based grantmaking. Oberheide co-hosts the "Inside the Network" podcast and actively invests in early-stage security companies, including participation in Blumira's $15M Series B in 2023.

Culture and hiring

Pre-acquisition Duo was known for a specific engineering culture. Flat, technically serious, unusually candid about security (rare for a security vendor), and actively investing in developer relations and community. The company ran Duo Tech Talks, sponsored BSides events, and maintained a public engineering blog that actually shipped technical writing. Post-acquisition, some of that culture texture softened under Cisco's corporate layer.

Cisco Duo continues to hire in Ann Arbor across software engineering (backend Python and Go, mobile iOS and Android, frontend React), detection engineering, site reliability, product management, and security research. The bulk of posted Cisco security engineering roles for Michigan are Duo-lineage teams. Work model as of 2026 is hybrid with a meaningful downtown Ann Arbor in-office presence; specific day requirements vary by team.

Glassdoor reviews for Duo inside Cisco trend more mixed than the independent Duo era. Complaints cluster around Cisco bureaucracy, slower velocity, and org chart churn. Positive reviews still reference strong peers, stable comp, and the chance to work on identity at very large scale.

Strategic reading

Duo's position inside Cisco is secure for now. Identity and MFA are structurally sticky; customers do not rip out MFA lightly once it is bolted into every SSO flow. The product is profitable, well-distributed through Cisco's enterprise channel, and sits in the middle of the zero-trust narrative Cisco is telling against Palo Alto, Zscaler, and CrowdStrike.

The risk is not product failure. The risk is Cisco reorganization. Big security acquisitions inside Cisco have historically gone through multiple reporting-line shifts before the acquired team's culture settles or dilutes. The question for anyone weighing a Cisco Duo offer in 2026 is whether the Ann Arbor engineering group retains enough autonomy to matter, or whether the gravity of Cisco's San Jose security org eventually absorbs it.

Competitively, Duo faces Okta (with its own Adaptive MFA and a broader identity platform), Microsoft Entra ID (nearly free for anyone on Microsoft 365 and cutting deep into Duo's mid-market), and a long tail of passwordless and WebAuthn startups. Duo has moved toward passwordless and device trust to stay ahead of that pressure, with mixed success.

Locally, Duo's exit continues to echo. Censys was founded by a U-M professor in 2017 partially because the Duo exit proved a Michigan security company could scale. Blumira pulls from the Duo alumni pool. Every cybersecurity founder pitch in Ann Arbor references Duo, one way or another.

If you're considering an offer

A few things to weigh honestly if you have a Cisco Duo offer versus a coastal security company.

Compensation inside Cisco is competitive for Ann Arbor but below FAANG and below well-funded late-stage security startups. Glassdoor data puts Duo engineer total comp in the upper half of the Ann Arbor SWE band, above the $143K metro median but not at the $250K+ level some Amazon Ann Arbor roles disclose. Senior engineer bands are stronger. Equity is Cisco RSUs, which is a different instrument than early-stage options.

Work-life balance tends to be real at Duo in a way that is rarer at pre-IPO cybersecurity startups. Product has been shipping for over a decade. Systems are mature. On-call is bounded.

Career ceiling is the tradeoff. Inside Cisco, your growth depends partly on the political weather in the security org, not just your individual output. If you want the roll-up-your-sleeves, ship-a-feature-to-production-on-Friday experience, a smaller Ann Arbor security company like Blumira or Censys may be a better cultural fit. If you want to work on identity at hundreds-of-millions-of-users scale with a stable paycheck, Duo is the right answer.

For a relocator, downtown Ann Arbor is the part of the story to understand. Duo's presence anchors a cluster of cybersecurity talent that shows up at Blumira, Censys, Arbor Networks/NETSCOUT, and freelance consultancies. Going to a2NewTech or a2Tech360 and not bumping into a Duo alum is close to impossible. That density matters for your career. If your current role does not work out, the next one is likely one or two handshakes away.

On housing, downtown Ann Arbor proper is the most expensive part of the Ann Arbor MSA. Duo employees typically cluster in a mix of downtown rentals, Burns Park, Ann Arbor Hills, and Old West Side for owners, and Dexter, Saline, or Chelsea for families who want more space and school options. Detroit Metro Airport (DTW) is 25 minutes away by car with Delta nonstops to most major hubs.

Other Ann Arbor cybersecurity companies

  • Censys - U-M spinout internet-intelligence company, downtown Ann Arbor
  • Blumira - cloud SIEM and XDR for mid-market, Duo-alumni-backed
  • Arbor Networks (NETSCOUT) - Ann Arbor's DDoS pioneer, historical lineage for Duo founder Dug Song
  • Barracuda Networks - Silicon Valley HQ with 45,000 sq ft R&D office in the former Borders headquarters downtown
  • SensCy - cybersecurity for small and mid-size organizations

See the full Ann Arbor cybersecurity companies hub.

FAQ

Who founded Duo Security? Duo was co-founded in 2010 by Dug Song, who had spent seven years as chief security architect at Arbor Networks, and Jon Oberheide, a University of Michigan computer science and engineering PhD who grew up in Troy, Michigan.

When did Cisco acquire Duo Security? Cisco announced the acquisition on August 2, 2018 and closed the transaction in October 2018. The deal was $2.35 billion in cash, making it the largest Ann Arbor tech exit to date.

Is Duo Security still based in Ann Arbor? Yes. Duo operates as part of Cisco's security portfolio, and the Ann Arbor office remains the largest concentration of Duo engineering, product, and research staff. Historical locations include 123 N. Ashley Street and the Liberty Square building downtown.

What does Duo Security do? Duo sells cloud-based multi-factor authentication, device trust, and zero-trust access. The core product is a push-based MFA app and access gateway used by IT teams to secure employee logins and remote access to internal and SaaS applications.

How much did Duo raise before being acquired? Duo raised approximately $121 million across Series A through D rounds from investors including True Ventures, Benchmark, Redpoint, Meritech, Lead Edge Capital, and Index Ventures.

What happened to the Duo founders after the Cisco deal? Dug Song served as Cisco Chief Strategy Officer and has since shifted to civic and investing work through the Song Foundation and the Michigan Founders Fund, which he co-chairs with Bhushan Kulkarni. Jon Oberheide co-hosts the "Inside the Network" podcast and is an active angel investor, including in Blumira's 2023 Series B.

Is Duo Security a good place to work? Inside Cisco, Duo retains strong engineering practices and stable compensation, but Glassdoor feedback trends more mixed than the independent era. Reviewers cite Cisco bureaucracy and reorg risk alongside strong peers and meaningful product scale.

How does Duo compare to Okta? Duo is historically strongest in MFA and zero-trust access. Okta has a broader identity platform, including identity governance and lifecycle management. For MFA-first deployments in Cisco shops, Duo tends to win. For identity-first deployments in mixed environments, Okta tends to win.