How Cisco Duo secures identity for education institutions
Security leaders at universities, colleges, technical schools, and local K-12 school districts all share a common goal: to make learning safe and enjoyable for students and teachers from any location, and any device. With ransomware attacks targeting education rising 23% year over year in 2025, security teams face a formidable set of challenges around securing identity. Identity and access management (IAM) for education is the practice of verifying and controlling access for large, fast-changing populations of students, faculty, and staff across campus, remote, and BYOD environments. The core challenges include:
Keeping track of large, constantly changing user populations
Protecting sensitive personal information like social security numbers, payment data, and medical records
Rapid change as infrastructures evolve to support remote learning, BYOD, and cloud-based learning applications
Increasing risk from AI-powered phishing and MFA fatigue attacks targeting credentials
Whatever goals and hurdles they face, Cisco Duo helps CISOs at learning institutions level the playing field.
Duo delivers strong security through a flexible, far-reaching IAM solution
Many schools operate with limited budget and skills to level-up identity security. With limited resources compared to other sectors, security leaders are under pressure to protect highly privileged information and offer a fast, flexible user experience at the same time.
Duo offers an end-to-end identity and access management (IAM) solution that scales to help learning institutions protect thousands, or even tens of thousands of identities while improving their user experience and security posture at the same time. Diverse examples of learning institutions turning to Duo to solve identity security challenges include:
The University of Toronto, a global leader in learning, teaching and research, saw account compromise drop to nearly zero after rolling out Duo across more than 124,000 users. Duo also lowered operational costs by reducing the analyst hours spent on account recovery.
Eastern Michigan University (EMU), comprised of seven colleges and schools, was one of many colleges and universities to use Duo to strengthen its phishing-resistant authentication, protecting 26,000+ user accounts and secure servers across its multi-site infrastructure.
The School District of Philadelphia's Office of IT Security (OITS) relies on Duo to deliver strong security and an optimal user experience city-wide.
Trident Technical College, a two-year community college in South Carolina, leverages Duo in tandem with other Cisco Security solutions to advance its Zero Trust journey.
Virginia-based Washington and Lee University, one of the oldest colleges in the United States, used Duo's complete IAM solution to streamline cloud migration and support remote access.
Hundreds of other schools, colleges, and universities have adopted Duo's flexible, phishing-resistant multi-factor authentication (MFA), single sign-on (SSO), and identity intelligence to achieve similar benefits, sometimes choosing Duo over "free" MFA that comes bundled with basic security suites.
"Microsoft was free and easy, but we chose Duo because we trust Duo more," Trident College's CIO M.G. Mitchum explains, adding that, "For privileged accounts, for the real crown jewels, we put them behind Duo."
Duo puts security first, but keeps a premium on user experience
Complicated security is sometimes akin to no security at all because students and staff members will go to great lengths to avoid using it. Duo delivers security-first IAM that includes MFA, SSO, directory capabilities, and a completely passwordless authentication that's easy to adopt and even easier to use.
The University of Toronto's acting CISO Deyves Fonesca said, "The biggest concern for most researchers when it comes to a new solution is whether it will create more friction: Will it stand between them and the work? Can they still use the software that allows them to work most effectively?"
Andrew Speese, Deputy CISO at the School District of Philadelphia's Office of IT Security (OITS), a Duo Advantage customer since 2021, echoes the need to balance user satisfaction and strong security. "It's always about usability both on the IT admin side and user side," Speese says. "Duo gives us tons of options and flexibility to make the user experience very easy. We can go from SMS authentication to using tokens and run it all from one platform, and it all integrates and works 'super-easy' both for users and for my team."
Noting the Duo application makes it easy for non-technical people to ramp up identity security quickly, Speese calls this usability advantage "the number one reason I recommend Duo to other CISOs."
How Duo manages the student identity lifecycle
Cisco's recent survey of CISOs from a variety of industries highlighted the growing challenge of managing the "joiner, mover, leaver" (JML) lifecycle, especially as organizations extend more trust and privileges to AI agents and other non-human identities (NHIs). The challenge is front-and-center for security teams at high schools and higher education institutions where roughly a quarter of their user populations turns over every year.
Duo helps streamline the identity account management lifecycle with easy onboarding, flexible authentication options, and support for organizations' bring-your-own-device (BYOD) initiatives.
Users can self-enroll in MFA from any location without needing IT support, and IAM teams can quickly terminate access as students graduate or accumulate too many privileges. Complete visibility and granular control that decrease the risks associated with phased rollouts, overprovisioning, and centralized management of campus- or even city-wide deployments.
How Duo supports BYOD and remote learning in education
Duo helps progressive institutions like the University of Toronto extend flexible MFA options to users logging in from campus buildings, home, remote sites, and public Wi-Fi hotspots like coffee shops and bus stations. Further, higher education must protect a greater variety of operating systems and browsers. Fonesca recalls leading the university through a rapid transition to remote learning during COVID.
"A one-size-fits-all approach was off the table," the acting CISO said. "We had to find creative solutions to address the diversity of our campus while quickly maturing our cyber capabilities."
While allowing users to choose from a range of popular authenticators for a familiar login experience, Duo equips security analysts to enforce risk-based authentication policies that protect both school-issued laptops and personal devices from being compromised.
Schools also face challenges in supporting and securing BYOD initiatives that go hand-in-hand with hybrid learning. Trident College CIO M.G. Mitchum says Duo's ease of enrollment and onboarding helps the college support and extend phishing-resistant MFA across its growing BYOD initiative.
"We just have . . . too many endpoints that we don't own and we don't control, that we're being required to allow access. So, the challenge going forward, from a Zero Trust perspective, is ensuring those devices are in fact secure and that we do trust [them]," Mitchum says. "People saw how simple it was to implement, so it's been a very seamless and very, very good experience."
Cisco Identity Intelligence provides deeper insight into identity risk
Washington and Lee University in Virginia is one of many academic facilities to implement Duo MFA with Cisco Identity Intelligence (CII) across the college to bridge the gap between authentication and access and provide deeper insights into identity-based risk. As one of the oldest liberal arts universities in the U.S., the university's small security team plans to continue leveraging Duo's integration with CII to improve IAM into the future. Goals include consolidating and correlating more user data across the district's various security stacks.
IT Systems Analyst Karla Bunn says, "Cisco Identity Intelligence has already been invaluable in identifying attacks—for example, a student apparently trying to log in from multiple countries at the same time—and finding and removing old unused accounts."
Looking to the future, the next major challenges will likely center around AI. Like many learning institutions, the OITS team has already noticed "an explosion of different security-related use cases" stemming from the rise of generative AI. Speese says, "We're definitely seeing an uptick in phishing incidents and internal-facing phishing attacks in our environment."
Duo protects legacy investments while accelerating innovation
Many large, well-established organizations maintain decades-long investments in Active Directory. To support the consolidation and centralized management of identity providers (IdPs), Duo's Active Directory Defense capabilities deliver MFA insertion for legacy applications and hard-to-protect privileged access. It also adds rich on-prem context to Cisco Identity Intelligence, bridging visibility gaps and accelerates investigation and resolution of user issues.
Even schools whose mission includes fostering life-changing innovation struggle with their own modernization journeys. "Everyone is trying to digitize all the time and roll out new applications," says OITS's Andrew Speese, whose team manages nearly 25,000 Duo licenses as they protect employee and contractor identities across Philadelphia. "There's always some new educational app, or city-wide or district-wide initiative that's technology-enabled, and we end up playing in it."
While looking to adopt new learning applications, IT and security teams must maintain older, deeply entrenched technologies longer than other industry sectors. "We still have a lot of legacy systems so some of the things we inherited aren't great," Speese explains, noting the City of Philadelphia uses Central Authentication Service (CAS), an open source SAML platform as a more cost-effective solution for enabling SSO than Microsoft Active Directory (AD). Duo helps bridge the gap between affordability and control.
"We use the Duo reporting feature constantly because it sits at the front door for everything and pulls everything in," explains Speese. "We get all this nice context-driven data that's difficult to achieve with any other tool because every other identity tool on the market was developed for Active Directory."
Accelerating zero trust and passwordless in education with Cisco
Trident College uses the Duo Advantage edition in conjunction with other Zero Trust, WiFi, and firewall solutions from Cisco as part of a coordinated effort to protect more than 14,000 students. CIO M.G. Mitchum says working with one strategic partner delivers greater value than implementing a bunch of point solutions.
"Chasing the best of breed was not working for us," he explains. "It was expensive; we weren't implementing it." Standardizing around Cisco security solutions also helps the college reduce costs by making it easier for analysts to ramp up and manage multiple technologies. "It takes time to get people up to speed," Mitchum notes. "I needed technology that looked similar, acted similar, and had the same support structure so I didn't have to reinvent the wheel each time."
Start securing education with Duo today
The success stories described here are just a few examples of how educational institutions and other organizations use Duo's complete IAM solution to resolve a wide range of identity security challenges. Browse through our Resource Center to read these and other case studies in their entirety.
Learn more about Duo for Higher Education and Duo for K-12 Education, or reach out and see how Duo can help your organization today.