Security · Duo
Score your Duo deployment: app coverage (VPN / SSO / RDP / admin), policy shape, device trust, passwordless migration path, and bypass-code safety.
Most Duo deployments stall after protecting VPN. The value is in breadth — protect everything that takes a login, harden policy, and move to passwordless. This tool gives you a readiness score and the gaps to close.
You get a readiness score (0-100), a gap list, and a staged rollout plan from here. Scores below 60 usually mean Duo is protecting VPN only — good start, but not yet defense-in-depth.
All human logins pass through Duo (SSO or directly). Device trust enforced on anything that reaches production. WebAuthn passwordless for the main identity (Azure AD / Okta) with phone-app fallback. Bypass codes are help-desk-issued, short-lived, auditable. Risk-based policy: step-up to FIDO2 when anomaly score is high.
The #1 missed control: protecting privileged accounts. Domain Admins and cloud root users must have their own Duo policy — shorter trust intervals, mandatory FIDO2, geolocation fencing.
Essentials: MFA only. Advantage: adds device health, trusted endpoints. Premier: adds Risk-Based Auth and VPN-less remote access (Duo Network Gateway).
Push is the default but phishable via push-fatigue. WebAuthn (Windows Hello, Face ID, YubiKey) is phishing-resistant. Migrate privileged users first.
Score ~65. Next: enforce device trust on SSO, protect RDP, define strict bypass policy.
Score ~85. Next: enforce WebAuthn for privileged users, add Risk-Based Auth step-up, deploy DNG for VPN-less access.