What Is Cisco Secure Client? The AnyConnect Successor, Module by Module

If you have ever connected to a corporate VPN, there is a decent chance you have used Cisco Secure Client, even if you still call it AnyConnect. Cisco renamed the client with version 5, and the old AnyConnect 4.x line is on its way out: software maintenance ended March 31, 2024, and application support ends March 31, 2027. That deadline is pushing a lot of IT teams to look at what Secure Client actually is now, what each piece does, and whether it is the right place to anchor web security. If you are also weighing Cisco's broader SSE roadmap, read our breakdown of Cisco Secure Access and the Umbrella migration first, because Secure Client is the on-ramp to it.

The short answer

Cisco Secure Client is Cisco's endpoint client for Windows, macOS, Linux, and mobile, formerly AnyConnect. It is best known as a VPN client, but Cisco describes it as a modular security client: one shell that hosts a VPN, Zero Trust Access, the Umbrella Roaming Security module, Secure Endpoint, network visibility, posture checks, and more. That design is the point to understand. Secure Client is a chassis, not a security control. Its web protection is whatever module and subscription you plug into it, and the default Umbrella roaming module works at the DNS layer, so having Secure Client installed rarely means HTTPS is being inspected. dope.security takes a different approach: one lightweight agent that performs SSL inspection on the device and sends traffic direct.

What is Cisco Secure Client?

Cisco's data sheet calls Secure Client the rebranded version of one of the most widely deployed security clients, and says that while AnyConnect is best known as a VPN, it is now more accurately a comprehensive security client offering a suite of services through a modular approach. The user interface looks much like AnyConnect with new branding. Under the hood, version 5 also folded in the former AMP for Endpoints agent as the Cisco Secure Endpoint module.

You can deploy it the traditional ways, from a Secure Firewall ASA or Firewall Threat Defense headend, through ISE, or with an MSI through SCCM or an MDM. Cisco also offers cloud deployment and management through Cisco Secure Client Cloud Management or Cisco XDR, which generates a lightweight bootstrapper that pulls down the modules and profiles you assign.

The modules, one by one

Most of the confusion around Secure Client comes from not knowing which modules a given laptop actually runs. Here is what Cisco documents.

• AnyConnect VPN. The core remote-access VPN, with TLS, DTLS, and IPsec IKEv2 tunnels, always-on options, a management tunnel for patching out-of-office machines, and split or full tunneling.
• Zero Trust Access. A newer module, available from Secure Client 5.1.3.62, that provides app-level access and is currently supported by Cisco Secure Access.
• Umbrella Roaming Security. DNS-layer security for roaming devices when the VPN is off, with Intelligent Proxy on Umbrella subscriptions. It requires a separate Umbrella subscription.
• Cisco Secure Endpoint. The former AMP for Endpoints, licensed separately.
• Network Visibility Module. Endpoint flow telemetry sent to a collector or Cisco XDR, only when the device is on a trusted network.
• ISE Posture and Secure Firewall Posture. Compliance checks before granting access. Secure Firewall Posture was formerly HostScan.
• Network Access Manager. Windows-only 802.1X wired and wireless access control.
• ThousandEyes Endpoint Agent. Network and application performance monitoring, licensed separately.

Count the licenses in that list. The client itself requires Cisco Premier or Advantage licensing. Umbrella, Secure Endpoint, and ThousandEyes each carry their own subscription, and ISE Posture needs ISE. The chassis is one install. The capabilities are several contracts.

How Cisco Secure Client handles web security

This is the part that matters most for a security leader, because it decides what actually gets inspected on a laptop at a coffee shop.

When the VPN is up in full-tunnel mode, web traffic rides the tunnel to your headend, and whatever sits there, a firewall or a cloud security stack, does the inspecting. When the VPN is down, or when traffic is split out of the tunnel, protection falls to the Umbrella Roaming Security module. Cisco's own data sheet describes that module as DNS-layer security when no VPN is active, using endpoint redirection to enforce DNS-based security, with Intelligent Proxy available on Umbrella plans. Full web inspection with URL paths, file inspection, and data controls requires Umbrella's cloud Secure Web Gateway on a SIG package, which proxies web traffic from the device to Cisco's cloud.

So there are three very different security postures hiding under one icon in the menu bar: tunnel to headend, DNS-only roaming, or proxy to Cisco's cloud. We unpack why the DNS layer alone falls short in is DNS filtering enough in 2026, and our deep dive on the Cisco Umbrella roaming client vs an endpoint SWG covers the roaming module specifically.

The AI governance test

The cleanest way to see the gap is a specific policy: allow the corporate ChatGPT workspace and block personal ChatGPT accounts on the same domain. Cisco's own documentation on this use case (doc 225162) says it needs the intelligent proxy, SSL decryption, and a root certificate installed on devices. DNS alone cannot do it, because both accounts resolve the same hostname. With only the roaming module in DNS mode, Secure Client cannot tell the two apart. dope.security Cloud Application Control makes that call on the device, restricting ChatGPT, Claude, Google, and Microsoft 365 to corporate tenants.

Does Cisco Secure Client slow things down?

The client itself is not the problem. The routes it chooses are. In full-tunnel VPN mode, every request from a remote laptop travels to the VPN headend, gets inspected or forwarded, and comes back. That is backhaul by definition, and it is why so many teams turn on split tunneling, which then hands web traffic to the DNS-layer module instead of a full inspection. Our guide to split tunnel vs full tunnel VPN covers that trade-off in depth.

When web traffic goes to a cloud SWG instead, the detour moves from your headend to the vendor's nearest point of presence. Measured cloud-proxy latency typically runs 40 to 80 milliseconds near a point of presence and 150 to 400 milliseconds when users are far from one, and a modern SaaS page chains dozens of requests. The math is in the latency math behind cloud proxy SWGs.

How much is the detour costing you? Run the Fly-Direct Speed Test to measure your real round-trip latency and compare a VPN or cloud-proxy detour with inspection on the device. See how dope.security's Fly-Direct Secure Web Gateway removes the stopover, or book a 20-minute demo to see it live.

The takeaway: split tunneling trades the detour for a blind spot, while on-device inspection removes the detour without creating one.

Known pain points worth planning for

Cisco's documentation and bug tracker are refreshingly explicit about the operational edges, and they are worth reading before a migration.

• Module sprawl. Every added module is another component to version, profile, and troubleshoot. Cisco also removed, in release 5, the ability of the Umbrella module to push automatic updates for all installed modules through the Umbrella cloud, so update orchestration now lives in your deployment tooling or Cisco's cloud management.
• Roaming client resource and compatibility issues. Cisco has documented high CPU conditions in the roaming client (bug CSCvy78761), TLS 1.3 handling problems, and conflicts between the roaming client and Microsoft 365 traffic.
• Root certificate dependence. Any HTTPS inspection through Umbrella requires installing Cisco's root certificate on every device, which brings the usual certificate-pinning breakage and bypass lists. We cover the fix in certificate pinning and SSL inspection.
• The AnyConnect 4.x deadline. Application support for AnyConnect 4.x ends March 31, 2027, so every remaining 4.x install needs a planned upgrade either way.

Cisco Secure Client vs the dope.security agent

Both are endpoint agents that deploy through MDM and follow users off network. They are built around different jobs. Here is the comparison, line by line.

• What the agent is. Cisco Secure Client is a modular shell whose security depends on which modules and subscriptions you add. The dope.security agent is itself an on-device SSL inspection proxy with URL filtering, anti-malware, Cloud Application Control, and Dopamine DLP built in.
• Web inspection off the VPN. Secure Client's roaming module provides DNS-layer security, and full inspection requires a cloud SWG subscription that proxies traffic to Cisco. dope.security inspects HTTPS on the device, on any network.
• Network path. Secure Client sends inspected traffic to a VPN headend or a Cisco cloud point of presence. dope.security flies direct to the destination, with up to 4x performance over legacy proxy SWGs.
• Corporate vs personal AI accounts. Cisco's documented approach needs the intelligent proxy, SSL decryption, and a root certificate. dope.security Cloud Application Control blocks personal ChatGPT, Claude, Google, and Microsoft 365 logins while allowing corporate tenants.
• Data in AI prompts. Dopamine DLP intercepts file uploads and AI prompts on the device and classifies them with zero-retention OpenAI APIs.
• Licensing. Secure Client needs Premier or Advantage licensing, plus separate subscriptions for Umbrella, Secure Endpoint, and ThousandEyes. dope.security runs SWG, CASB Neural, and DLP under one console.
• Footprint. The dope.security agent is Mac native and Windows, and uses less than 100 MB of RAM.

We ran the same analysis on the other big clients in the category: Palo Alto GlobalProtect, the Zscaler Client Connector, and the Netskope Client. The pattern repeats: the agent steers, and the engine lives somewhere else.

Do you still need Cisco Secure Client?

Often, yes, for part of the job. If you run Cisco firewalls and need remote access to private applications, the VPN module or Zero Trust Access is doing real work, and there is no reason to rip it out. The question is whether it should also be your web security. You can keep Secure Client for private access and let a dedicated on-device SWG handle internet traffic. The two run side by side, and we explain how in how dope.security works hand in hand with your VPN.

That split is also the fastest path off Umbrella. Greylock Partners replaced Cisco Umbrella with dope.security and went from first proposal to signed contract in 27 days, deploying through Intune in phases. Read how Greylock Partners made the switch. If you are comparing the wider field, our honest comparison of Cisco Umbrella alternatives covers it.

The bottom line on Cisco Secure Client

In one line: Cisco Secure Client is a capable container whose security is only as deep as the modules and subscriptions you load into it, and on a roaming laptop that usually means DNS, not a decrypted, inspected session. The AnyConnect 4.x deadline is a good moment to decide what the client should and should not be responsible for. If you want web security, AI tenant control, and DLP to live on the device and travel direct, that is what dope.security was built to do. Book a 20-minute demo and we will run the corporate-versus-personal ChatGPT test live, or read more about the Fly-Direct Secure Web Gateway.

Frequently Asked Questions

Is Cisco Secure Client the same as AnyConnect?

Yes. Cisco Secure Client version 5 is the renamed successor to the AnyConnect Secure Mobility Client, and the VPN inside it is still called AnyConnect VPN. Software maintenance for AnyConnect 4.x ended March 31, 2024, and application support ends March 31, 2027, with Secure Client 5 as the migration path.

Is Cisco Secure Client a VPN?

It includes a VPN, but Cisco describes it as a modular security client. Alongside the VPN it can host Zero Trust Access, the Umbrella Roaming Security module, Secure Endpoint, posture checks, network visibility, and ThousandEyes. Which of those a device actually runs depends on your deployment and licenses.

Does Cisco Secure Client inspect HTTPS traffic?

Not by itself. With the VPN on, inspection happens at the headend. With the VPN off, the Umbrella roaming module provides DNS-layer security, and full HTTPS inspection requires an Umbrella cloud SWG subscription and a Cisco root certificate on each device. dope.security performs SSL inspection on the endpoint itself.

Do I need a separate license for the Umbrella module in Cisco Secure Client?

Yes. Cisco's data sheet states that the Umbrella Roaming Security module requires a subscription to the Umbrella Roaming Security service through a DNS Security or SIG plan. Secure Endpoint and ThousandEyes are also licensed separately, and the client itself requires Premier or Advantage licensing.

Can Cisco Secure Client block personal ChatGPT while allowing corporate ChatGPT?

Not with DNS-layer protection alone, because both accounts use the same domain. Cisco's documentation says this requires the intelligent proxy, SSL decryption, and a root certificate. dope.security Cloud Application Control enforces the corporate-only split on the device, and Dopamine DLP inspects prompts and uploads before they leave.

Can I run dope.security alongside Cisco Secure Client?

Yes. Many teams keep Secure Client for VPN or Zero Trust Access to private applications and use dope.security for internet-bound web security, AI governance, and DLP. The dope.security agent deploys through MDM tools like Intune and inspects web traffic on the device, so it does not depend on the VPN being connected.