In short
Cisco Multicloud Defense is ordered as MCD-SEC-SUB, licensed on gateway hours aggregated across your clouds, in units of 100, at the Advantage or Premier tier. The hours are bought for a 12 to 60-month term, 36 by default, with a support code added. Forever Systems, a Cisco Partner, sizes and quotes it, with terms confirmed at quote.
Get a quote for Cisco Multicloud Defense licences
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What Cisco Multicloud Defense protects
Cisco Multicloud Defense applies one network security policy across Amazon Web Services, Microsoft Azure, Google Cloud, Oracle Cloud Infrastructure and private cloud. It deploys gateways that stop inbound attacks, prevent lateral movement between workloads and block data leaving through unapproved routes. It comes in two tiers:
| Capability | Advantage | Premier |
|---|---|---|
| Visibility across unlimited cloud accounts | Yes | Yes |
| Outbound FQDN filtering, malicious IP and geography blocking | Yes | Yes |
| IPS/IDS with Cisco Talos threat intelligence | Yes | Yes |
| TLS decryption and third-party integrations | Yes | Yes |
| URL filtering, DLP, web application firewall, API rate limiting, antivirus | Not included | Yes |
| Multicloud connectivity and hybrid segmentation | Not included | Yes |
| Threat Defense Virtual based gateway with Threat, Malware and URL licensing | Not included | Yes |
For the product itself and where it fits with Cisco's other firewalls, see Cisco Multicloud Defense (opens in a new tab) on our Cisco security site.
Not sure which tier fits? Ask us
Tell us what you need and we will recommend the right tier for your organisation, with a quote.
How Cisco Multicloud Defense licensing works
Multicloud Defense is ordered as MCD-SEC-SUB, which sits under the Cisco Security Cloud Control subscription. You buy an amount of gateway hours, aggregated across all your cloud environments, at either the Advantage or the Premier tier. The hours are entered as an estimate and converted to units of 100.
- Bought for the term: Cisco is clear that although licensing is based on consumption, it is not pay-as-you-go. The hours are bought for the subscription term, and more can be added to a current subscription in 1, 3 or 5-year intervals through Cisco's Change Subscription process.
- Term: 12 to 60 months, with 36 months as the default. Prepaid term billing is the default, and annual billing is an option.
- Support: Enhanced Support (SVS-MCD-SUP-E) or Premium Support (SVS-MCD-SUP-P) is added to the subscription automatically and can be swapped between the two.
- Threat Defense Virtual gateways: when Multicloud Defense orchestrates Threat Defense Virtual instances, they can run on Premier gateway hours or on traditional Smart Licences; only the virtual firewall licences included with Premier count against your gateway hours. This needs a Security Cloud Control Firewall Management subscription, and the traditional codes are on our Cisco Secure Firewall part numbers page.
Cisco shows the tier gateway-hour items only inside its ordering tool, so the tier line is confirmed at quote under MCD-SEC-SUB.
Cisco Multicloud Defense part numbers
Codes from Cisco's Multicloud Defense ordering guide. Order MCD-SEC-SUB with your tier and gateway-hour quantity, plus one support code. The tier gateway-hour item is configured under MCD-SEC-SUB and confirmed at quote.
| Part number | Description | Unit | Term | Route | Basket |
|---|---|---|---|---|---|
| MCD-SEC-SUB | Multicloud Defense subscription, Advantage or Premier gateway hours | Gateway hours, in units of 100 | 12 to 60 months | Annual | |
| SVS-MCD-SUP-E | Enhanced Support for Multicloud Defense, with Customer Success onboarding | One per subscription | Same term as the subscription | Annual | |
| SVS-MCD-SUP-P | Premium Support for Multicloud Defense, with onboarding, adoption and lifecycle management | One per subscription | Same term as the subscription | Annual |
Part numbers from Cisco Multicloud Defense Ordering Guide (updated 24 August 2025) (opens in a new tab), checked 2026-11-08. Add the licences you need to your basket and request a quote: we confirm the right part numbers, quantities and terms when we quote.
Is Cisco Multicloud Defense licences the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Sizing gateway hours
Cisco's ordering guide sizes Multicloud Defense from the number of enforcement points and how long they run. Its worked example: one gateway running all the time averages 730 hours a month (365 days of 24 hours, divided by 12). Divide by 100 and round up, so one gateway running continuously needs 8 units. The hours reset each month, so the figure is your typical monthly use rather than a running total.
To size your own estate, count the gateways you expect in each cloud and region, including any extra instances that scale out at busy times, multiply by their average hours a month, then add the totals. We can work through this with you from your cloud architecture.
Cisco monitors consumption rather than enforcing a hard limit. If you go over the hours bought, traffic and features carry on; if use runs well beyond them, Cisco notifies the customer so the subscription can be brought into line. Extra hours are added through Change Subscription, which keeps everything on one subscription. Multicloud Defense renews through the same process, with an invoice at the start of each annual term.
Multicloud Defense in the Cloud Protection Suite
Multicloud Defense can also be bought inside Cisco's Cloud Protection Suite. Cisco's guide says Cloud Protection Suite Gateway Essentials includes Multicloud Defense Premier together with Threat Defense Virtual licences, which suits organisations protecting both data centre and public cloud workloads with one subscription. See Cisco security suites part numbers for the suite codes, and Cloud Protection Suite (opens in a new tab) for what the suite covers.
Multicloud Defense can also be bought through a Cisco Enterprise Agreement, where it is switched on as an option within the enterprise-wide commitment. For other cloud and network security options, see firewall software.
How we help
Tell us which clouds and regions you run, how many gateways you expect, whether you need the Premier features such as the web application firewall and DLP, and whether you also run Cisco firewalls on premises. We estimate the gateway hours, recommend the tier and support level, and check whether the Cloud Protection Suite is the better buy.
Add MCD-SEC-SUB and a support code to your basket and send it, or describe your cloud estate, and we reply with a quote showing the tier, gateway hours and term. Contact us to get started.
How Forever Systems supplies your software licences
Forever Systems supplies business software subscriptions to UK organisations from one account, with one invoice and a team who know the products.
- Help choosing the right edition: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from our engineers, not just a reseller account
- Consolidated billing and renewal reminders to help stop subscriptions lapsing unexpectedly
We can supply businesses, schools, charities and public sector organisations of all sizes.
Frequently asked questions
What is a gateway hour in Cisco Multicloud Defense?
One Multicloud Defense gateway running for one hour. Hours are aggregated across all your clouds and bought in units of 100; Cisco's example puts one gateway running all the time at about 730 hours, or 8 units, a month.
Is Cisco Multicloud Defense pay as you go?
No. Licensing is based on gateway hours, but the hours are bought for a 12 to 60-month term, 36 by default. More hours can be added to the same subscription during the term.
What is MCD-SEC-SUB?
It is the subscription part number for Cisco Multicloud Defense, offered under the Cisco Security Cloud Control subscription. The tier (Advantage or Premier) and the gateway-hour quantity are configured under it, and a support code is added automatically.
What is the difference between Advantage and Premier?
Advantage covers visibility, outbound filtering, IPS/IDS, Talos threat intelligence and TLS decryption. Premier adds URL filtering, DLP, a web application firewall, API rate limiting, antivirus, multicloud connectivity, hybrid segmentation and Threat Defense Virtual based gateways.
Still have a question about Cisco Multicloud Defense licences?
Ask us and a member of our team will get back to you.