Can Notakey replace Duo for a RADIUS VPN without changing the RADIUS server?

Yes. The Notakey auth-proxy sits in front of your existing RADIUS server (FreeRADIUS, Microsoft NPS, User Manager) and is transparent to it. On the VPN, only the RADIUS server address and the timeout change.

Does Notakey have anything like Verified Duo Push?

No number matching. The Notakey approval card instead shows the service, the username and, where supplied, the IP address, so the user can see a login they did not start and deny it. Both approaches address push-bombing; Duo’s is the stronger explicit check for interactive logins.

Is Notakey cheaper than Duo?

At list price, Notakey’s per-user prices (€0.80 on-premise, €2.50 cloud, excluding VAT) are below Duo’s $3 to $9. Duo’s free tier covers 10 users against Notakey Cloud’s 6 (10 on-premise), so a team of 7 to 10 pays nothing on Duo’s free edition. Duo’s higher editions include features Notakey does not have, so compare what you will actually use.

Comparison · Cisco Duo

Notakey vs Cisco Duo: phone-approval MFA compared

For IT teams choosing a second factor for VPNs, firewalls, Windows and internal applications. Duo is the product most of them evaluate first; this page says where it is the better choice and where Notakey is.

Request a demo Try the live demo

The short version

Duo is a cloud service from Cisco with a very large integration catalogue, device-trust and risk policies, and phishing-resistant options such as FIDO2 security keys. If you want one vendor for everything from SaaS logins to device posture, and a cloud control plane is acceptable, Duo is the safer default.

Notakey is an authentication appliance you can run inside your own network or have us host, with a phone approval that shows the user what they are approving. It has no number matching; the readable approval card is its answer to push-bombing. It is the better fit when authentication must stay on-premise, when the systems to protect are RADIUS VPNs, firewalls, Linux servers, Windows Remote Desktop and legacy web apps rather than SaaS, or when you need transaction signing and not only logins.

Vendor facts checked on 13 October 2026. Prices are the vendors’ published list prices on that date and change without notice.

Aspect

Notakey

Cisco Duo

Where it runs: NotakeyOn-premise appliance (virtual machine) or cloud hosted by Notakey. Authentication records and the approval decision stay on your appliance; the push notification, with its short message, is delivered through Apple’s and Google’s push services.; Cisco DuoCloud service operated by Cisco. For RADIUS and LDAP, the Duo Authentication Proxy runs on a Windows Server or Linux host in your network and calls Duo’s cloud for the second factor.
Pricing (list, per user per month): NotakeyCloud: first 6 users free, then €2.50. On-premise: first 10 users free, then €0.80. Enterprise SLAs priced separately.; Cisco DuoFree up to 10 users. Essentials $3, Advantage $6, Premier $9. Under 100 users, licences are bought in increments of 10.
VPN and firewall over RADIUS: NotakeyThe auth-proxy ships inside the appliance (or as a container / MSI next to a cloud instance) and sits transparently in front of your existing RADIUS server, or the appliance’s own RADIUS plugin. Approval window 30 s by default.; Cisco DuoThe Authentication Proxy acts as the RADIUS server for the VPN; by default it sends an automatic Duo Push after the primary login, and users can append “,push” or a passcode to the password to choose a method. Duo recommends a 60-second client timeout.
MikroTik: NotakeyScript-based VPN 2FA with no RADIUS server at all, plus WinBox/WebFig/SSH logins over RADIUS. Both documented step by step.; Cisco DuoWe found no MikroTik-specific guide in Duo’s documentation; the generic RADIUS proxy applies, as with any RADIUS client.
Against push-bombing: NotakeyThe approval card names the service, the username and, where the integration supplies it, the requesting IP, with a countdown; a request the user did not start is denied with one tap and logged. No number matching.; Cisco DuoVerified Duo Push: the user types a code shown on the login screen into Duo Mobile, so a blind “Approve” is not possible. A stronger, explicit countermeasure for interactive logins; Duo’s RADIUS documentation does not mention it.
Phishing-resistant (site-bound) factors: NotakeyNot offered. Keys are device-bound and cannot be copied, but a real-time relay of a login through a fake page is not stopped by a phone approval.; Cisco DuoPhishing-resistant MFA and passwordless login with FIDO2 are listed from the Essentials edition up.
Transaction signing: NotakeyYes: the user signs a readable description of a payment, order or change on the phone, with PSD2 dynamic linking.; Cisco DuoNot a Duo feature; Duo authenticates logins.
Windows login: NotakeyWindows Credential Provider for local and Remote Desktop logins, optionally passwordless-only; works with on-premise Active Directory.; Cisco DuoDuo Authentication for Windows Logon and RDP; Verified Duo Push and offline access for console logons from Essentials up.
SSO, device trust, risk policies: NotakeyA SAML and OAuth/OpenID Connect SSO service ships with the appliance for your own applications. No device-posture checks, no risk-based policies, no VPN-less access.; Cisco DuoDuo SSO; Trusted Endpoints from Essentials; risk-based authentication and Cisco Identity Intelligence from Advantage; complete device trust and VPN-less remote access in Premier.
Vendor: NotakeySmall EU vendor (Latvia); support comes from the engineers who build the product.; Cisco DuoPart of Cisco.

Choose Duo if

You want one MFA vendor across hundreds of SaaS applications and already run, or accept, a cloud identity control plane.
Device trust, posture checks or risk-based policies are requirements, not nice-to-haves.
Your administrators need phishing-resistant factors such as FIDO2 security keys for the accounts that matter most.

Choose Notakey if

Authentication has to run inside your own network, on an appliance you control rather than a third-party cloud control plane, for policy, audit or data-residency reasons.
The systems to protect are RADIUS VPNs and firewalls, MikroTik, Linux SSH, Windows Remote Desktop and legacy web applications, with on-premise Active Directory as the user source.
You need transaction signing (payments, approvals, administrative changes) and not only logins.
Per-user cost at scale matters and you can run a virtual machine.

What Notakey does not do

No device-trust or endpoint-posture checks.
No risk-based or adaptive policies.
No passkeys or FIDO2 keys, so real-time relay attacks on a login page are not stopped.
No catalogue of pre-built SaaS integrations; SaaS applications connect through the SSO service with SAML or OAuth.
No telephone-call or SMS second factor (SMS is used only, optionally, to verify onboarding).

Frequently asked questions

Can Notakey replace Duo for a RADIUS VPN without changing the RADIUS server?: Yes. The Notakey auth-proxy sits in front of your existing RADIUS server (FreeRADIUS, Microsoft NPS, User Manager) and is transparent to it. On the VPN, only the RADIUS server address and the timeout change.
Does Notakey have anything like Verified Duo Push?: No number matching. The Notakey approval card instead shows the service, the username and, where supplied, the IP address, so the user can see a login they did not start and deny it. Both approaches address push-bombing; Duo’s is the stronger explicit check for interactive logins.
Is Notakey cheaper than Duo?: At list price, Notakey’s per-user prices (€0.80 on-premise, €2.50 cloud, excluding VAT) are below Duo’s $3 to $9. Duo’s free tier covers 10 users against Notakey Cloud’s 6 (10 on-premise), so a team of 7 to 10 pays nothing on Duo’s free edition. Duo’s higher editions include features Notakey does not have, so compare what you will actually use.

Sources

Product names are trademarks of their owners and are used only to identify the products compared.

← All comparisons

Notakey vs Cisco Duo: phone-approval MFA compared

See your first passwordless login this week