Protectimus vs Duo Security: A Complete MFA Comparison

Posted By Cyber Max on Nov 16, 2018 | 0 comments

Duo Security and Protectimus are both OATH-based multi-factor authentication providers, but they differ in deployment model, hardware token support, and pricing structure. This comparison covers server-side deployment, supported technologies, features, authentication methods, hardware token support, and pricing to help you decide which fits your environment.

Quick Verdict

Duo Security is a cloud-based MFA service from Cisco built around push notifications in the Duo Mobile app. Protectimus covers the same core MFA scenarios but can be deployed either as a cloud service or entirely on your own servers, and supports a wider range of one-time password delivery methods, including its own line of OATH hardware tokens. If you need on-premise deployment or hardware tokens at scale, Protectimus is usually the better fit. If your infrastructure is built around Cisco and you prefer a fully managed cloud service, Duo is a natural choice. 

DON’T LIKE LONG READS? FIND OUR CONCLUSIONS IN A COMPARISON TABLE AT THE END OF THE ARTICLE.

1. Server-side component

Duo Security

Duo is a cloud-based 2FA solution. The choice of the SaaS model is completely logical. It makes integration fast and reduces the cost of deploying, protecting, and maintaining an authentication server. This style of interaction is convenient and easy for the client and company alike. In addition, it’s a rather modern approach to strong authentication, so it fits well with Duo Security’s concept as a modern, innovative provider of revolutionary MFA solutions.

Protectimus

Protectimus two-factor authentication solution is available not only in cloud-based form but also as an on-premise platform.

Often, we advise customers to choose the cloud-based service, since it’s convenient, fast, and modern. Clients connected to the Protectimus SaaS service don’t need to waste time and money on extra equipment, security measures, and sysadmin salaries — there’s no load balancing or other infrastructure issues to worry about. The result is rapid integration with minimal costs.

However, some companies can’t make use of cloud-based services because of strict information security rules, either from within the company or imposed by the government. For these cases, we made it possible to purchase an on-premise platform that clients can install in their own environments, allowing them to retain full control of the authentication server. For organizations that need MFA tied directly to their directory service, Protectimus also offers directory-level MFA for Active Directory. Both the on-premise platform and cloud-based service are available with a subscription. Lifetime licenses for the platform can also be purchased.

You can find out more about the differences between the cloud-based service and the platform here.

2. Features

Duo Security

Note: Nearly all features examined in this section can be activated only with Duo’s most expensive payment plans, Access and Beyond. Self-service is also available in the Duo MFA basic plan.

Most of Duo’s advanced access controls are available only in its higher-tier plans. User self-service is included in the basic paid plan.

• User self-service – users enroll and manage their own devices, which saves administrators time.
• Geographic filters – access can be allowed only from specific countries or blocked from selected ones.
• Network- and IP-based access control – access from anonymous networks such as Tor or from specific IP ranges can be blocked or allowed.
• Role-based access policies – stricter authentication rules for users with higher privileges, for example hardware tokens only for network administrators.
• Device health monitoring – with Duo Mobile installed, administrators can check whether a device has a screen lock, an up-to-date operating system and browser, or has been rooted, and block access from devices that don’t meet the requirements.

You can find out more about these features by reading “Duo Security vs Protectimus: Features.”

Protectimus

Note: All features examined in this section are available with all payment plans, including the no-cost Protectimus Free plan.

All of the features below are available in every Protectimus plan, including the free one.

• User self-service – users issue and manage their own tokens.
• Geographic filters – access can be allowed only from specific countries or blocked from selected ones.
• Time-based filters – access is granted only at set times, for example during business hours. Even if a token is left at the office, nobody can use it after hours.
• Adaptive authentication – Protectimus analyzes the user’s environment (browser, operating system, language, screen resolution and other parameters) and asks for a one-time password only when the mismatch threshold is exceeded.
• Resources and delegated administration – users are grouped into resources, each with its own administrators and authentication rules. For example, a payment system can keep a convenient resource for customers and a stricter one for administrators, where only hardware tokens are allowed and time and location filters are enabled.
• Different token types for different users – administrators decide which authentication methods are available in each resource or assign a token to a specific user.
• CWYS (Confirm What You See) data signing – one-time passwords are generated from the data of the current operation, such as the amount and currency of a transfer, so an intercepted password cannot confirm any other operation. This protects against phishing, man-in-the-middle attacks and banking trojans.

Protectimus does not scan users’ devices the way Duo does, but the system can be customized to provide equivalent checks on request.

You can find out more about these features by reading “Duo Security vs Protectimus: Features.”

3. Technologies

Duo Security

Duo’s two-factor authentication system is built on the principles of asymmetric cryptography. The private key is stored on the user’s smartphone, while the public key is stored on the authentication server. First, the authentication server communicates with the Duo Mobile application. The user confirms the action, the communication is signed with the private key, the request returns to the server, the signature is verified with the public key, and the user gains access to the resource. This is a good approach. It guarantees that even in the event that Duo Security’s servers become compromised, an attacker cannot gain access to users’ accounts. However, asymmetric cryptography only works with Duo Push.

As an alternative to push notifications, Duo offers good old one-time passwords generated based on a shared secret and a counter. The Duo Mobile app and Duo hardware tokens use the HOTP (HMAC-based one-time password) algorithm to generate OTPs. While the HOTP algorithm does meet two-factor authentication standards, it is quite outdated. The problem lies in the fact that HOTP passwords remain current until used (compared to TOTP and OCRA, under which passwords are valid for no more than 60 seconds). Suppose that a third party is able to gain control of an HOTP token for one minute. All the third party needs to do is generate and write down a series of passwords and use one of them before the account owner notices something is wrong. The actual user will no longer be able to access the account, since the HOTP token will have become desynchronized from the server.

This deficiency in HOTP algorithm is the reason for the shift toward the more modern one-time password generation algorithms: TOTP (Time-based One-Time Password) and OCRA (OATH Challenge-Response Algorithm). The moving factor in these algorithms is time (and not a counter, like HOTP’s). One-time passwords generated using the TOTP algorithm remain valid for just 30 or 60 seconds. And thanks to OCRA, the CWYS data signing functionality described in the Features section above is available.

Duo Security allows connecting third-party TOTP hardware tokens to its 2-factor authentication service but doesn’t recommend it as there is no functionality for time synchronization in its MFA system.

U2F tokens can also be connected to Duo’s service. You can read more about U2F here. The principles of U2F are somewhat similar to those of asymmetric cryptography, described above.

Protectimus

The Protectimus two-factor authentication solution is fully compliant with the OATH (Initiative for Open Authentication) standards. Protectimus 2FA service supports all OATH one-time password generation algorithms: HOTP, TOTP, and OCRA.

HOTP, TOTP and OCRA algorithms presuppose one-time passwords’ generation based on a shared secret and some variable. For HOTP, this variable is an event counter. For TOTP, it’s the current time, and for OCRA, it’s the time and a specific data set. The algorithms work like this: the token takes the current variable and shared secret, hashes them, and ends up with the one-time password. The user sends this one-time password to the server, which performs the same calculations in turn and compares the values. If the values match, the user is granted access to their account.

You can find out more about how one-time passwords work here.

All OATH algorithms are publicly available standards, and they have been tested for vulnerabilities by thousands of hackers. All the flaws in these algorithms have been identified, and 2FA providers learned to deal with them long ago — there will be no surprises when it comes to security. Shared secrets stored on Protectimus servers are encrypted using an HSM (hardware security module). In the event that the Protectimus authentication server is compromised, an attacker will be unable to compromise the shared secrets.

4. Authentication methods

Duo Security

• Duo Push – the user approves a login by tapping “Approve” in the Duo Mobile app. Push requests also alert the user to unauthorized login attempts. Push requires an internet connection on the phone.
• Duo Mobile passcodes – the app generates HOTP passcodes for Duo-protected logins and TOTP codes for third-party services such as Google or GitHub. Duo Mobile has no time synchronization for TOTP.
• Hardware HOTP tokens – Duo supports HOTP tokens from any vendor and sells its own. HOTP uses a counter as the moving factor, so codes written down from a token stay valid until they are used.
• Third-party TOTP hardware tokens – can be connected, but Duo does not recommend it because its system has no time synchronization for tokens.
• U2F security keys – USB keys such as YubiKey, activated by touching the key.
• SMS passcodes, voice calls and backup codes – convenient fallback options, but SMS can be intercepted or redirected through SIM swapping, and backup codes stay valid much longer than a one-time password.

In “Duo Security vs Protectimus: Authentication methods”, we take a closer look at all the one-time password delivery options Duo offers its users, including their strengths and weaknesses.

Protectimus

• Protectimus Smart app – generates HOTP, TOTP and OCRA one-time passwords, works offline, can be protected with a PIN or fingerprint, supports 6- or 8-digit codes and token backup, and also works with third-party 2FA systems.
• Push notifications – the user confirms a login with one tap, just like with Duo.
• Hardware OATH tokens – HOTP, TOTP and OCRA tokens with pre-installed secret keys. They work offline and cannot be compromised by malware on the user’s device.
• Programmable TOTP tokens – Protectimus Slim NFC tokens can be programmed with a new secret key using an NFC-enabled Android smartphone, so they work with almost any service that supports 2FA.
• Third-party tokens – existing HOTP, TOTP or OCRA tokens from any vendor can be connected if you have their secret keys.
• SMS and email – available for users who need them. SMS can be combined with CWYS data signing, and on-premise customers can connect their own SMS provider via SMPP.
• Protectimus Bot – one-time passwords and login confirmations are delivered through messaging apps such as Telegram, Viber and Facebook Messenger, with no extra app to install.
• Unlike Duo, Protectimus does not support U2F keys, voice calls or backup codes.

You can find out more about each authentication type offered by Protectimus in “Duo Security vs. Protectimus: Authentication methods“.

Hardware token support

Hardware tokens are one of the main differences between the two solutions. Duo relies mainly on HOTP hardware tokens and FIDO2 security keys, and does not recommend connecting TOTP tokens because its system cannot synchronize token time. Protectimus supports hardware HOTP, TOTP and OCRA tokens, keeps TOTP tokens synchronized with the server, and also offers programmable TOTP tokens that can be reassigned to a new service.

Protectimus also supplies its own OATH hardware tokens, including programmable models that work with any TOTP-based service. For organizations that cannot rely on employees’ personal smartphones, this makes hardware tokens a practical default rather than an exception.

5. Integration

Duo Security

Duo provides an enormous assortment of plugins and an SDKs (Software Development Kits) for convenient integration with client systems. For paid plans, an API is also available. All documentation is provided on the company’s site.

Protectimus

An API for integration with the Protectimus service is available even with the free plan. SDKs for popular programming languages (Java, PHP, Python) and an assortment of plugins have been developed to enable integration with just a few clicks. It’s worth noting that the number of plugins available is less than that offered by Duo, but we’re always working to expand the opportunities for integration with Protectimus. All integration-related documentation is openly accessible on the company’s site.

6. Pricing

Duo Security

Duo offers a free plan for up to 10 users. It includes basic multi-factor authentication, standard integrations and the Duo Mobile authenticator app, but most of the access controls described in the “Features” section are not available on it. Hardware tokens are not included in any plan and must be purchased separately.

Paid plans are priced per user, per month, and each higher tier includes everything from the previous one:

• Duo Essentials – US$3 per user per month. The entry-level paid plan adds phishing-resistant MFA, passwordless authentication, single sign-on, trusted endpoints and unlimited protected applications. It suits organizations that need reliable MFA and SSO without advanced access policies.
• Duo Advantage – US$6 per user per month. Duo’s most popular plan adds risk-based authentication, session theft protection, Active Directory defense and Cisco Identity Intelligence, which analyzes identity data to detect suspicious activity. This is the tier where most of Duo’s adaptive access features become available.
• Duo Premier – US$9 per user per month. The full package, including complete device trust with endpoint protection verification and VPN-less remote access to private resources. It is aimed at organizations building a complete zero trust architecture around Duo.

For self-service subscriptions, licenses are sold in increments of 10 users for teams under 100 users and in increments of 25 users above that, so the actual bill can be higher than the per-user price suggests. All paid plans come with a 30-day free trial.

Because Duo is a fully cloud-based service, there is no up-front infrastructure cost and no local authentication server to maintain. On the other hand, there is no on-premise option for organizations whose security or compliance requirements call for keeping authentication data in-house, and features such as advanced access policies are available only on the more expensive tiers.

Prices as listed on duo.com, October 2026.

Protectimus

Protectimus customers receive a modern two-factor authentication solution at least as good as that of Duo and other competitors — often better — and it’s cheaper. The cost of support for a single user in the Protectimus system starts at US$1 per month, and the more users you add, the lower the cost per user. All features are available regardless of the plan you choose, even if you choose the free plan.

As with Duo, up to 10 users, Protectimus strong authentication solution is free. Customers can nonetheless access all of the Protectimus cloud service’s features. (Note: additional resources, filters, administrators, SMS, and hardware tokens must be paid for separately.)

Paid cloud plans:

• Starter: US$33 per month. Includes 23 users and 1 resource.
• Business: US$111 per month. Includes 77 users, 2 resources, 2 filters (geographic and time-based), and 1 additional administrator.
• Custom: US$2 per user per month. Any number of users, resources, administrators, and filters, configured individually.

The Protectimus on-premise platform starts at US$199 per month for up to 99 users, with each additional user at US$2. A clustered high-availability setup starts at US$299 per month. Lifetime licenses are also available for enterprise customers. For questions about service or platform pricing, contact sales@protectimus.com.

Like Duo, the Protectimus cloud service has no up-front costs. The main pricing difference is deployment: Protectimus can also run on your own servers or in a private cloud, which Duo does not offer.

7. When to Choose Which

In this overview, we’ve tried to touch on all the important aspects of choosing a two-factor authentication provider. As you might expect, these two systems with a modern approach to MFA offer a range of similar features. There are, however, some unique functions: Duo features end-user device security monitoring, while Protectimus offers data signing, reflashable hardware tokens, and delivery of one-time passwords in messengers.

Choose Duo if your infrastructure is built around Cisco, you want a fully managed cloud service, and push notifications in a mobile app are the main authentication method you plan to use.

Choose Protectimus if you need to keep the authentication server on-premise, plan to use hardware tokens – including programmable ones – at scale, need time-based access filters or CWYS data signing, or want full functionality and API access on every plan, including the free one.

For Windows environments, Protectimus provides MFA for Active Directory that can run entirely on-premise. If you are also evaluating identity platforms, see the Protectimus vs Okta comparison, or read how Protectimus compares with RSA SecurID.

FAQ

Is Protectimus a good alternative to Duo?

Protectimus covers the same core MFA scenarios as Duo – VPN, Windows and RDP login, Microsoft 365 and web applications – and adds an on-premise deployment option and its own line of OATH hardware tokens.

Can Duo be deployed on-premise?

Duo is delivered as a cloud service. Components such as the Duo Authentication Proxy run in your network, but authentication is processed in Duo’s cloud. Protectimus can be deployed either as a cloud service or entirely on your own servers.

Do Duo and Protectimus support hardware tokens?

Both support OATH hardware tokens. Protectimus manufactures its own TOTP tokens, including programmable models, while Duo relies mainly on HOTP tokens and FIDO2 security keys.

Is there a free version of Protectimus?

Yes. Protectimus is free for up to 10 users with full functionality, including API access.

1. ↑The Duo Mobile app supports TOTP for third-party services, also you can use third-party hardware tokens with Duo 2FA service.
2. ↑Only third-party TOTP tokens.
3. ↑Currently, Protectimus Bot is available on Telegram, Viber, and Facebook Messenger
4. ↑API available only with paid plans

Read more

• How does 2-factor authentication work?
• The Evolution of Two-Step Authentication
• The Pros and Cons of Different Two-Factor Authentication Types and Methods
• Mobile Authentication Pros and Cons
• How to Backup Google Authenticator or Transfer It to a New Phone
• Protectimus New OTP Tokens
• Why US, Canadian, and EU Universities Choose Programmable Hardware OTP Tokens

Image and logo source: duo.com