Solutions
Cloud PKI, cloud RADIUS, passwordless onboarding, all in one platform.
Cloud PKI for Azure, Intune, and Entra ID
The best cloud RADIUS for Microsoft environments
Entra ID authentication to SSH endpoints
Passwordless security key and smart card onboarding for Entra ID
Eliminate SSL certificate outages and vulnerabilities
Blog
Partner
Your trusted partner for passwordless security
Join our global partner network
If your Cisco ISE deployment is doing the one job of authenticating users and devices onto your network, Keytos Shield is a great alternative that can do it without any appliances to size, patch, or upgrade. Keep the Cisco switches and access points you already own.
1,200+
Global organizations
trust Keytos
45M+
RADIUS authentications
per month in EZRADIUS
7.3M+
Cryptographic operations
per month in EZCA
20+
Deployment regions
around the globe
Cisco ISE is a capable NAC platform for enterprise networks. But it's also an infrastructure project.
Fully hosted, with no nodes to size, patch, back up, or fail over
Live in under an hour, with no professional services engagement
Real-time Entra ID group checks through Microsoft Graph, with no directory sync
Intune compliance enforced on every authentication, not just at enrollment
Cloud certificate authority included, with no separate PKI to stand up
Published price from $1.50 per user per month, month to month
You size, deploy, patch, and upgrade policy and monitoring nodes yourself
Deployments and major upgrades are planned projects with node sizing and pre-upgrade checks
Entra ID authorization needs release 3.2 or later, configured as a REST identity source
MDM compliance and posture are Premier-tier features, not part of the base licence
The internal CA is tied to ISE and is not a general purpose PKI for the rest of your estate
Quote-only licensing by active endpoint, plus separate perpetual per-node VM licences
Cisco ISE is a full network access control suite and Keytos Shield is a network authentication platform. They overlap on 802.1X, certificates, and policy, and they diverge after that. Both sides of that are in the table.
| Capability | |
Cisco ISE |
|---|---|---|
| Pricing | $1.50 per user per month, or less See pricing by company size |
Quote only. Licensed by active endpoint across Essentials, Advantage, and Premier tiers, plus separate perpetual VM licences |
| Delivery model | Multi-tenant SaaS across 20+ regions, with nothing to rack or patch | Self-managed appliances or virtual machines that you size, patch, and upgrade |
| Typical time to first authentication | Under an hour, self-service | A planned project: node sizing, installation, and pre-upgrade checks, commonly with a Cisco partner |
| Wi-Fi, wired 802.1X, and VPN with EAP-TLS | Yes, certificate-first | Yes |
| Works with your existing Cisco and Meraki hardware | Yes, any 802.1X-capable switch, controller, or access point | Yes, with the deepest integration on Cisco hardware |
| Legacy and non-certificate endpoints | Yes, PEAP, EAP-TTLS, MS-CHAPv2, PAP, and MAC authentication bypass | Yes |
| Dynamic VLAN assignment from identity | Yes, from Entra ID group membership | Yes, from ISE policy using Active Directory, LDAP, or Entra ID attributes |
| Microsoft Entra ID integration | Yes, live Microsoft Graph lookups with no directory sync or connector, on every plan | Yes, from release 3.2, with Entra ID added as a REST identity source for EAP-TLS and TEAP authorization |
| Device compliance enforced at authentication | Yes, live Intune compliance check on every connection, included in the base plan | Yes, through the posture agent or Intune as an MDM server. Both are Premier-tier features |
| General purpose certificate authority | Yes, EZCA issues certificates for devices, servers, Azure Key Vault, and IoT, not just network access | Internal CA scoped to ISE endpoints |
| Intune SCEP, Jamf, and ACME certificate delivery | Yes, and EZCA is listed in Microsoft's Intune SCEP documentation | SCEP supported. Not a Microsoft-listed Intune SCEP partner CA |
| BYOD onboarding without an MDM | Yes, Keytos Connect for Windows, macOS, iOS, iPadOS, Android, and Linux, included at no extra cost | Yes, through the ISE BYOD portal, in the Advantage tier |
| Encrypted RADIUS transport | Yes, RadSec (RADIUS over TLS) alongside classic RADIUS endpoints | Yes, RADIUS over DTLS |
| Network access when the internet is down | Yes, with a local RADIUS proxy container that caches credentials and policy on your network | Yes, nodes run on your own network |
| HSM-backed certificate authorities | Yes, FIPS 140-3 Level 2, or Level 3 on Premium | The internal CA keeps its keys on the ISE nodes. Release 3.3 adds TPM-based key protection; external HSMs are not documented |
| Log retention and SIEM export | 1 year included, with export to Microsoft Sentinel or any SIEM | Retention depends on the monitoring node you size and run |
| Azure GCC High support | Yes, at no additional cost | Runs where you deploy it, including government environments |
| Deploy and bill through the Azure Marketplace | Yes, deploy in a few clicks | Deployable from the Azure Marketplace as a bring-your-own-licence virtual appliance. The licence still comes from Cisco or a partner |
| Self-service, fully featured, 1-month free trial | Yes, with no credit card or sales call required | Evaluation licenses through Cisco or a partner |
| Minimum purchase or long-term contract | None. Start with one user and cancel at any time | Subscription terms of 1, 3, or 5 years |
| SSH certificates for GitHub and Linux | Yes, with EZSSH | No |
| TACACS+ device administration | No. Keep Cisco ISE or another TACACS+ service for this | Yes, with a separate perpetual Device Administration licence per Policy Service Node |
| Endpoint posture agent and remediation | No agent of its own. Compliance comes from Intune | Yes, in the Premier tier |
| Device profiling and endpoint classification | No | Yes, in the Advantage tier |
| TrustSec and SGT-based segmentation | No. VLAN and reply attributes only | Yes, in the Advantage tier |
| Identity sources | Microsoft Entra ID only | Active Directory, LDAP, ODBC, RADIUS token, RSA SecurID, and Entra ID. SAML providers such as Okta are for portal sign-in rather than 802.1X |
| G2 review score | 4.8/5 | See G2 for current Cisco ISE ratings |
Cisco ISE is a genuinely capable network access control platform, and it does things Keytos does not. We would rather tell you now than halfway through a migration.
TACACS+ device administration. If ISE controls who can log in to your routers, switches, and firewalls, and which commands they can run, Keytos does not replace that. Keep the ISE Device Administration licences, which are perpetual and bought per Policy Service Node, or move that function to another TACACS+ service.
Endpoint posture and remediation agents. ISE can run an agent that inspects the endpoint itself, checking for a specific process, file, patch level, or antivirus state and quarantining the device until it is fixed. ISE can also read Intune compliance instead of running its own agent, though both that and posture sit in the Premier licence tier. Keytos enforces compliance through Intune in the base plan, which covers most Microsoft-managed fleets but is not the same as an on-device agent.
Device profiling and classification. ISE fingerprints unknown devices from their network behavior to work out what they are. Keytos authenticates endpoints you have already decided to trust, so profiling an unmanaged estate is not something it does.
TrustSec and SGT segmentation. If your segmentation design is built on security group tags propagated across Cisco infrastructure, that is Cisco-specific and stays with ISE. Keytos assigns VLANs and RADIUS reply attributes.
An identity source other than Entra ID. ISE authenticates against Active Directory, LDAP, ODBC, RADIUS token servers, and RSA SecurID as well as Entra ID. Keytos builds network policy from Entra ID groups and Intune compliance only, so if your users do not live in Entra ID, Keytos is not the right fit today.
Plenty of teams keep ISE for wired NAC, posture, or TACACS+ and hand the wireless and certificate workload to Keytos. Both systems speak standard RADIUS, so they can run side by side indefinitely, each authenticating the networks you point at it.
If 802.1X was the only reason ISE was there, that is when replacing it outright makes sense, and that is the case this page is written for.
Keytos was built by ex-Microsoft cloud security engineers for organizations that run on Microsoft Entra ID and Intune. It is a passwordless identity platform rather than a NAC suite, so network authentication comes with the certificate authority, the onboarding apps, and the SSH and server certificates around it.
No. EZRADIUS is a standard RADIUS service, so any 802.1X-capable switch, wireless LAN controller, or access point works with it. Cisco Catalyst, Cisco wireless, Meraki, Aruba, Ubiquiti, and the rest are all just RADIUS clients. You add them in the portal and point them at the nearest of the 20+ EZRADIUS regions, over classic RADIUS or RadSec.
Nothing gets racked, re-cabled, or replaced. The hardware investment you already made in your Cisco network keeps earning.
Yes. Keytos Shield is one subscription covering an HSM-backed cloud PKI, cloud RADIUS with classic RADIUS and RadSec endpoints, passkey and smart card onboarding, and the Keytos Connect app for personal and BYOD devices, at one per-user price starting at $1.50 per user per month.
That matters more when you are leaving ISE than when you are leaving a RADIUS-only service. The ISE internal CA is scoped to ISE, so teams that outgrow it end up standing up AD CS or buying a separate PKI. With Keytos the same certificate authority that issues your 802.1X certificates also issues certificates for servers, Azure Key Vault, and IoT devices.
Yes. EAP-TLS is how Keytos recommends authenticating every device that can hold a certificate, and Keytos Shield handles the whole chain for you, from creating the certificate authority to publishing the RADIUS profiles, in under an hour. Even Keytos Connect, which signs the user in with their Entra ID credentials, provisions a certificate in the background so the device authenticates with EAP-TLS.
For the printers, cameras, and legacy devices every real network still has, Keytos also supports PEAP, EAP-TTLS, MS-CHAPv2, PAP, and MAC authentication bypass, with per-device VLAN assignment and central auditing in the portal.
Policies are built from the Entra ID groups and Intune compliance policies you already manage. On every authentication, not just at enrollment, Keytos reads the user's current group membership through Microsoft Graph and the device's current Intune compliance state. A laptop that falls out of compliance, or a user removed from a group, loses network access at its next connection even though the certificate on the device is still valid.
ISE has supported Entra ID as a REST identity source since release 3.2, so this is no longer a capability gap. The difference is what it takes to get there: an ISE deployment that still authenticates against Active Directory carries the AD join, the connector health, and the drift between what the directory says and what the policy engine believes. Keytos only ever talks to Entra ID, so there is no directory sync and no second copy of your identity data to keep current.
Cisco has published an end-of-life announcement for ISE software versions 3.1 and 3.2. The last day to order is November 3, 2026, which is also the end of software maintenance releases, and the last date of support is November 30, 2027. Upgrading can also force a hardware refresh, because SNS 3595 appliances are not supported on ISE 3.3 and later.
That is a budgeted project either way. It is also the natural moment to ask whether a full NAC appliance stack is still the right answer for the part of it that is really just wireless authentication, and to price the alternative before the renewal is signed.
Moving RADIUS to the cloud raises an obvious question, and it is the first one most ISE teams ask. Keytos includes a local RADIUS proxy, a lightweight Docker container that runs on your own network and caches user credentials and policies, so authentication continues even when your internet connection is down or the cloud service is unreachable.
Network and audit logs are kept for 1 year at no extra cost, and every Keytos product can stream its logs to Microsoft Sentinel, Splunk, or any other SIEM. There is no monitoring node to size, and retention does not shrink because a disk filled up.
Network access is rarely the only place an organization needs certificates. Passwordless onboarding for FIDO2 passkeys and smart cards is included in the base plan. Engineers get short-lived SSH certificates for Linux and GitHub, services get TLS certificates that renew themselves in Azure Key Vault, and IoT fleets get device identity.
All of it comes from one vendor, one security review, and one stream of logs into your SIEM.
Yes. Every Keytos price is on keytos.io, the tiers get cheaper as you grow, and the calculator below gives you your monthly cost in seconds. Keytos Shield is month to month, with no minimum, and you can cancel at any time.
As of October 2026, Keytos has 43 reviews on G2 averaging 4.8 out of 5 across its products, including 21 for EZRADIUS and 20 for EZCA, making it the highest rated in its category.
Both systems speak standard RADIUS, so Keytos runs alongside ISE while you validate. There is no cutover weekend and no single date everything has to work.
Create your tenant, connect Entra ID and Intune, and either issue certificates from EZCA or trust the certificate authority you already use, including the ISE internal CA and AD CS.
Rebuild your ISE authorization rules as Keytos access policies from Entra ID groups and Intune compliance, then add your controllers, access points, and switches as RADIUS clients.
Validate a single SSID or switch stack, then repoint the others at your own pace. Keep ISE for any wired NAC, posture, or TACACS+ you still rely on.
Cisco does not publish an ISE list price. ISE is licensed by active endpoint across Essentials, Advantage, and Premier tiers on 1, 3, or 5-year terms. Device Administration for TACACS+ is a separate perpetual licence bought per Policy Service Node, and virtual or cloud nodes need their own perpetual VM licences. Keytos publishes every price. Here is how the two compare on the terms that decide what you actually pay.
| Pricing term | |
Cisco ISE |
|---|---|---|
| List price | Starts at $1.50 per user per month with no minimum number of users | Not published. Quoted by active endpoint through Cisco or a partner |
| Price published on the vendor's website | Yes, every plan and tier | No. A licensing guide, but no prices |
| What you pay for | Each licensed user, with unlimited certificates and devices | Each active endpoint, counted from concurrent RADIUS sessions, so a user with a laptop, a phone, and a tablet can count three times |
| Infrastructure cost | None. The service is fully hosted | SNS appliances, or a separate perpetual VM licence for every virtual or cloud node, plus the hypervisor capacity behind them |
| Certificate authority | Included in Shield, with unlimited issuance | Internal CA included but scoped to ISE. A general purpose PKI is a separate product |
| TACACS+ device administration | Not offered | Separate perpetual Device Administration licence, bought per Policy Service Node |
| Deployment and professional services | None required. Self-service setup in under an hour | Commonly a Cisco partner services engagement |
| Contract | Month to month. Cancel at any time | Subscription terms of 1, 3, or 5 years |
| Free trial | 30 days, self-service, no credit card | Evaluation licenses through Cisco or a partner |
A very simple architecture product that delivers on promises - we haven't had a single WiFi failure since we migrated. No downtime during transition, and the pricing let us finally move away from legacy ISE.
EZCA is the only CA platform that is actually native to Azure, enabling easy PKI deployment for PIV authentication without standing up Windows Server VMs - much cleaner and easier to deploy.
Ease of implementation and ease of use during operations. We use EZRADIUS for 802.1x authentication on wired and wireless LANs - it's significantly improved our infrastructure security and given us confidence in access control across our networks.
Easy to use, with quick and knowledgeable support via chat and helpful documentation for third-party integrations. Setup required minimal effort, and the EZCA/EZRADIUS/Intune integration was key for CMMC compliance.
No server deployment needed for wireless authentication with Entra credentials - straightforward setup, and the organization eliminated its on-premises RADIUS server entirely by moving to a fully cloud-based infrastructure.
Eliminates the need to stand up and maintain a traditional on-prem PKI/CA infrastructure for 802.1X, with fully automated certificate issuance and renewal through Intune SCEP integration.
If your organization runs on Microsoft Entra ID and Intune, and your ISE deployment is mostly 802.1X for Wi-Fi, wired ports, and VPN, Keytos is built for you: native Entra ID, Intune, and Jamf integration, a certificate authority included, Azure GCC High support, and, since Keytos is a Microsoft partner and part of the Microsoft Intelligent Security Association, the option to pay through the Azure Marketplace. If wired NAC, posture agents, device profiling, TACACS+, or TrustSec are central to how you run the network, keep Cisco ISE for those.
It depends on what you use Cisco ISE for. If your ISE deployment is mainly 802.1X authentication for Wi-Fi, wired ports, and VPN, Keytos Shield replaces that workload with cloud RADIUS and cloud PKI that deploy in under an hour and cost $1.50 per user per month. If you rely on ISE for endpoint posture agents, device profiling, TACACS+ device administration, or TrustSec segmentation, Keytos does not replace those functions and you should keep ISE for them.
No. Keytos EZRADIUS is a standard RADIUS service, so any 802.1X-capable switch, wireless LAN controller, or access point works with it, including Cisco Catalyst, Cisco wireless, and Meraki. You add them as RADIUS clients and point them at the nearest EZRADIUS region. Nothing is racked, re-cabled, or replaced.
Cisco does not publish an ISE list price. ISE is licensed by active endpoint across Essentials, Advantage, and Premier tiers on 1, 3, or 5-year terms. Device Administration for TACACS+ is a separate perpetual licence bought per Policy Service Node, virtual nodes need their own perpetual VM licences, and posture and MDM compliance sit in the top Premier tier. Keytos publishes every price. Keytos Shield starts at $1.50 per user per month for cloud PKI and cloud RADIUS together and falls to $0.15 per user above 10,000 users, with no appliance cost, no platform fee, no minimum, and no long-term contract. See the full pricing comparison.
A Keytos tenant is live in under an hour, with no professional services engagement and no appliances to size. Most teams then move one SSID or one switch stack at a time. Because both systems are standard RADIUS, you can run Keytos alongside ISE and cut each network over once you have validated it, so there is no single big-bang migration date.
Cisco has published an end-of-life announcement for ISE software versions 3.1 and 3.2. The last day to order is November 3, 2026, which is also the end of software maintenance releases, and the last date of support is November 30, 2027. Upgrading can also force a hardware refresh, because SNS 3595 appliances are not supported on ISE 3.3 and later. Many teams use that forced project as the moment to ask whether a full NAC appliance stack is still the right answer for wireless authentication.
Yes. EAP-TLS is the core of Keytos Shield. The built-in certificate authority issues device and user certificates through Intune SCEP, Jamf, ACME, or the Keytos Connect app, and the cloud RADIUS service validates them for Wi-Fi, wired 802.1X, and VPN. For printers, cameras, and legacy endpoints that cannot hold a certificate, Keytos also supports PEAP, EAP-TTLS, MS-CHAPv2, PAP, and MAC authentication bypass.
Yes. Keytos EZCA is a cloud certificate authority backed by FIPS 140-3 validated HSMs, and it is one of the third-party certificate authorities listed in Microsoft's own Intune SCEP documentation. It handles issuance, automatic renewal, revocation, CRLs, and OCSP. Keytos can also trust certificates issued by your existing certificate authorities, including the ISE internal CA and Microsoft AD CS, so devices keep connecting while they re-enroll.
No. Keytos does not offer TACACS+ device administration. If you use Cisco ISE to control administrative logins to routers, switches, and firewalls, keep ISE or another TACACS+ service for that function. Keytos covers the RADIUS authentication and certificate side of network access.
Keytos enforces compliance using Microsoft Intune rather than its own posture agent. On every authentication, Keytos checks the device's current Intune compliance state and the user's current Entra ID group membership, so a device that falls out of compliance loses network access at its next connection even though its certificate is still valid. If you need an agent that inspects the endpoint itself, such as checking for a specific running process or file, that is a Cisco ISE posture capability Keytos does not replicate.
No. Keytos is built by ex-Microsoft engineers for Microsoft Entra ID, in commercial, GCC, and GCC High tenants, and builds network policy from Entra ID groups and Intune compliance. Devices managed through Intune, Jamf, and other MDM platforms can all receive Keytos certificates, but user identity and group policy come from Entra ID.
Yes. Keytos includes a local RADIUS proxy, a lightweight Docker container that runs on your own network and caches user credentials and policies, so network access continues even when your internet connection is down or the cloud service is unreachable.
Yes. Keytos is SOC 2 Type 2 certified and ISO 27001 compliant, its certificate authorities run on FIPS 140-3 validated HSMs, and every Keytos product sends its security logs to Microsoft Sentinel or any other SIEM so your SOC team keeps its own record of what happened.
Yes. You can start a 30-day trial of the Keytos platform with every feature turned on, with no credit card and no sales call, so you can prove it on your own access points before you commit.
As a security provider, Keytos maintains a strict policy of not publicly disclosing specific customer information. However, more than 1,200 organizations across a wide range of industries and company sizes worldwide trust Keytos to secure their environments.
Keytos is also an active and recognized participant in leading industry programs and organizations that set the industry standards such as the FIDO Alliance and the Microsoft Intelligent Security Association (MISA).
Start a 30-day trial with every feature turned on and run it next to ISE on your own access points. No appliances. No professional services. No long-term contract. Cancel anytime.
