Cisco Identity Intelligence (CII): An Independent Guide to the Product, Skills, and Learning Path
Cisco Identity Intelligence, commonly abbreviated as CII, is an identity-security capability within Cisco’s wider security ecosystem rather than a certification family described in the supplied official material. Cisco presents it as an AI-powered solution that connects authentication and access by bringing identity activity, user context, and risk information together. This overview helps security professionals, administrators, architects, and certification planners decide what to learn first, distinguish product knowledge from formal credential requirements, and choose a sensible next step without assuming that CII has its own published exam levels or certification ladder.
Start with the key distinction: CII is a Cisco security capability, not a documented credential track
The supplied Cisco sources describe Cisco Identity Intelligence as a product capability and integration, but they do not establish a CII certification, exam, badge, qualification level, prerequisite, renewal policy, or official learning path. That distinction should guide how readers use this page: treat CII as a technology area to understand and operate, not as a standalone certification title unless Cisco publishes separate credential information through an official certification channel.
Cisco describes Identity Intelligence as an AI-powered solution that bridges the gap between authentication and access. Its stated purpose includes improving visibility into identity activity, helping organizations clean up vulnerable accounts, addressing risky privileges, and blocking high-risk access attempts. These are product and security outcomes, not evidence of a separate credential framework. Source: https://www.cisco.com/site/us/en/solutions/security/identity-intelligence/index.html
For readers comparing certification paths, the practical implication is straightforward. A person may need CII product knowledge for a Cisco security, identity, secure access, or operations role, but the supplied evidence does not identify which Cisco certification, if any, formally assesses that knowledge. Readers should therefore verify any claimed exam association, blueprint, or requirement directly through Cisco’s current certification pages before treating CII study as exam preparation.
What this means for a certification comparison
Do not choose a supposed “CII certification level” based only on a third-party listing. The supplied sources contain no official CII credential hierarchy. A responsible comparison should instead ask whether the target role needs product administration, identity-security architecture, Secure Access integration, Duo knowledge, Cisco XDR workflows, or broader Cisco security competency.
This approach also prevents a common category error: learning how to configure a Cisco integration can be valuable professional development even when the activity is not itself a certification requirement. Product familiarity and vendor certification can support one another, but they are not interchangeable claims.
Understand what CII is designed to connect
CII is intended to give organizations a more complete view of identities across the systems where identity activity occurs. Cisco says fragmented identities can make it harder to assess user trust consistently enforce policy, and detect breaches. Cisco identifies traditional identity providers such as Entra ID, Duo, and Okta, non-traditional sources such as GitHub, Google, and Salesforce, and HR systems such as Workday as possible contributors to that fragmentation. Source: https://securitydocs.cisco.com/docs/csa/olh/136576.dita
The product perspective is therefore broader than a single login service. CII aggregates identity information from diverse sources so that security teams can examine users, identities, and related risk context across a more connected view. Cisco’s XDR integration page lists Entra ID, Duo, Okta, GitHub, Google, Salesforce, and Workday among the sources represented in its description of CII. Source: https://connect.xdr.security.cisco.com/integration/cisco-identity-intelligence
This makes CII most relevant to readers whose responsibilities cross identity, access, security monitoring, and incident investigation. It may be useful to identity administrators reviewing accounts, security analysts investigating suspicious activity, architects designing connected security controls, and Cisco platform administrators planning Secure Access or XDR integrations. Those audiences overlap, but they do not need identical depth.
The central learning concept is identity context
A useful first objective is to understand how identity information becomes security context. Cisco documents that associating an identity source with Identity Intelligence provides user and device risk ratings to Security Cloud Control. Source: https://securitydocs.cisco.com/docs/scc-fw/ftd/manage/160887.dita
That relationship matters for learning because CII is not only a directory view. The supplied evidence connects identity sources with risk ratings and connects CII-known users and identities with Cisco XDR User Insights. A learner should be able to explain which source contributes information, where the resulting context is displayed, and how that context supports an investigation or access decision.
The official material does not define a universal risk-scoring formula, a guaranteed detection result, or a specific operational outcome for every deployment. Preparation should therefore focus on understanding documented data flows and configuration dependencies rather than memorizing unsupported claims about how the system will respond in every environment.
The ecosystem includes Security Cloud Control and Cisco XDR
Cisco positions Security Cloud Control as the connection point for the CII integration with Cisco XDR. Cisco says the integration exposes CII-known users and identities in XDR User Insights and adds account context to incidents and investigations. Source: https://connect.xdr.security.cisco.com/integration/cisco-identity-intelligence
This gives the ecosystem at least two important study angles. One is service configuration and organization management in Security Cloud Control. The other is security operations: understanding how identity context appears in XDR and how analysts can use it during investigation. A reader targeting an implementation role may prioritize the first; a reader targeting an operations role may need more emphasis on the second.
The XDR integration page also identifies an installable workflow named “Cisco Identity Intelligence (CII): Ingest Critical Threat Checks.” Cisco notes that a legacy workflow concerning failed checks has been replaced by the version using XDR Detection Findings. Source: https://connect.xdr.security.cisco.com/integration/cisco-identity-intelligence
Because workflow details can change, learners should use the current Cisco integration page and configuration guidance rather than relying on an old workflow title, screenshot, or third-party practice question.
Choose a learning audience before choosing study material
The best CII learning path depends on the work a reader expects to perform. CII is relevant to several audiences, but each should begin with a different practical question: will you connect sources, interpret identity risk, manage access context, investigate incidents, or coordinate licensing and activation?
Identity and access administrators should start with identity sources, organization selection, Duo relationships, and the effect of associating sources with Identity Intelligence. Their goal is dependable identity coverage and correct administrative setup, not broad XDR workflow expertise.
Secure Access administrators should study the integration sequence and the tasks that follow it. Cisco’s Secure Access guidance recommends integrating all available third-party products and identity providers after integrating Cisco Identity Intelligence, with particular emphasis on Duo Directory. Source: https://securitydocs.cisco.com/docs/csa/olh/136579.dita
Security operations analysts should focus on how CII information is surfaced in Cisco XDR User Insights, incidents, and investigations. They should also understand the current workflow terminology and the difference between identity context and a confirmed security finding.
Security architects should examine how fragmented sources are brought together, what systems need to be connected, how access decisions depend on identity context, and which Cisco services are in scope. Architects should avoid assuming that the existence of an integration automatically resolves governance, account lifecycle, or privilege problems.
Cisco or Duo administrators should pay particular attention to activation, organization ownership, licensing language, and administrative responsibility. Those topics are operational prerequisites rather than certification subjects, but errors in them can affect whether a deployment proceeds cleanly.
A simple role-to-topic map
If your work is onboarding and configuration, prioritize Security Cloud Control activation, identity-source association, Secure Access integration, and vendor documentation for the sources your organization uses.
If your work is monitoring and response, prioritize the CII-to-XDR connection, User Insights, identity context in incidents, and the current XDR Detection Findings workflow described by Cisco.
If your work is governance and architecture, prioritize identity fragmentation, source coverage, user and device risk ratings, vulnerable-account cleanup, risky privileges, and the boundaries between CII, Duo, Secure Access, and XDR.
If your goal is a formal Cisco certification, first identify the official Cisco credential and its current blueprint. Then map CII topics to that blueprint only where Cisco explicitly includes them. The supplied CII sources do not provide that mapping.
Build preparation around documented workflows, not assumed exam objectives
A sound preparation approach is to move from concepts to configuration decisions, then to operational interpretation. Cisco’s official documentation is the appropriate foundation because the supplied sources are primarily product guides and integration references rather than certification blueprints.
Begin by defining the identity problem CII addresses. Review Cisco’s explanation of fragmented identities and note the different categories of sources it names. Then explain, in your own words, why scattered identity records complicate user-trust assessment, policy enforcement, and breach detection. This establishes the product rationale before configuration work begins.
Next, study the service relationships. Determine how CII connects through Security Cloud Control, how an identity source is associated, and what user and device risk ratings become available in that environment. The Cisco Security Cloud Control documentation is especially relevant for readers working with firewall management or other Security Cloud Control functions. Source: https://securitydocs.cisco.com/docs/scc-fw/ftd/manage/160887.dita
After that, examine Secure Access integration. Cisco’s guide separates the integration activity from later recommendations, including connecting available third-party products and identity providers. A learner should be able to describe what is integrated first and what should be considered afterward, without treating the recommendation as proof that every organization has identical requirements. Source: https://securitydocs.cisco.com/docs/csa/olh/136579.dita
Finally, study the XDR view. Review how CII-known users and identities appear in User Insights and how account context can support incidents and investigations. Check the current workflow wording because the official page explicitly distinguishes the current Detection Findings workflow from a legacy workflow. Source: https://connect.xdr.security.cisco.com/integration/cisco-identity-intelligence
Use hands-on questions to test readiness
A learner is better prepared when they can answer operational questions without relying on memorized labels. Examples include: Which identity sources are relevant to the organization? What is the relationship between an identity source and a user or device risk rating? Where would an analyst look for CII-known users in XDR? Which service owns the integration path? What administrative choice could prevent activation from completing?
These are practical readiness indicators, not official exam objectives. They help a reader judge whether study has produced usable understanding. The questions should be answered from current Cisco documentation and, where possible, validated in an authorized environment. They should not be treated as a substitute for a Cisco exam blueprint or as evidence that Cisco will test the exact wording.
A useful exercise is to draw a simple data-flow diagram showing identity sources, Identity Intelligence, Security Cloud Control, Secure Access, and Cisco XDR. Mark where identity context is collected, where risk ratings are made available, and where analysts encounter the information. The diagram should reflect the selected deployment and Cisco’s current documentation rather than assume that every listed product is enabled.
Separate product documentation from study aids
Cisco’s product documentation should establish what the service does and how it is configured. Training courses, labs, and independent notes can help explain the material, but they should be checked against current official documentation when they make claims about supported integrations, workflows, licensing, or availability.
Third-party practice material can be especially risky when it presents an invented CII exam, a fixed question count, a passing score, or a credential level without an official Cisco source. The supplied evidence supports none of those claims. Readers should not treat leaked questions, dumps, or memorization as a reliable route to professional competence or certification success.
A better use of study notes is to record source, purpose, prerequisite, expected result, and possible failure condition for each task. That format encourages understanding of dependencies and makes it easier to identify information that may have changed.
Treat activation and organization ownership as part of readiness
CII preparation should include administrative safeguards because Cisco documents activation conditions that can affect the deployment itself. Cisco warns that once a Duo instance is activated in a Security Cloud Control organization, it cannot be reused or attached to a different organization. Cisco also warns that selecting the wrong initial Duo administrator can stop activation and require an activation reset. Source: https://securitydocs.cisco.com/docs/scc/gsg/new/160090.dita
These statements do not describe certification prerequisites, but they are important preparation topics for anyone expected to configure or administer the service. Before starting, a team should confirm the intended Security Cloud Control organization, identify the correct initial Duo administrator, and understand who has authority to make the activation decision.
A practical readiness check is to document the organization choice and administrator choice before activation, verify that the relevant subscription and service context are available, and confirm the rollback or support process described by current Cisco guidance. Do not assume that a later transfer will be straightforward, because Cisco’s documentation specifically warns about reuse or attachment to another organization.
The Secure Access documentation also provides a useful sequence for implementation planning. Cisco’s guidance places Identity Intelligence integration within a broader Secure Access onboarding and integration context. Readers should compare the guide’s sequence with their own architecture and avoid executing a recommendation merely because it appears in a generic checklist.
Activation questions to resolve with the implementation team
Which Security Cloud Control organization is the intended owner of the Duo instance?
Who is the correct initial Duo administrator, and has that person’s role been confirmed?
Which identity sources will be associated with Identity Intelligence first?
Will the deployment also connect Secure Access, Cisco XDR, or firewall-related services?
Who will validate that users, identities, and risk context appear where expected?
What support route will be used if activation is blocked or an organization choice needs correction?
These questions are implementation controls, not Cisco certification requirements. Their value is that they reduce preventable configuration errors and clarify responsibility before a service is activated.
Understand the licensing and identity terminology before planning scope
CII planning should use Cisco’s licensing definitions precisely. Cisco’s Duo product description defines an identity as one user listed in the Cisco Identity Intelligence interface. It also states that each Duo Advantage or Duo Premier user license allocates up to five identities in Cisco Identity Intelligence. Source: https://www.cisco.com/c/dam/en_us/about/doing_business/legal/OfferDescriptions/duo-product-description.pdf
Cisco further states that if this Identity Intelligence allocation is exceeded, the customer may need to purchase additional Duo user licenses after good-faith efforts to resolve excess usage. Source: https://www.cisco.com/c/dam/en_us/about/doing_business/legal/OfferDescriptions/duo-product-description.pdf
These facts are relevant to administrators and architects estimating scope, but they should not be turned into a universal cost estimate. The supplied material does not provide a complete deployment price, a current commercial quote, or every licensing condition that may apply. Readers should consult the current Cisco offer description and their commercial agreement for decisions involving entitlement or expenditure.
A useful preparation task is to inventory the sources that will contribute identities and identify how many user records the organization expects to expose in the CII interface. The inventory should account for the organization’s actual identity landscape rather than assume that the number of employees alone represents the number of identities. Cisco’s description makes the interface listing, not a general headcount assumption, the relevant terminology.
Why source inventory matters
Cisco identifies identity fragmentation across traditional identity providers, non-traditional applications, and HR systems. A source inventory helps teams see where duplicate, stale, privileged, or poorly governed identity records may exist. It also provides a basis for deciding which integrations are useful first.
The inventory should record the system name, ownership, identity type, expected data contribution, and operational purpose. Keep this as an architecture and governance exercise, not as a promise that connecting every possible source will automatically improve security. Cisco’s guidance recommends broad integration in the Secure Access context, but the correct order and scope still require organization-specific planning.
Use official integration guidance to shape the next technical step
The next step should match the reader’s role and environment: review the product overview for orientation, use Security Cloud Control documentation for service relationships, use Secure Access guidance for the integration sequence, or use the XDR integration page for operational visibility and workflows.
For a Secure Access-focused path, begin with Cisco’s “After Integrating Cisco Identity Intelligence” guidance. It recommends integrating available third-party products and identity providers after CII, with particular emphasis on Duo Directory. This makes the page useful for planning a connected identity and access deployment, but it does not create a certification level or establish that every source is mandatory. Source: https://securitydocs.cisco.com/docs/csa/olh/136579.dita
For a Security Cloud Control-focused path, review the getting-started activation guide before making organization or administrator selections. The guide is particularly important because Cisco documents consequences associated with the initial Duo activation choice. Source: https://securitydocs.cisco.com/docs/scc/gsg/new/160090.dita
For a Cisco XDR-focused path, use the current CII integration page to understand installation, health, device insights, User Insights, and the listed installable workflow. The page also states that the legacy failed-check workflow has been replaced, so current page content should take priority over older study material. Source: https://connect.xdr.security.cisco.com/integration/cisco-identity-intelligence
For a product-orientation path, Cisco’s Identity Intelligence overview explains the intended security value: visibility into identity activity, vulnerable-account cleanup, risky-privilege reduction, and blocking high-risk access attempts. Use that material to understand the problem being addressed before studying implementation details. Source: https://www.cisco.com/site/us/en/solutions/security/identity-intelligence/index.html
A sensible sequence for independent study
First, learn the vocabulary: identity, identity source, fragmented identity, risk rating, Security Cloud Control, Secure Access, User Insights, and XDR Detection Findings. Then connect each term to an official Cisco page.
Second, map the architecture. Identify which sources are relevant, where CII is connected, and which teams consume the resulting context.
Third, review activation and licensing boundaries. Confirm the organization, administrator, entitlement, and expected identity scope before hands-on work.
Fourth, practice interpretation. Given a documented identity or risk context, explain which team would investigate it and where the relevant information should appear.
Fifth, if certification is the goal, stop and verify the target Cisco credential’s current blueprint separately. Add only the CII topics that Cisco explicitly associates with that credential.
Decide whether CII knowledge is the right next step
CII is a sensible next learning step when your target work involves identity visibility across multiple sources, Cisco Secure Access integration, Security Cloud Control, Duo administration, or Cisco XDR investigations. It is less suitable as a standalone target when your actual goal is a general networking, cloud, endpoint, or security certification and the target credential does not mention Identity Intelligence.
Readers should make the decision by comparing the work they want to perform with the product’s documented role. If the problem is fragmented identity context, risky privileges, vulnerable accounts, or identity-aware investigation, CII concepts may be directly relevant. If the problem lies elsewhere, a broader Cisco technology or certification path may be more appropriate, though the supplied sources do not identify or rank alternative Cisco credentials.
A formal certification choice requires a separate verification step. Check the current Cisco certification catalog, exam blueprint, prerequisites, delivery method, renewal rules, and official preparation recommendations for the exact credential under consideration. None of those details are established by the CII sources supplied for this overview, so they should not be inferred from product documentation.
For employers or team leads, the best path may be role-based rather than identical for everyone. An administrator may need activation and source-association competence; an analyst may need XDR investigation context; and an architect may need integration boundaries and licensing awareness. A team can use a shared CII foundation while assigning deeper study according to responsibility.
Questions to ask before committing time or budget
Is the target outcome product operation, architecture, security analysis, or a formal Cisco credential?
Does the official Cisco credential blueprint explicitly mention CII or the related products you need to learn?
Which identity sources are present in the intended environment?
Will the work involve Security Cloud Control activation, Secure Access, Cisco XDR, Duo, or more than one of these?
Who owns organization selection, initial administration, identity-source integration, and incident follow-up?
What current Cisco documentation governs licensing, workflow status, and supported integrations for this deployment?
How will readiness be demonstrated: a documented architecture, a controlled configuration exercise, an operational investigation, or an official certification assessment?
These questions help prevent a product name from becoming a vague study objective. They also keep the learning investment tied to a real role and a verifiable outcome.
What readers should verify on Cisco’s current pages
Readers should verify time-sensitive information directly with Cisco before making a certification or deployment decision. The supplied sources establish product descriptions and selected configuration and licensing statements, but they do not provide a complete certification catalog or a permanent statement of product availability.
Verify whether Cisco has introduced a dedicated CII credential, added CII to an existing exam blueprint, or changed the product’s naming and integration model. Verify current Secure Access subscription terms, Duo licensing language, XDR workflow status, and supported identity-source behavior before planning a live implementation.
Also verify regional, organizational, and contractual conditions. The XDR integration page lists regions including North America, Europe, and Asia-Pacific, Japan & China, but the supplied evidence does not establish that every capability, course, exam, or commercial term is identical in every region. Readers should use the relevant Cisco page and account-specific information for their situation.
A careful overview should remain useful even when those details change. The durable principles are to distinguish CII product knowledge from certification claims, learn how identity sources create context, understand the Security Cloud Control and XDR relationships, protect activation decisions, and choose study depth according to the intended role.
Conclusion
Cisco Identity Intelligence is best approached as a product and integration capability within Cisco’s security ecosystem, not as a documented standalone certification ladder in the supplied evidence. Start by learning the identity-fragmentation problem, then follow the path that matches your responsibilities: Security Cloud Control and activation for administrators, Secure Access integration for access teams, and XDR User Insights and current workflows for security operations. If a formal Cisco credential is your goal, verify its current official blueprint separately and treat CII knowledge as relevant only where Cisco explicitly places it. That method keeps preparation practical, evidence-led, and aligned with the work you intend to do.
Related exams
- Insurance Legal and Regulatory (IF1) Exam
- E05 exam — Examination element of M05 Insurance law
- M92 exam — Insurance Business and Finance (IBF)
- M05 exam — Insurance law (IL) Exam
