WIXLIB

The Cisco ISE Customer JourneyDrivers leading to the ISE investmentInterviewed Decision-MakersIntervieweeIndustryRegionNumber of usersEnterprise architectHigher educationEMEA15,000Network engineering servicesassistant directorHigher educationNorth America11,500CIOFinancial servicesNorth America6,000DirectorMediaEMEA7,000Technical team leadIT servicesLATAM200to quickly identify and isolate threats.KEY CHALLENGESInterviewees said that they reached the pointPrior to implementing ISE, interviewees typically hadwhere throwing more bodies at the problema mix of homegrown and siloed networkwould not solve. It.administration tools. They did not meet currentneeds, let alone anticipated future requirements.The interviewees noted how their organizationsstruggled with common challenges, including: Prior solutions that negatively affectedbusiness users. Before adopting ISE, manualprocesses and inadequate tools meant thatbusiness users often struggled to get access toThe significant growth in the number of userbusiness networks and resources. This resulteddevices and remote users. All intervieweesin lost productivity and users’ frustration. Areported dramatic growth in the number ofspecific use case that faced big challenges wasdevices requiring access to networks, typically aguest access for customers, partners, students,10x growth over the past five years. This wasetc.partly driven by more permissive BYOD policies.Additionally, COVID 19 work-from-homerequirements meant that the proportion ofworkers who were remote went from single-digitpercentages to almost 100%. This is expected tocontinue as a part of hybrid working models. Theresult was that existing tools, which includedmany manual processes, could not keep up withthe growth. Threats that security models and policies didnot address. Prior security solutions hadproblems such as a lack of granularity insegmenting networks and users, too much time“The greatest challenge we facedduring the pandemic was having7,000 people start working fromhome the next day. What we hadin place was not good enough.We needed to add ISE, and weneeded to add software-definedaccess to handle the changes.”Director, media organizationto define and implement changes, and an inabilityTHE TOTAL ECONOMIC IMPACT OF CISCO IDENTITY SERVICES ENGINE6

THE CISCO ISE CUSTOMER JOURNEYCOMPOSITE ORGANIZATIONBased on the interviews, Forrester constructed a TEIframework, a composite company, and an ROIanalysis that illustrates the areas financially affected.The composite organization is representative of thefive decision-makers that Forrester interviewed and isused to present the aggregate financial analysis inthe next section. The composite organization has thefollowing characteristics:Description of composite. The compositeorganization is a North American-based companywith offices in some major commercial centersaround the world. It has 5,000 employees, with a 5%annual churn rate. Annual revenues are 1.3 billion. Ituses homegrown and sometimes-older tools, alongwith many manual processes, to manage networksegmentation and user and device access. Itwants solutions to address the previouslydescribed challenges.Deployment characteristics. The compositeorganization deploys Cisco ISE in the Initial Period ofthe study to cover all employees and guest access,along with 10,500 attached devices. The Flexibilitysection of the study describes the additional benefitsthat can be achieved if Cisco DNA Center forsoftware-defined access is also implemented.Key assumptions 5,000 employees 1.3 billion revenues 10,500 attached devices Cisco ISE deploymentTHE TOTAL ECONOMIC IMPACT OF CISCO IDENTITY SERVICES ENGINE7

Analysis Of BenefitsQuantified benefit data as applied to the compositeTotal BenefitsRef.BenefitYear 1Year 2Year 3TotalPresent ValueAtrImproved security 177,880 177,880 177,880 533,639 442,361BtrReduced IT costs 85,500 171,000 171,000 427,500 347,524CtrImproved business outcomes 63,444 113,095 113,095 289,633 236,113Total benefits (risk-adjusted) 326,823 461,975 461,975 1,250,773 1,025,998incidents to remediate. The media intervieweeIMPROVED SECURITYsaid that security tasks took half the time toEvidence and data. All interviewees said thatcomplete and that the security team would havemoving to Cisco ISE improved their security in termshad to add two FTEs to its team of threeof seeing fewer realized threats and making lifewithout ISE. One of the higher-educationeasier for the security organization. The reporting andinterviewees said that it would have needed toanalytics features also improved compliance. ISE candouble its existing security team if it hadn’tadditionally help with zero-day stop activities forimplemented ISE.employees leaving a company. Interviewees sharedthe following ways security improved: easier. The CIO at the financial services firmGreater visibility into everyone and everythingsaid: “Security is our concern, but compliance isconnected to the networks helped the securitythe most important thing because we are in ateam identify threats and isolate them faster. they were supposed to, and changes couldbe made faster and applied at scalethrough automation. easier.”Modeling and assumptions. For the financialanalysis, Forrester made the following assumptions: The composite organization has 20 securityevents per quarter that ISE helps address.The number of breaches from vectors that ISEaddresses was significantly reduced. One higher- ISE is implemented in the Initial Period, and thiseducation organization said that “98% of past bigreduces the number of events by 50% beginningthreats were avoided,” and the director at thein Year 1.media organization said that it went from “20high-risk events per quarter before ISE down toless than one per quarter” with ISE. highly regulated industry. ISE makes complianceSegmentation was more granular to ensurepeople only had access to corporate resourcesSome interviewees said that compliance was Each security event affects, on average, 0.5%of the 5,000 employees, or 25 users. Theseare people who may be using the sameThe relevant security teams did more withoutnetwork resources when someone else’s deviceadding more staff from efficiency gains and fewerinfects them.THE TOTAL ECONOMIC IMPACT OF CISCO IDENTITY SERVICES ENGINE8

ANALYSIS OF BENEFITS Forrester’s research has found that the averageRisks. The magnitude of this benefit may varytime to remediate a security breach is 3.8 hours. 2based on:During this time, users are 50% less productivebecause they may lose access to their computer streamlining and automating of IT securityand/or some networks and corporate resources. The average fully burdened salary, includingbenefits and payroll taxes, across all employeesfunctions they enabled. The preexisting security team responsible forareas that ISE covers is four FTEs. The additionThe number and type of security eventsprevented and the number of affected users.is 85,000. The tools in place before and how much The salaries of business users and ITsecurity resources.of ISE means that one additional FTE does notResults. To account for these risks, Forresterneed to be added to deliver comparableadjusted this benefit downward by 10%, yielding aadditional service.three-year risk-adjusted total PV (discounted at 10%)The financial calculations only include the lostof 442,000.productivity of affected business users and theavoided addition of security staff. There are manyother potential costs associated with a breach, butthey were excluded from the analysis because thetype and severity of security events vary greatly bythreat vector, industry, individual company, etc.Forrester’s research has found that a major security 442,36143%three-yearbenefit PVevent that impacts customer-facing systems andinformation can result in lost revenues, branddamage, and other related costs of 170,000 for a5,000-employee organization.3 The reader isencouraged to consider the types of security eventsISE will help prevent and the potential financialimpacts to their organization.“We now have better visibility,more granular segmentation,better policy enforcement, andbetter identity and accessmanagement.”CIO, financial services organizationTHE TOTAL ECONOMIC IMPACT OF CISCO IDENTITY SERVICES ENGINE9

ANALYSIS OF BENEFITSImproved SecurityRef.MetricSourceYear 1Year 2Year 3A1Number of applicable security events prior to ISEComposite808080A2Reduced number of eventsA1*50%404040A3Reduced number of affected usersA2*5,000*0.5%1,0001,0001,000A4Lost productivity per user per event3.8hours* 85,000/2,080 hours 155.29 155.29 155.29A5Reduction in lost productivityA3*A4*50% 77,644 77,644 77,644A6Existing relevant security team (FTEs)Composite444A7Avoided increase in security FTEsComposite111A8Avoided additional IT security team costsA7* 120,000 120,000 120,000 120,000AtImproved securityA5 A8 197,644 197,644 197,644Risk adjustment 10% 177,880 177,880 177,880AtrImproved security (risk-adjusted)Three-year total: 533,639Three-year present value: 442,361problems, fewer user-access help desk tickets,REDUCED IT COSTSand fewer security false alerts.Evidence and data. Cisco ISE streamlined andautomated activities related to network managementModeling and assumptions. For the financialand user and device access. All interviewees saidanalysis, Forrester made the following assumptions:that if they had not added ISE, they would haveneeded to add more people to teams and still not three FTEs.have achieved the same levels of security andservice. Interviewees shared the following examples of how IT costs decreased: level of services, this increases to two additionalThe enterprise architect in EMEA said that theFTEs beginning in Year 2. The increase isbecause ISE deploys across more networks andmore people without ISE and that would havethere is an ever-increasing number of devicesonly covered 9-to-5 support.At the North American higher-educationorganization, the team would have needed toincrease from three to nine. Implementing ISE means that one FTE does nothave to be added in Year 1 to achieve the samecurrent team of seven would have required five The network operations team consists oftrying to access network resources. The fully burdened cost of a network operationsteam member is 95,000.Contributing factors to the time savings includebetter automation, less time to diagnose potentialTHE TOTAL ECONOMIC IMPACT OF CISCO IDENTITY SERVICES ENGINE10

ANALYSIS OF BENEFITS The salary of a network operationsteam member.“Without ISE, we would bespending a lot more time helpingpeople connect. Now, we candiagnose 90% of the problems in10 minutes. Doing it the oldschool way would have taken alot more time.”Results. To account for these risks, Forresteradjusted this benefit downward by 10%, yielding athree-year risk-adjusted total PV of 348,000.Network engineering servicesassistant director, higher-educationorganization 347,524three-yearbenefit PV34%Risks. The magnitude of this benefit may varybased on: The existing network operations team and howmuch process streamlining and automation werein place.Reduced IT CostsRef.MetricSourceYear 1Year 2Year 3B1Existing number of FTEsComposite333B2Number of avoided new hiresComposite122B3Network operations employee fullyburdened annual salaryTEI standard 95,000 95,000 95,000BtReduced IT costsB2*B3 95,000 190,000 190,000Risk adjustment 10% 85,500 171,000 171,000BtrReduced IT costs (risk-adjusted)Three-year total: 427,500IMPROVED BUSINESS OUTCOMESEvidence and data. Providing better and fasteraccess to corporate resources makes users moreproductive. This is especially true in the case of newhires. There can also be better collaboration withTHE TOTAL ECONOMIC IMPACT OF CISCO IDENTITY SERVICES ENGINEThree-year present value: 347,524guest users, such as customers, partners, andsuppliers. This can increase innovation and speed.All of these improvements can deliver variousimproved business outcomes such as fastertime-to-market, increased revenues, and higher11

ANALYSIS OF BENEFITScustomer satisfaction. Interviewees shared the The composite organization size is held constantfollowing examples of how ISE increases userfor simplicity. However, there is 5% employeeproductivity and contributes to improvedchurn per year. Each new hire is now fullybusiness outcomes:productive 1.5 days faster than prior to ISE. The daily fully burdened cost is based on an annualThe enterprise architect at the European higher-rate of 85,000.education organization said that it onboards45,000 to 55,000 devices per year and that 96% A 50% productivity capture is applied to all timeof the time it is a fully self-service and near-savings because not all freed-up time translatesinstantaneous experience.into additional work being completed.At the North American higher-educationorganization, all users saved 5 to 10 minutes per“We can produce digital contentfaster and collaborate betterbecause we have eliminatedalmost all access issues.”day authenticating to different wireless networks. The director at the European media organizationsaid that its 7,000 employees were all moreproductive, which “is extremely importantbecause TV productions are on a tight timeline.” Director, media organizationThe network engineering services assistantdirector at the higher-education organization saidthat prior to ISE, each new hire required six to 10Risks. The magnitude of this benefit may vary basedhelp desk tickets. Now, new hires areon:automatically preprovisioned if no sign-offs arerequired or “up and running in a few hours if sign- and/or other ways in which employees becomeoffs are required. Previously, new hires lost amore productive.couple of days of productivity.”Modeling and assumptions. For the financial Reduction in lost productivity is a proxy forExisting efficient zero-day start processes andsystems for new hires.analysis, Forrester made the following assumptions: The number of devices being registered The average fully burdened cost of an employee.improved business outcomes because the valueResults. To account for these risks, Forresteran employee generates should be, at a minimum,adjusted this benefit downward by 10%, yielding aequal to her compensation.three-year risk-adjusted total PV of 236,000.Each employee registers 1.5 new devices peryear. Prior to ISE, there was a 3-hour period forregistration-related activities when employeeswere 25% less productive. Now, in 96% of thecases, registration is completed nearinstantaneously using a self-registration page.Half of this benefit is realized in Year 1 because23% 236,113three-yearbenefit PVof user change management and learning curveconsiderations.THE TOTAL ECONOMIC IMPACT OF CISCO IDENTITY SERVICES ENGINE12

ANALYSIS OF BENEFITSImproved Business OutcomesRef.MetricSourceC1Reduced downtime registering new devices(hours)5,000 employees*1.5 devices*3hours*96% success rate*25% reductionin productivityC2Downtime due to registering devices (only50% realized in Year 1)C1* 85,000/2,080 hoursC3Number of new hires5,000*5%C4Reduced downtime per new hireC5CtCtrYear 1Year 2Year 35,4005,4005,400 110,337 220,673 220,6732502502501.5 days* 326.92*25% reduction inproductivity 122.60 122.60 122.60Reduced downtime onboarding new hiresC3*C4 30,649 30,649 30,649Improved business outcomesC2 C5 70,493 125,661 125,661Risk adjustment 10% 63,444 113,095 113,095Improved business outcomes (riskadjusted)Three-year total: 289,633UNQUANTIFIED BENEFITSAdditional benefits that customers experienced butwere not able to quantify include: Three-year present value: 236,113with their other solutions improved security andgenerated additional benefits from pastinvestments. With regard to Cisco, other securitysolutions mentioned included AnyConnect,Increased employee satisfaction. EmployeesSecure Firewall, SecureX Platform, TrustSec,expect their work-related technology experiencesand Umbrella. Cisco networking solutionsto be as seamless as their personal ones.covered the entire stack for both wired andInterviewees said that difficulties associated withwireless networking and remote access.accessing networks and corporate resourceswere a major source of frustration for users priorto implementing ISE. By providing self-servicetools, automating processes, and largelyeliminating access and security problems, usersbecame happier. This can translate intoincreased productivity and higher retention. Withregard to IT and security teams, eliminatingmanual low-value tasks and providing access tocutting-edge tools increases satisfaction. “Leveraging the Ciscoequipment we have with ISEmakes our environment easier tooperate, improves security, andprovides better reporting.”CIO, financial services organizationIncreased value from other security solutions.All interviewees used a wide range of Cisco andother vendor solutions in their security stack.Interviewees all said that using ISE in conjunctionTHE TOTAL ECONOMIC IMPACT OF CISCO IDENTITY SERVICES ENGINEFLEXIBILITYThe value of flexibility is unique to each customer.There are multiple scenarios in which a customer13

ANALYSIS OF BENEFITSmight implement ISE and later realize additional usesand business opportunities, including: Continually updating security policies andand effective. Forrester modeled what thepractices. Once ISE is in place, the networkingadditional benefits would look like based on theoperations and security teams have an enhancedcustomers’ experiences and expectations.toolset and more flexibility in improving network management and user security and access.The additional benefits attributed to SDA appearThese teams are constantly evolving theirinclude 1) reducing applicable threats by 40%; 2)approaches to meet new business andreducing business user downtime (by reducingsecurity c

FINANCIAL MODEL FRAMEWORK Constructed a financial model representative of the interviews using the TEI methodology and risk-adjusted the financial model based on issues and concerns of the decision-makers. CASE STUDY Employed four fundamental elements of TEI in modeling the investment impact: benefits, costs, flexibility, and risks.