Cisco Secure Client vs AnyConnect: what actually changed, and what it means for you
Published · Updated
Cisco Secure Client 5.x is the successor to AnyConnect 4.x. The short answer is that it is the same VPN engine under a new name. The longer answer matters if you run Windows 11, because the migration is what fixes an entire category of connection failures.
The naming, cleared up
AnyConnect had been more than a VPN client for years — it carried modules for posture assessment, DNS-layer security, and network visibility. The rename to Cisco Secure Client reflects a product that had outgrown its name.
The VPN component is still called AnyConnect inside the product. That is why you will see both names in the same interface, and why searching for either term returns results about the other.
- AnyConnect 4.x — the previous generation. 4.10 is the last branch supported on Windows 11.
- Cisco Secure Client 5.x — current. Same VPN engine, new drivers, unified module management.
What actually differs
| Area | AnyConnect 4.x | Secure Client 5.x |
|---|---|---|
| VPN engine | AnyConnect SSL/IPsec | Same engine |
| Windows 11 drivers | Blocked by Memory Integrity below 4.10 | Signed and compatible |
| Module handling | Separate installers per module | Unified deployment |
| ZTNA | Not available | Zero Trust Access module |
| Interface | Familiar layout | Same layout, new branding |
| Profile format | XML profiles | Same XML, compatible |
The row that matters operationally is the driver one. If you are running Windows 11 with a client older than 4.10, you are in the population that hits the stuck-on-connecting hang. Migrating to Secure Client resolves it properly, without disabling a Windows security control to get there.
Do you need to migrate?
Yes, if you run Windows 11 on a client below 4.10; you want ZTNA; or you are past the support date for your current branch. Running an unsupported VPN client means no security patches on the software carrying all your remote traffic.
Not urgently, if you are on 4.10 with a stable Windows 10 estate. Plan it, but it is not an emergency.
Migration gotchas
- Uninstall first. Installing 5.x over 4.x is supported but leaves orphaned adapters often enough to be worth avoiding. Uninstall, reboot, install.
- Profiles move, but check the paths. XML profiles are compatible; the directory changed. Deployment scripts referencing the old path will silently do nothing.
- Modules are separate. Umbrella, Network Visibility and posture modules each need enabling in the deployment package. A default install has VPN only, and posture-enforced gateways will then reject your users.
- ASA firmware has a floor. Very old ASA versions do not recognise 5.x clients. Confirm the gateway supports it before a fleet-wide rollout.
- Licensing is unchanged — Secure Client uses the same Plus/Apex/VPN Only tiers. Both are commercial products requiring a valid licence; neither is free software.
Which should you install?
If your organisation gave you a specific version, install that one — the gateway may be configured for it, and posture rules are often version-aware.
If the choice is yours and you are on Windows 11: Cisco Secure Client 5.x. It is current, supported, and avoids the driver problems entirely.
Both are licensed Cisco products. Download them from Cisco's official Software Download portal or through your organisation's Cisco account.
Frequently asked
Is Cisco Secure Client just AnyConnect renamed?
Largely, but not only. The VPN engine is the same and the interface is nearly identical. The meaningful changes are updated drivers that work with Windows 11 Memory Integrity, unified module deployment, and the addition of a Zero Trust Access module. The VPN component is still called AnyConnect inside the product.
Can I run AnyConnect 4.x and Secure Client 5.x on the same machine?
No. They install to the same locations and conflict. Uninstall the older client, reboot, then install the newer one. Installing over the top is supported but frequently leaves orphaned virtual adapters that cause connection failures.
Will my existing AnyConnect profile work with Secure Client?
Yes, the XML profile format is compatible. The directory the profile lives in changed, so any deployment script or group policy referencing the old path needs updating — otherwise it will appear to succeed while deploying nothing.
Is Cisco Secure Client free?
No. Both AnyConnect and Secure Client are commercial products requiring a valid Cisco licence, sold in Plus, Apex, and VPN Only tiers. Access is normally provided by the organisation running the VPN gateway.