New features in AI Defense, Splunk, and Cisco IQ will provide security and operations teams with a unified, closed-loop system to identify risks, measure value, and demonstrate trustworthiness.
News summary:
- Cisco AI Defense’s adaptive AI red teaming framework will integrate Anthropic’s Claude Mythos to simulate real-world attacks against AI agents using advanced adversarial reasoning.
- With Cisco Enhanced Tokenomics, businesses can optimize AI spending by directly linking agency costs to ROI in real time, prioritizing resources for the most critical protections.
- Cisco IQ, built on decades of vulnerability and troubleshooting data, now correlates real-time threat detection data with potentially exposed network infrastructure at machine speed to accelerate remediation.
- Cisco states that these innovations together provide enterprises with a continuously online trust loop to secure, govern, and observe AI agents and complex enterprise AI deployments with不断增强的 capabilities.
Melbourne, Australia, November 9, 2026 /PRNewswire/ — At CISCO LIVE APJC, Cisco (NASDAQ: CSCO) today announced the integration of Claude Mythos into AI Defense for red teaming AI applications and agents, enabling defenders to stress-test AI systems using cutting-edge adversarial reasoning. Combined with new Splunk Agent Observability and Cisco IQ advancements, Cisco is helping enterprises navigate a new era of trust that requires protecting, observing, and governing agents at machine speed.
Jeetu Patel, President and Chief Product Officer at Cisco, said: “Scale is impossible without security, governance, and observability. By combining cutting-edge AI runtime protection with machine-speed agent quality control, we are building a continuous trust loop: safeguarding agents from compromise while ensuring every token expenditure delivers measurable business value.”
As AI agents become increasingly widespread and connect to complex tools and sensitive data, 81% of IT operations and engineering professionals reported increased collaboration between security and observability teams, according to a global research report released by Splunk last month. Cisco notes that Splunk and AI Defense’s innovations enable security leaders to perform customized security testing on advanced AI agents while tracking token expenditures and the effectiveness of tool usage.
Cisco states that since the launch of AI Defense in January 2025, the product has helped hundreds of customers identify critical flaws in AI models, applications, and agents before they enter production. Its adaptive red teaming capability enables security teams to quickly build customized, multi-step attacks targeting specific systems to uncover unique risks. Claude Mythos will enhance this framework with advanced reasoning to plan truly impactful tests and translate results into targeted attack strategies for each system.
Related features include:
- Realistic adversarial scenarios: Generate multi-step, context-aware attack paths designed to help identify subtle vulnerabilities in complex architectures.
- Secure and controlled access: By design, customers can interact only through AI Defense’s structured interface; they do not have open prompt access.
- Audit trail and reproducible results: AI Defense logs every test operation for auditing purposes, and test results can be carried forward for subsequent attack cycles.
Michael Moore, Head of Cybersecurity at Anthropic, said: "Enterprises are increasingly embedding AI agents into their core operations and want to thoroughly test these agents before deploying them in production. By integrating Claude Mythos into Cisco AI Defense, Cisco enables security teams to leverage advanced reasoning to conduct red team testing on their agents, plan tests, and generate attack scenarios for each system."
Cisco states that it has designed multiple layers of defense for AI Defense using Claude Mythos:
- Registered and authorized targets: Testing may only be conducted on targets explicitly registered, owned, and authorized by enterprise customers; scanning of arbitrary internet infrastructure is prohibited.
- Named operator attribution: Each red team test requires authentication and is cryptographically bound to a named enterprise operator.
- Revocable execution: Test tasks run according to fixed jobs and targets defined by human users, with session time limits and the ability to abort on demand.
- Dual-layer supervision: Product-level controls and project-level protection and monitoring operate in parallel.
Closed-loop integration: From test discovery to measurable agent ROI
Cisco stated that cutting-edge AI models may excel at complex security tasks such as developing AI red teaming strategies, but this capability is a double-edged sword. As many enterprises strive to balance security, governance, and return on investment within their expanding AI portfolios, AI is also lowering the barrier to entry for attackers.
Cisco states that for organizations to confidently deploy AI agents at scale, they need unified, real-time visibility into AI agent costs, business performance, and quality. To bridge this trust gap, Cisco has introduced enhanced features to Splunk Agent Observability:
- Tokenomics: This is a cost governance feature, coming soon to AWS Marketplace, that links AI spending to output quality. It leverages usage data from Amazon Bedrock and Amazon CloudWatch to pair the cost of each agent with assessments of its work quality and impact, providing organizations with a unified view of AI ROI. This extends the token spending attribution functionality introduced at .conf26, which tracked costs for AI agents and coding tools such as Claude Code, Codex, and Cursor.
- Eval-G1 Evaluation Model: Splunk Agent Observability extends support for converting agent traces and expert feedback into customized small language models to perform evaluations and guardrails, with costs up to 98% lower than commercial large language models. Cisco states that this generation of Eval-G1 models delivers evaluation response times 2.5 times faster than traditional large language models and enables high-precision real-time agent control.
- Evaluation Tuner: The team can convert agent trajectories and subject matter expert feedback into a fine-tuned evaluation model that executes quality standards and guides agents at machine speed.
Cisco announced that adaptive red teaming powered by Claude Mythos will soon be available to select enterprises. Tokenomics will enter private preview in December and launch officially on AWS Marketplace in early 2027. The model evaluator and Evaluation Tuner are now fully available starting this month.
Connect infrastructure exposure with security actions using Cisco IQ and the Cisco Data Fabric powered by the Splunk platform.
Cisco states that while understanding vulnerabilities is crucial, defenders must also accelerate the remediation of risks within complex enterprise asset environments. Cisco IQ identifies critical exposures, and Cisco’s robust ecosystem of partners and professional services transforms these insights into action. Partners help scale remediation efforts and modernize infrastructure, while Cisco Professional Services bring deep expertise to implement new Cisco capabilities. Cisco says that together, Cisco and its partners can help streamline operations and prepare IT infrastructure for the long-term demands of the AI era.
Cisco states that as AI-accelerated threats compress the window between vulnerability disclosure and exploitation from weeks to hours, one-time audits leave organizations exposed. To help security and network operations teams act at machine speed, Cisco is extending real-time intelligence from Cisco IQ—covering nearly 17,000 customers and over 22 million devices—directly into enterprise security environments, open orchestration protocols, and automated lifecycle workflows.
Main updates include:
- Cisco Data Fabric Integration: Use open APIs to directly import vulnerability, lifecycle, and configuration data from Cisco IQ into the Splunk platform, enabling SecOps teams and AI agents to correlate real-time threat detection with underlying network exposure within Splunk Enterprise Security.
- Model Context Protocol (MCP) with ServiceNow Connector: Provides structured infrastructure context to supported AI agents and enterprise IT service management platforms, automatically converting exposed discoveries into ServiceNow incident records linked to assets, enabling coordinated remediation without manual data reconciliation.
- AI-driven Playbook for Elastic Infrastructure: Presents critical lifecycle vulnerabilities, including personalized alerts for known flaws and quantum-safe cryptography readiness, enabling teams and certified partners to define and prioritize their modernization roadmap.
Liz Centoni, Executive Vice President and Chief Customer Experience Officer at Cisco, said: “AI is reducing the time it takes organizations to respond to threats, but it only matters if you can take action and know where you’re exposed. Integrating Cisco IQ’s vulnerability insights into the Cisco Data Fabric, powered by the Splunk platform, equips analysts with this context during investigations so they can determine the next steps. With our partners and professional services teams, we’re helping customers move from identifying risks to truly reducing them.”
Cisco says that for more information on how to protect and observe agent-based enterprises, visit cisco.com/go/ai-defense.
For more information, see the Cisco blog:
- Cisco AI Defense to Integrate Anthropic's Claude Mythos for AI Red Teaming
- Splunk by Cisco Brings Agent ROI to AWS Marketplace and Real-Time Evaluations to Everyone
- From Risk to Resilience: Close the Gap Between Knowing and Fixing
- Moving Fast and Staying in Control in the Agentic AI Era
About Cisco
Cisco (NASDAQ: CSCO) states that as a global technology leader, it is redefining how organizations connect and protect themselves in the age of AI. For over four decades, Cisco has been connecting the world securely. With industry-leading AI-driven solutions and services, Cisco empowers customers, partners, and communities to unlock innovation, enhance productivity, and strengthen digital resilience. Cisco remains committed to building a more connected and inclusive future. Learn more at The Newsroom and follow @Cisco on X.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the United States and other countries. A list of Cisco trademarks can be found at http://www.cisco.com/go/trademarks. Third-party trademarks mentioned herein are the property of their respective owners. Use of the term "partner" does not imply a partnership between Cisco and any other company.