Melbourne, Australia – Cisco has introduced new artificial intelligence (AI) security and observability capabilities designed to help enterprises test AI agents for vulnerabilities, monitor their performance and manage infrastructure risks.
The updates include the integration of Anthropic‘s Claude Mythos into Cisco AI Defence for AI red teaming, enhancements to Splunk Agent Observability and new infrastructure intelligence features for Cisco IQ.
The company said the additions are intended to help security and operations teams assess AI-related risks, monitor agent costs and performance, and accelerate responses to vulnerabilities as organisations deploy more AI agents across business operations.
“You cannot scale what you cannot secure, govern, or observe,” said Jeetu Patel, President and Chief Product Officer at Cisco.
“By uniting frontier-level AI runtime protections with machine-speed agent quality controls, we are building a continuous trust loop: protecting agents from compromise while ensuring every token spent delivers measurable business value,” Patel continued.
AI Defence adds Claude Mythos for red teaming
The integration of Claude Mythos into Cisco AI Defence will allow security teams to conduct more advanced red teaming exercises against AI applications and agents. The framework uses adversarial testing to simulate potential attacks and identify vulnerabilities before systems enter production.
Cisco said its adaptive red teaming capabilities allow organisations to create customised, multi-step attack scenarios based on the systems being tested. Claude Mythos will add advanced reasoning capabilities to help develop relevant test strategies and generate attack ideas.
The features include contextual attack-path generation, controlled access through AI Defense’s structured interface, and audit trails that record testing activity for review and repeatability.
The integration also includes safeguards that restrict testing to targets registered and authorised by enterprise customers. Each engagement requires authentication linked to a named operator, while time-limited sessions can be stopped on demand. Product-level controls are supported by additional programme-level oversight and monitoring.
“Enterprises are increasingly building AI agents into their core operations and want to test those agents thoroughly before putting them into production,” said Michael Moore, Cybersecurity Lead at Anthropic.
“By bringing Claude Mythos to Cisco AI Defence, Cisco can help security teams red team their agents with advanced reasoning that plans tests and generates attack ideas for each system,” Moore continued.
Adaptive red teaming with Claude Mythos is expected to become available soon to selected enterprises.
Splunk adds agent cost and performance monitoring
Cisco is also expanding Splunk Agent Observability with tools designed to give organisations greater visibility into AI agent spending, output quality and operational performance.
One addition, Tokenomics, links AI expenditure to the quality and impact of an agent’s work. Using usage data from Amazon Bedrock and Amazon CloudWatch, the feature provides a view of agent costs alongside evaluations of their outputs.
Tokenomics builds on existing cost attribution capabilities that track spending across AI agents and coding tools, including Claude Code, Codex and Cursor.
The update also introduces Eval-G1 evaluation models, which use agent activity traces and expert feedback to create smaller language models for evaluating agent performance and enforcing guardrails. Cisco said these models can run evaluations at up to 98 per cent lower cost than commercial large language models, with response times 2.5 times faster than traditional models.
The Evaluation Tuner allows teams to use agent traces and subject matter expert feedback to fine-tune evaluator models and apply quality standards to agent operations.
Tokenomics is expected to enter private preview in December, with general availability through AWS Marketplace planned for early 2027. The evaluation models and Evaluation Tuner are generally available from November.
Cisco IQ connects infrastructure exposure with security operations
Cisco is also extending Cisco IQ’s infrastructure intelligence into security and network operations environments through integrations with Cisco Data Fabric, powered by the Splunk Platform.
The update is intended to help security teams correlate live threat detections with vulnerabilities, lifecycle information and configuration data across enterprise infrastructure.
Cisco IQ, which the company said serves nearly 17,000 customers across more than 22 million devices, will provide infrastructure information to Splunk through open application programming interfaces.
Additional integrations include support for the Model Context Protocol (MCP) and ServiceNow connectors. These are designed to provide infrastructure context to supported AI agents and IT service management platforms, while converting exposure findings into asset-linked ServiceNow problem records to support remediation.
An AI-powered infrastructure playbook will also identify lifecycle vulnerabilities, provide alerts about known defects and assess readiness for quantum-safe cryptography. The information can help organisations and certified partners prioritise infrastructure upgrades and modernisation plans.
“AI is shrinking the time organisations have to respond to threats, and knowing where you’re exposed only matters if you can act on it,” said Liz Centoni, Cisco EVP and Chief Customer Experience Officer.
“Bringing Cisco IQ vulnerability insights into Cisco Data Fabric powered by the Splunk Platform gives analysts that context in the middle of an investigation, so they can decide what to do next. With our partners and Professional Services teams, we’re helping customers move from identifying risk to actually reducing it,” Centoni continued.
The updates form part of Cisco’s broader effort to help enterprises secure, govern and monitor AI deployments while connecting security insights with operational responses.
