Singapore – Cisco has unveiled a series of Splunk advancements aimed at helping enterprises deploy artificial intelligence with greater trust, control and cost visibility. The announcements span on-premises AI deployment, spend tracking and agentic security operations.
According to Cisco, the update addresses a persistent barrier to enterprise AI adoption: confidence, rather than capability. The company says customers need assurance that AI is secure, governed and cost-effective before they scale it across their organisations.
Central to the announcement is an expanded partnership between Cisco and NVIDIA, which brings self-managed Splunk AI to on-premises, private cloud and air-gapped environments. The move is designed for organisations unable to move sensitive data to the cloud, Cisco said.
The Cisco Secure AI Factory with NVIDIA, a reference architecture combining Cisco infrastructure, NVIDIA accelerated computing and a Kubernetes-based architecture, underpins the offering. Its newest configuration, Cisco AI POD for Splunk, is available today and has been pre-validated for Splunk AI workloads.
Partners including Accenture, bitsIO, Wipro and World Wide Technology are positioned to support customers deploying the new infrastructure from launch, according to Cisco.
Running on this layer are Splunk AI Assistant, available now, and Agent Launchpad, due later this year. Together, the two tools enable ad-hoc agentic investigations and custom agent building, including for agentic security operations centres, within customers’ own data centres.
Customers will also be able to self-host a range of generative AI models for Splunk Enterprise workloads. These include the Cisco Deep Time Series Model, Google Gemma 4 and OpenAI GPT-OSS 20B, with NVIDIA Nemotron open models expected in the coming months.
“One of the biggest roadblocks to enterprise AI today is that it’s too hard to deploy,” said Jeetu Patel, President and Chief Product Officer, Cisco.
“Customers want to know: Can I trust it to do the job? Can I afford it? And, most importantly, can I secure it? By running Splunk AI on the infrastructure customers already trust, they can move faster to put AI to work in their business with confidence and control,” Patel added.
Justin Boitano, Vice President of Enterprise AI at NVIDIA, echoed the emphasis on data sovereignty. “Enterprises need to bring AI where their data lives, especially when security and sovereignty requirements require critical workloads to stay on-premises,” he said.
“By enabling Splunk AI workloads to run with NVIDIA Nemotron open models on NVIDIA accelerated computing, Cisco and NVIDIA are working together to bring AI agents directly to Splunk and giving organizations a high-performance, full-stack foundation for agentic security operations wherever they run their infrastructure,” Boitano added.
Beyond deployment, Cisco has introduced new observability tools to help organisations track how AI agents perform and spend. Splunk Agent Observability now includes a Tokenomics capability, which the company says gives real-time visibility into agent performance and token expenditure.
The feature tracks and attributes token spend across AI agents as well as employees’ use of coding agents such as Claude Code, Codex and Cursor. It also forecasts consumption patterns using the Cisco Deep Time Series Model, allowing organisations to anticipate spend before a billing period closes, according to Cisco.
Splunk Agent Observability, initially launched as an on-premises offering, is now also available in Splunk Observability Cloud and Cisco Cloud Control. Cisco says the tool evaluates agent and model behaviour, monitors performance across the AI stack, and applies runtime guardrails against risks such as hallucinations and sensitive data leakage.
Additional observability updates include the Observability Studio, designed to help teams build applications that are measurable and production-ready from the outset, and the Network Intelligence App, which brings Cisco network topology, device health and event data into Splunk. Cisco has also introduced Essentials and Premier editions of Observability Cloud, aimed at simplifying how customers purchase and scale observability capabilities.
On the security front, Cisco is expanding Splunk’s agentic security operations centre capabilities to help teams counter AI-driven attacks that move faster than traditional, human-led responses. New agent capabilities extend the Splunk Agentic SOC Workforce across detection engineering, threat hunting, investigation, response and policy governance, the company said.
These agents draw on enterprise-wide telemetry and specialised AI models to correlate data across network, cloud, application and identity environments, according to Cisco. The company says this approach is intended to reduce alert noise and speed up mean time to remediate.
Cisco has also enhanced Exposure Analytics with broader asset coverage, historical change tracking and business-specific risk insights, responding to growing pressure for complete exposure visibility amid AI-driven vulnerability scanning by attackers. The tool connects exposure context with live security activity across Splunk, Cisco and third-party systems, the company said.
New capabilities have also been added to Splunk Enterprise Security Essentials, extending agentic security operations to a wider range of teams, while Splunk Enterprise Security Premier offers deeper agentic autonomy alongside the platform’s full feature set.
Separately, Splunk and AWS have signed a multi-year agreement to jointly develop security solutions aimed at matching the pace of AI-driven attacks. The companies said the partnership will combine Splunk’s data platform and detection capabilities with AWS’s cloud scale to support analysts across detection, investigation and response.
