Enterprises deploying AI agents face a harder control problem than traditional application teams: they must test agents before production, watch their behavior after deployment and connect technical findings to business cost. Cisco (NASDAQ: CSCO) is adding tools across AI Defense, Splunk Agent Observability and Cisco IQ that target those three operational gaps.
The company said its AI Defense platform will add Claude Mythos for adaptive red teaming of AI applications and agents. Cisco described the integration as a way for security teams to create customized, multi-step attack tests against systems they own and authorize for testing. The platform records testing actions for audit, requires named operators and runs engagements within fixed, revocable jobs, according to Cisco.
Those controls matter because red-team exercises against an agent can involve access to tools, data and workflows that ordinary model evaluations do not touch. Cisco said its structured interface does not give customers open-ended prompt access to the model used in the testing workflow. The company said the capability will be available soon to select enterprises, rather than generally available at launch.
On the operations side, Splunk Agent Observability is gaining Tokenomics, a cost-governance feature that links an agent’s usage cost to evaluations of its output quality and impact. Cisco said Tokenomics uses Amazon Bedrock and Amazon CloudWatch usage data and is scheduled for private preview in December, with availability through AWS Marketplace planned for early 2027. The company also said its Eval-G1 evaluation models and Evaluation Tuner are generally available this month.
Cisco said the evaluation models can turn agent traces and expert feedback into custom small language models that run evaluations and guardrails. The company said these models can operate at up to 98% lower cost than a commercial large language model and respond 2.5 times faster than traditional LLMs. Those are Cisco performance claims, but the operational objective is clear: move evaluation from an occasional review into a control that can run alongside agent activity.
For infrastructure and security teams, Cisco is extending Cisco IQ vulnerability, lifecycle and configuration data into the Splunk Platform through open APIs. The company said that integration is intended to help SecOps teams correlate live threat detections with network exposure. It also announced Model Context Protocol and ServiceNow connectors that can translate exposure findings into asset-linked problem records, reducing the manual reconciliation needed to start remediation work.
The updates do not eliminate the need for an enterprise to define which agent actions are acceptable or to validate vendor performance claims. But they combine testing, runtime quality signals, spend data and infrastructure context in a more connected workflow. That could make it easier for security, platform and finance teams to investigate a risky agent behavior using the same operating picture.
Cisco’s strategy also illustrates how the AI-agent market is shifting beyond standalone guardrail products. Legacy security and observability tools often leave teams to join testing results, operational telemetry and asset data themselves. Cisco is positioning its portfolio around that integration point: a single path from an AI-agent test or threat signal to the systems and remediation work that enterprise teams must manage.