The Pulse
Cisco announces AI agent red teaming and observability updates
Cisco announced it will add Anthropic’s Claude Mythos to its AI Defense red-teaming framework, with access planned soon for select enterprises. The company also outlined updates to Splunk Agent Observability and Cisco IQ, including new tool
AI.info Team · Written with AI · fact-checked ·
Cisco announced the updates on Nov. 9 at Cisco Live APJC in Melbourne, Australia, spanning AI Defense, Splunk Agent Observability and Cisco IQ. Cisco said the additions are intended to help security and operations teams test AI agents, monitor their performance and connect security findings with infrastructure data.
Red teaming with Claude Mythos
The red-teaming update brings Anthropic’s Claude Mythos into Cisco AI Defense to help teams test AI applications and agents using adversarial reasoning, Cisco said. The adaptive framework lets security teams build customized, multi-step attacks to look for specific risks in systems, Cisco said. Claude Mythos is intended to plan tests and turn their results into attack ideas tailored to each system, according to Cisco.
The testing interface is structured, and customers do not get open-ended prompt access; AI Defense also records actions for audit and repeat testing. The engagements are restricted to customer-registered, owned and authorized targets, and cannot scan arbitrary internet infrastructure. Each engagement requires an authenticated operator, runs against objectives set by a human user and can be halted on demand. Claude Mythos red teaming is coming soon for select enterprises.
“You cannot scale what you cannot secure, govern, or observe,” said Cisco President and Chief Product Officer Jeetu Patel. Cisco said the company is seeking to link runtime protections with controls for agent quality and spending.
Measuring agent cost and quality
For agent monitoring, Cisco described Tokenomics, a cost-governance feature that links AI spending to evaluations of output quality and impact. The feature uses usage data from Amazon Bedrock and Amazon CloudWatch to pair each agent’s cost with evaluations of its work. Tokenomics will enter private preview in December and is scheduled for general availability in AWS Marketplace in early 2027.
Splunk Agent Observability’s Eval-G1 models are designed to run evaluations and guardrails at up to 98% lower cost than a commercial large language model, Cisco said. The models deliver evaluation response times 2.5 times faster than traditional LLMs and support real-time agent control, Cisco said. A related Evaluation Tuner lets teams use agent traces and subject-matter expert feedback to create evaluator models. The evaluation models and tuner are generally available starting this month.
Linking threats to infrastructure
The Cisco IQ update brings vulnerability, lifecycle and configuration data into the Splunk Platform through Cisco Data Fabric integration and open APIs. Cisco said the data can help security teams and AI agents compare live threat detections with network exposure in Splunk Enterprise Security. Cisco also outlined Model Context Protocol and ServiceNow connectors that provide infrastructure context to supported agents and can turn exposure findings into asset-linked ServiceNow problem records.
Cisco IQ has close to 17,000 customers across more than 22 million devices. Cisco said 81% of ITOps and engineering professionals cited increased cooperation between security and observability teams, according to a Splunk research report published the previous month.