The new features of AI Defense, Splunk, and Cisco IQ will provide a unified closed-loop for security and operations teams, which is used to identify risks, measure value, and prove credibility.

News Summary:

• The adaptive AI red team testing framework of Cisco AI Defense will add Claude Mythos, utilizing advanced adversarial reasoning to simulate real-world attacks targeting AI proxies.
• Leveraging Cisco Enhanced Edition Tokenomics, enterprises can optimize AI expenditures by directly correlating proxy costs with return on investment in real-time, thereby prioritizing resources for the most critical protection targets.
• Built using decades of data on vulnerabilities and troubleshooting, Cisco IQ is now capable of correlating real-time threat detection data with potentially exposed network infrastructure at machine speed, thereby accelerating the repair process.
• Cisco states that these innovations collectively provide enterprises with a continuously online trust loop to protect, govern, and monitor an increasingly sophisticated deployment of AI proxies and complex enterprise AI environments.

Melbourne, Australia, November 9, 2026 / PRNewswire / -- At the CISCO LIVE APJC conference, Cisco ( NASDAQ : CSCO ) announced today that it will integrate Claude Mythos with AI Defense for red-team testing of AI applications and proxies, enabling the defense to use cutting-edge adversarial reasoning capabilities to conduct stress tests on the AI system. Along with the advancements in new Splunk Agent Observability and Cisco IQ, Cisco stated that it is helping companies embrace a new era of trust that requires protection, observation, and governance of proxies at machine speed.

Cisco President and Chief Product Officer Jeetu Patel stated: "Without ensuring security, governance, or visibility, scalability cannot be achieved. By combining cutting-edge AI runtime protection with proxy quality control at machine speed, we are building a continuous trust loop: protecting proxies from intrusion while ensuring that every token expenditure brings measurable business value."

As AI proxies continue to become more widespread and are connected to complex tools and sensitive data, according to a global research report published by Splunk last month, 81% of IT operations and engineering professionals stated that collaboration between security teams and observability teams has increased. Cisco claims that these innovations in Splunk and AI Defense can help security leaders conduct customized security tests on high-capacity AI proxies, while also tracking token expenditures and the effectiveness of tool usage.

Cisco stated that since the launch of AI Defense in January 2025, this product has helped hundreds of customers identify critical defects before AI models, applications, and proxies are deployed into production environments. Its adaptive red team testing feature allows security teams to quickly build customized multi-step attacks targeting specific systems in order to uncover particular risks. Claude Mythos will enhance this framework with advanced reasoning, plan truly important tests, and transform the results into attack strategies tailored for each system.

Relevant functions include:

• Realistic adversarial concept:Generate multi-step, context-aware attack paths aimed at helping to identify subtle vulnerabilities in complex architectures.
• Secure and controlled access:According to the design, customers can only interact through the structured interface of AI Defense; customers do not have access to open-ended prompts.
• Audit trail and repeatable results:AI Defense will record each test operation for auditing purposes, and the test results can also be reused in subsequent attack cycles.

Anthropic The person in charge of network security Michael Moore stated: "More and more enterprises are integrating AI proxies into their core operations and hope to conduct thorough testing on these proxies before putting them into production. By introducing Claude Mythos into Cisco AI Defense, Cisco can help security teams use advanced reasoning to carry out red-team testing on these proxies, plan the tests, and generate attack strategies for each system."

Cisco stated that it has designed multiple layers of protection measures for AI Defense using Claude Mythos.

• Registered, authorized targets:Only intended for target operations that are explicitly registered, owned by corporate customers, and authorized for testing; it is not allowed to scan any internet infrastructure.
• Named operator attribution:Each time the red team conducts a test, authentication is required, and it must be bound to a named corporate operator in an encrypted manner.
• Revocable execution:The test tasks are run based on fixed assignments and objectives defined by human users. Sessions have time limits and can be terminated as needed.
• Double-layer supervision:AI Defense offers product-level control in conjunction with project-level protection and monitoring that operate in parallel.

Closed-loop solution: From test findings to measurable return on proxy investment

Cisco indicates that cutting-edge AI models may perform exceptionally well in complex security tasks such as formulating AI red team testing strategies, but this capability has a dual nature. At a time when many enterprises are striving to balance security, governance, and return on investment within the continuously expanding AI mix, AI is also lowering the entry barrier for attackers.

Cisco states that in order for organizations to be able to deploy AI proxies on a large scale with confidence, they need unified, real-time visibility into the costs, business performance, and quality of these proxies. To bridge this trust gap, Cisco has introduced enhanced features for Splunk Agent Observability.

• Tokenomics:This is a cost management feature that will be launched under AWS Marketplace. It allows for the association of AI expenditures with output quality. By utilizing usage data from Amazon Bedrock and Amazon CloudWatch, this feature pairs each agent's costs with evaluations of their work quality and impact, providing the organization with a unified view of AI return on investment. It expands on the token expenditure attribution feature previously introduced in conf26, which can track the costs of AI agents as well as coding tools such as Claude Code, Codex, and Cursor.
• Eval-G1 Evaluation Model:Splunk Agent Observability has expanded support for the following capabilities: it converts proxy trajectories and expert feedback into customized small language models for evaluation and safety mechanisms, with costs that can be up to 98% lower than those of commercial large language models. Cisco claims that this generation of Eval-G1 models has an evaluation response speed 2.5 times faster than traditional large language models and can achieve real-time proxy control with high precision.
• Evaluation Tuner:The team can transform their proxy trajectories and feedback from subject experts into a fine-tuned evaluator model, which can then execute quality standards at machine speed to guide the proxies.

Cisco indicates that the adaptive red team testing equipped with Claude Mythos will soon be rolled out to some enterprises. Tokenomics will enter private preview in December and will be officially launched on AWS Marketplace at the beginning of 2027. The evaluation model and Evaluation Tuner have been fully available since this month.

Leveraging Cisco IQ and Cisco Data Fabric driven by the Splunk platform, we connect infrastructure exposure with security actions.

Cisco states that while understanding the exposure of vulnerabilities is crucial, defenders must also accelerate the speed at which they fix these risks in complex enterprise asset environments. Cisco IQ is used to identify key exposures, and the strong ecosystem of Cisco partners and professional services can transform insights into action. Partners help to advance repairs on a large scale and modernize infrastructure, while Cisco Professional Services provides deep expertise to implement new Cisco functions. Cisco claims that Cisco and its partners can work together to simplify operations and prepare the IT infrastructure for the long-term needs of the AI era.

Cisco states that as the time window between the discovery of vulnerabilities and their exploitation, accelerated by AI, is compressed from weeks to hours, a one-time audit can expose organizations to risk. To help security and network operations teams take action at machine speed, Cisco is directly extending real-time intelligence from Cisco IQ – which covers nearly 17,000 customers and over 22 million devices – to enterprise security environments, open proxy protocols, and automated lifecycle workflows.

Main updates include:

• Cisco Data Fabric Integration:By enabling API, the vulnerabilities, lifecycle, and configuration data of Cisco IQ can be directly imported into the Splunk platform. This allows the SecOps team and AI agents to correlate real-time threat detection with underlying network exposures within Splunk Enterprise Security.
• Model Context Protocol (MCP) and ServiceNow Connector:Provides structured infrastructure context to supported AI proxies and enterprise IT service management platforms, automatically converting exposed issues into ServiceNow issue records associated with assets, facilitating coordinated repairs without the need for manual data reconciliation.
• AI Driven Elastic Infrastructure Action Manual:Present critical lifecycle vulnerabilities, including personalized reminders for known defects and quantum-safe cryptography readiness, enabling teams and certified partners to define and prioritize modernization roadmaps.

Cisco Executive Vice President and Chief Customer Experience Officer Liz Centoni stated: " AI is shortening the time it takes for organizations to respond to threats, and only by being able to take action and knowing where they are exposed does it make sense. Integrating the vulnerability insights from Cisco IQ into the Cisco Data Fabric driven by the Splunk platform allows analysts to gain this context during the investigation process, thereby determining what to do next. With the help of our partners and professional services team, we are helping customers move from identifying risks to truly reducing them."

Cisco indicates that for further information on how to protect and monitor proxy enterprises, you can visit cisco.com / go / ai-defense.

For more information, please refer to Cisco's blog:

• Cisco AI Defense to Add Anthropic 's Claude Mythos for AI Red Teaming
• Splunk by Cisco Brings Agent ROI to AWS Marketplace and Real-time Evaluations to Everyone
• From Risk to Resilience : Close the Gap Between Knowing and Fixing
• Moving Fast and Staying in Control in the Agentic AI Era

About Cisco

Cisco ( NASDAQ : CSCO ) states that the company is a global technology leader, reshaping the way organizations connect and protect themselves in the AI era. For over 40 years, Cisco has been connecting the world in a secure manner. With its industry-leading AI driven solutions and services, Cisco helps customers, partners, and communities unleash innovation, enhance productivity, and increase digital resilience. Cisco asserts that it is always committed to creating a more connected and inclusive future. For more information, please visit The Newsroom, and follow @ Cisco on the X platform.

Cisco and the Cisco designation are trademarks or registered trademarks of Cisco and/or its affiliated companies in the United States and other countries. A list of Cisco trademarks can be found at http :// www.cisco.com / go / trademarks. Third-party trademarks mentioned in this text are the property of their respective owners. The use of the term “partner” does not imply any partnership between Cisco and any other companies.