Cisco bets on unified security to counter AI-led threats

Complexity is one of the most significant issues facing technology leaders. As new challenges and technologies emerge, new products and services are typically added to the technology stack. Adding to that is the continual shift in products as vendors add to their portfolios. And AI has changed the game as attackers can now find vulnerabilities that may never have been found by humans.

The rapid growth in AI use by threat actors has vastly increased the size of the attack surface as each project in the technology stack must be monitored, maintained and secured. Cisco is betting that simplicity and an integrated platform will be more important than individual features.

"Vulnerabilities are being found that would never have been found by humans," said Jeff Schultz, the SVP for Portfolio Strategy and Marketing at Cisco said at Cisco Live 2026 in Melbourne.

This complexity and the issues that derive from it are driving networking, security, observability and management into a unified architecture. Security will be integrated into networking through capabilities such as hybrid mesh firewall and smart switches, while identity and segmentation will extend beyond human users to AI agents and devices. Cisco Cloud Control will provide a common operational and management layer with Splunk supplying the data and intelligence to support security decisions.

Oliver Tuszik, Cisco EVP AND Chief Sales Officer, said "Security can't be an afterthought. It needs to be built in right from the beginning, especially on agents."

Cisco's security strategy is founded on using AI to identify vulnerabilities and weaknesses before attackers exploit them, and defensively to respond at machine speed. During Cisco Live, the company announced a partnership with Anthropic that brings Claude Mythos into Cisco's AI Defence red-teaming capabilities.

AI Defence discovers AI models, applications and agents, tests them for vulnerabilities and applies guardrails. When a vulnerability is discovered, AI Defence puts a shield in place to protect systems until a patch is released and there is an opportunity to apply it.

"That shield can be automatically deployed and prevents a vulnerability from being exploited," explained Schultz.

The company said more than 600 customers have worked with AI Defence since its introduction.

Splunk's acquisition by Cisco was completed in 2024 and it is now central to Cisco's cybersecurity strategy. It provides the telemetry, observability and analytics required to support automated defence. The company's ambition is to combine signals from networking, security, applications and AI agents so threats can be identified and addressed more quickly.

Traditional security monitoring might establish that files have been accessed, altered or deleted, but it cannot determine whether the deletion resulted from an external attack, a rogue agent or an authorised instruction. Kevin Kennedy, Vice President Cisco Security Strategy said, "When you bring together security and observability you can actually see the intent."

Schultz added, "Splunk is really integral now to everything we are doing within the security story and within this platform for agentic trust. What we're finding is that the line between observing an agent and securing an agent is beginning to blur."

Unified platform

Creating a unified platform has forced a significant reorganisation within Cisco. While technology and security leaders face complexity within their infrastructure stack, Cisco's product portfolio made finding solutions difficult.

"Organisations spend more of their time trying to stitch things together and making them work than actually doing security," said Kennedy.

The company is responding with improved product integration, a common management platform and a fundamental change to its sales organisation.

"Our portfolio was too complex, not integrated," said Tuszik. "Customers love what we're offering, but they were complaining about the effort they had to implement it. We decided to reduce the number of specialists and increase the number of front-end portfolio sellers because that's where we create our unique position."

While Cisco is working to streamline its product portfolio to make it easier to navigate, the challenge will be persuading customers to modernise their infrastructure and operating practices. For example, Kennedy nominated automated patching and retiring obsolete technology as two practical priorities for organisations that cannot afford to rebuild their security environments.

To address existing security weaknesses, Kennedy said, "Making sure you are conscientiously removing tech debt, and end of life software and systems are key."

This will become increasingly important as threat actors employ more AI for vulnerability detection and to create attack tools. And with defenders using AI, we are soon approaching the time when agents will be battling agents.

"We're not there yet, but we are headed towards lots of agent on agent fighting," added Kennedy.

As the threat landscape continues to evolve, Cisco is committed to reducing complexity with a unified, AI‑powered platform that will move security from an afterthought to a foundational capability. The company's strategy of removing technical debt, automating patching, and tightening agent trust will prepare organisations for the inevitable day when every device must fight, defend, and collaborate on the same battlefield.