Cisco Security Presents at Security Field Day 16

Reimagining Security and Trust for the Agentic Era with Cisco

Watch on YouTube
Watch on Vimeo

Kevin Kennedy of Cisco opened the company’s Security Field Day 16 presentation by framing security and trust for the agentic era. He outlined Cisco’s security imperatives for an AI-armed threat landscape, introduced eBPF-based vulnerability shielding with Live Protect, and explained how agentic AI is reshaping SASE requirements and driving the convergence of security and observability in the SOC. Kennedy, who later handed off to Ant Ducker for a deeper dive, framed the era around two questions: whether organizations can defend against adversaries armed with AI, and whether they can trust their own agents to work securely.

Kennedy illustrated the stakes with a 27-year-old OpenBSD bug that a $50 Mythos run turned into a single-packet crash. He argued that time to exploit has gone negative. AWS saw honeypot exploit attempts against the recent PHP vulnerability four days before the fix shipped. About 15 percent of packages on a common repository still had vulnerable versions four years after Log4j. Customers adopt Cisco’s hardening releases at single-digit rates, so Cisco built Live Protect. It uses eBPF technology from Cisco’s Isovalent acquisition to apply kernel-level, signature-based shields that block exploit paths without reboots or meaningful performance impact. Talos validates and releases the shields, which are included in standard licenses and will cover Cisco’s core products by year end.

Kennedy said Cisco is working to extend shielding to customer workloads, where agents interacting with eBPF find better compensating controls than human-written policy. He also argued that agents will transform SASE. In a survey of roughly 1,000 enterprises, 99 percent called SASE important or critical to agentic AI, and Cisco expects enterprise traffic to more than double within 24 months. Because agents face no consequences for misbehaving, zero trust must shift from access control to action control, enforced inline through agent gateways. Finally, he said the SOC cannot tell whether an agent deleting 10,000 files is compromised, rogue, or working as intended without observability data. That is why Cisco is bringing security and observability together on one data fabric.

Personnel: Kevin Kennedy

Stop Attacks Everywhere with Cisco Hybrid Mesh Firewall

Watch on YouTube
Watch on Vimeo

Tony Giandomenico of Cisco Talos and Ant Ducker of Cisco explained how adversaries are using AI and how Cisco’s hybrid mesh firewall approach is designed to stop attacks everywhere. The session covered AI-assisted and semi-autonomous attack techniques, Cisco’s extension of hybrid mesh firewall to third-party policies, smart switches, and eBPF-protected workloads, and the threat model used for the day’s demos.

Giandomenico said adversaries have moved from human-controlled missions to AI-assisted workflows and are now testing bounded autonomy, though Talos has not seen full autonomy in the wild. Attackers use open source tools with AI built in, such as PentestGPT, to automate reconnaissance, exploitation, and proof-of-concept development. Talos also found 84 malware samples across four families with embedded text meant to trick AI-based file analysis tools into treating the file as harmless. Talos also analyzed implant code that sends reconnaissance data to multiple LLMs. The LLMs vote on the next action from a menu, and the implant executes the winning action with no human involved. Ducker then explained how Cisco extends Gartner’s hybrid mesh firewall concept beyond a single control plane for its own firewalls. Cisco’s version also manages third-party firewall policies, enforces policy at individual switch ports through smart switches, and controls workloads at the kernel level with eBPF.

Giandomenico warned that humans will eventually set a mission and let agents complete it. Agents iterate so fast that attackers may not bother with stealth, because they can be in and out before thousands of alerts are triaged. Ducker argued that hyper-distributed applications demand control from process to socket to network to enforcement point. His example finance app spans legacy tiers, replicated data centers, Kubernetes microservices, and an LLM. He outlined the threat model for the day, built on the Talos implant research. It starts with a browser exploit, moves laterally into SQL injection and zero days across two data centers, then attacks Kubernetes and ends in exfiltration. He positioned Cisco Cloud Control as the platform that manages Cisco’s technology domains, hosts its agentic workforce, and runs on a data fabric built from Splunk.

Personnel: Ant Ducker, Tony Giandomenico

Cisco Identity and Agentic Ops – Stop Attacks Everywhere

Watch on YouTube
Watch on Vimeo

Gayathri Nagarajan of Cisco explained how Cisco surfaces identity-related risk to stop attacks everywhere. She covered Identity Services Engine, Cisco Identity Intelligence and its trust scores for human and non-human identities, and how Cisco firewalls use those scores in dynamic policy. She then demonstrated AgenticOps surfacing and remediating a risky administrator account in Cisco Cloud Control. Nagarajan, product management leader for Hybrid Mesh Firewall and AgenticOps, presented during Cisco Security’s appearance at Security Field Day 16. Her session picked up after Ant Ducker framed the compromised user identity as the first phase of the day’s attack scenario.

Nagarajan argued that attackers increasingly log in rather than hack in, using MFA fatigue, session hijacking, and privilege escalation that network-only controls struggle to catch. Identity Services Engine uses security group tags to follow users and devices across the network. Cisco Identity Intelligence, built from the Oort acquisition, pulls from sources such as Duo, Okta, Entra ID, Workday, Salesforce, GitHub, and AWS to build an identity graph. It assigns trust scores to human and non-human identities by assessing inherent, behavioral, and posture risk, such as missing MFA or unrotated service account credentials. Integrating it with Cisco firewalls creates four system-defined attributes for trusted and untrusted users and devices. These update in real time, so policy can block risky identities, step up their authentication, or selectively decrypt their traffic.

In her demo in Cisco Cloud Control, AgenticOps flagged a user risk spike: a new privileged account was using a bypass token from a denied country. AgenticOps recommended blocking the account, but a dynamic firewall rule had already blocked untrusted and questionable users automatically. Nagarajan said this matters because agents won’t wait for help desk tickets, so identity risk must be handled at machine speed rather than human speed. She noted that Identity Intelligence runs as SaaS without taxing endpoints, and it comes with Duo Premier licenses with no extra firewall license. It does not yet support air-gapped environments, which she said is on the roadmap.

Personnel: Ant Ducker, Gayathri Nagarajan

Stop Attacks Everywhere with Cisco Segmentation

Watch on YouTube
Watch on Vimeo

Ant Ducker of Cisco showed how Cisco builds segmentation and advanced threat prevention for a hyper-distributed application. He demonstrated AI policy discovery, which uses graph-based machine learning to generate candidate micro-segmentation policy. He then explained how Encrypted Visibility Engine, Snort 3, and Snort ML work together in Cisco Secure Firewall to stop known and zero-day threats. Ducker, a security technologist at Cisco, presented during Cisco Security’s appearance at Security Field Day 16.

Ducker said AI policy discovery feeds telemetry from agents, enforcement points, and NetFlow into a graph-based neural network that maps relationships between workloads and clusters. Administrators label the application into scopes and inventories, set a time window, and tune the model, for example to avoid recommending ephemeral port ranges. The resulting visualized policy exposed insecure protocols inside the Kubernetes namespace and let him prune unwanted flows. A flow from an agentic workload to its local MCP server was bound to both port and process, so a rogue process could not reach the server. Encrypted Visibility Engine uses a naive Bayes model to fingerprint TLS flows on the fly and sort them into malicious, benign, or uncertain buckets. Only the uncertain traffic goes to selective decryption.

Ducker argued that signature-based IPS cannot keep up with novel threats generated by AI. Snort ML instead uses a convolutional neural network to recognize malicious byte patterns across SQL injection, command injection, cross-site scripting, and code injection. He said Talos has seen Snort ML detect a novel PHP command injection exploit out of the box, with no model changes. His demo showed Encrypted Visibility Engine blocking TrickBot command and control traffic with high confidence. He acknowledged a compute trade-off but argued the value lies in far less decryption and in protection against undisclosed threats. He urged teams to fit IPS controls to their workloads rather than enabling every rule in block mode, with Snort ML backing up Snort 3 and Talos TruffleHunter rules.

Personnel: Ant Ducker

Cisco Threat Hunting – Stop Attacks Everywhere

Watch on YouTube
Watch on Vimeo

Tony Giandomenico and Ant Ducker of Cisco covered the human side of threat detection and the resilience of the infrastructure underneath it. Giandomenico described a human-led threat hunting service designed to catch campaigns before they reach vendor threat intelligence. Ducker outlined privileged access management, post-quantum resilience, secure boot, and the rollout of Live Protect. The session closed the stop attacks everywhere portion of Cisco Security’s appearance at Security Field Day 16.

Giandomenico, product manager for the threat hunting service, argued that a human element remains essential no matter how much AI is applied to detection. Products must limit false positives, but his hunters can run broad hypotheses that return a thousand hits, triage them with automation, and have investigators review about a hundred a day. Customers are notified only about findings that matter. He said new threat intelligence often takes a day or two to reach products, which leaves attackers a 24-to-48-hour window of unclassified command and control activity that the service aims to catch. Its hunts draw on first-party research, automated OSINT, and data from Cisco’s global incident response work against nation-state and criminal actors. The data sits in large Elasticsearch clusters, and federated searches help control storage costs.

Giandomenico said his team plans to bring Duo and Cisco Identity Intelligence telemetry into hunts early next year, alongside endpoint and firewall data, and to add vendor-neutral sources over time. Ducker then turned to attacks that target infrastructure rather than applications. A privileged access management capability, a couple of months away, will limit user access to a defined change window. Ducker said Cisco can later extend that control to agentic workloads, so even a misbehaving agent stays bound to its maintenance slot. Cisco plans post-quantum resilience across most of its product range by early summer next year, along with secure boot across its data center switches and routers. Live Protect is available now on Nexus smart switches and will extend shortly to SD-WAN and LAN controllers. The rest of Cisco’s infrastructure follows early next year, so critical exploits can be shielded without waiting for a change window.

Personnel: Ant Ducker, Tony Giandomenico

Secure the Workforce with Cisco

Watch on YouTube
Watch on Vimeo

Prabhu Barathi and Aaron Woland of Cisco explained how Cisco is extending zero trust to AI agents as part of securing the workforce. They covered why agents require a shift from access control to action control, agent and non-human identity discovery in Cisco Cloud Control, stream-level visibility through Cisco Secure Client, and authorization for agents based on OAuth 2.1. The session opened the secure the workforce portion of Cisco Security’s appearance at Security Field Day 16.

Barathi, a global security technologist focused on SASE and identity, said a single agent request spawns many machine-to-machine tasks across SaaS APIs, MCP connectors, and enterprise apps. Any delay in those tasks hurts the business, and users blame the network. Agents combine broad data access with machine speed but lack human judgment and fear of consequences. He grouped zero trust for agents into three areas: knowing every agent, authorizing actions, and adapting to risk in real time. Woland, a distinguished engineer focused on identity, said the identity app in Cisco Cloud Control unifies human, device, and agent identities using technology from the Oort and Astrix acquisitions. It combines signals from EDR tools, AI platforms, identity providers, and HR systems like Workday. That lets it identify individual agent instances and sub-agents, and flag agents left running after their owners depart.

Woland said Cisco Secure Client runs on more than 250 million endpoints. Its stream-level interceptor records agent traffic metadata before encryption, without capturing payloads or interfering with VPNs. Its agentic module includes Defense Claw, whose enterprise version is being renamed AI Defense for Endpoints, plus osquery for inventory. It feeds the identity app, AI Defense, the firewall, and Splunk Agent Observability. For authorization, MCP servers or the agent gateway route agents through OAuth 2.1 dynamic client registration. Duo or a third-party identity provider then issues fine-grained tokens for just-in-time, just-enough, just-long-enough access. Woland noted that an inactive accounts check recently helped one customer remove more than 140 stale accounts.

Personnel: Aaron Woland, Prabhu Barathi

Cisco Authorize Every Action

Watch on YouTube
Watch on Vimeo

Prabhu Barathi and Neil Patel of Cisco showed how Cisco Secure Access is extending zero trust from controlling access to authorizing every action that users and agents take. They covered AI Access for generative AI, intent-based AI guardrails, an agent gateway that governs LLM, MCP, and SaaS API traffic, and intent-based inspection that stops indirect prompt injection. The session continued the secure the workforce portion of Cisco Security’s appearance at Security Field Day 16.

Barathi said AI Access identifies more than 3,800 generative AI applications to expose shadow AI. Tenant controls redirect users from unapproved tools like Grok to ChatGPT Enterprise and disable switching to personal workspaces. Because prompts are unstructured, regex pattern matching falls short, so AI guardrails inspect user intent for prompt injection, unsafe content, and privacy leaks. Patel, who leads product management for the Secure Access agent gateway, said the gateway can act as the inference endpoint for agents. That lets administrators limit which models each user and agent can reach and weight requests across providers like Bedrock, Vertex, and Anthropic to control cost. It can also hand agents dummy GitHub or AWS tokens and swap in the real credentials inline, so secrets are never exposed to the agent. In a beta demo, Codex reached a CRM through the gateway, but policy blocked a product manager’s attempt to bulk-close cases.

Patel said the gateway enforces controls when agents point to it explicitly. Without that, it relies on TLS inspection, backed by agent hooks in AI Defense for Endpoints. He said the capabilities will move into an agent security experience in Cisco Cloud Control and be licensed together under AI Defense. Barathi then argued that URL filtering cannot catch malicious instructions hidden inside legitimate MCP tool calls. In his demo, a malicious Notion page told an agent to suppress its security warnings, and the agent then handed over password and credit card pages. With intent-based inspection enabled, the same requests were blocked under a data exfiltration policy. Barathi closed by stressing that this is not a new product to buy. Instead, Cisco is adapting controls built for the human workforce to agents.

Personnel: Neil Patel, Prabhu Barathi

Cisco Data Fabric AI Observability – Defend at Machine Speed

Watch on YouTube
Watch on Vimeo

Tapan Shah of Splunk explained how Cisco aims to close the trust gap in agentic AI by unifying observability and security on the Cisco Data Fabric. He covered federated data, correlation at scale, and agent observability capabilities for evaluations, tracing, tokenomics, and guardrails. He then demonstrated catching and correcting an AI support agent that issued an unauthorized refund. The session opened the defend at machine speed portion of Cisco Security’s appearance at Security Field Day 16.

Shah framed the problem around non-deterministic agent behavior, weak governance, and rising AI costs. He gave the example of an agent that leaves 15 servers unpatched with no explanation. Security can show which files were deleted and by whom, but only observability reveals whether a human or a “digital employee” acted, and why. The Cisco Data Fabric, powered by Splunk, ingests structured and unstructured data from any vendor. It can also federate queries to data where it resides rather than requiring centralization. On top of it, agent observability uses OpenTelemetry data to evaluate responses for hallucination, toxicity, bias, and relevance. It traces spans between agents and LLMs, tracks token costs with optimization suggestions, and enforces guardrails. It can be deployed in the cloud or on-premises.

Shah argued that guardrails matter because a crafted prompt can push agents into behavior they were never meant to allow. He cited an airline agent that granted him a $7,000 refund outside its 24-hour window. In a demo with Voltway, a fictitious retailer, a support agent issued a $1,200 refund against a $699.98 receipt. Inside Cisco Cloud Control, tracing flagged poor instruction adherence and correlated 15 signals, 13 of which affected five sessions tied to incorrect refund confirmations. The platform recommended a refund compliance policy automatically, without the user configuring it. Once enabled, the policy ran as a guardrail before the refund step, and the agent refunded the correct amount. Shah said the goal is not only to flag bad agent behavior but to improve it.

Personnel: Tapan Shah

Cisco Data Fabric Agentic SOC

Watch on YouTube
Watch on Vimeo

Neal Iyer of Cisco outlined Cisco’s agentic SOC strategy for defending at machine speed. He covered autonomous defense that combines deterministic and agentic automation, tiered storage on the Cisco Data Fabric to keep costs from scaling with data, and the discovery and prioritization of exposures. Ant Ducker then demonstrated a triage agent investigating DNS tunneling in Cisco Cloud Control.

Iyer said autonomous defense only works at scale and with trust. That requires deterministic automation alongside agents, plus native agent observability and AI Defense to secure the agents themselves. Customers can build their own agents with Agent Launchpad or bring in third-party agents. One Fortune 500 customer saw two-thirds of its queue resolved as benign, with no false negatives over three months. Another customer verifies every recommendation and still cut mean time to disposition from 20 minutes to five. Cisco uses OpenAI models with proprietary small language models and limits itself to US models. It runs evaluations on every agent run using the Luna models from its Galileo acquisition. Tiered storage lets agents promote cold data only when an investigation needs it, which is the basis for Cisco’s goal of letting customers 10x their data without changing their bill.

Iyer predicted that detection engineers will shift from writing SIEM rules to recommending policy for firewalls and endpoints. On exposures, Exposure Analytics, built on IP from Discovered Intelligence, parses Splunk logs to map assets, identities, and IP addresses, with agents coming soon. That context drives prioritization, such as patching the hundred servers without EDR before the rest. Emerging threat response agents will check new intelligence for affected assets, active exploitation, and detection gaps. Red, blue, and green team agents will emulate adversaries to find gaps before attackers do. Cisco is also building cloud-connected and fully air-gapped versions with no hyperscaler or frontier model dependencies for sovereign customers. Ducker’s demo showed enriched Secure Firewall logs surfacing DNS tunneling and a triage agent laying out what happened, why it matters, and how to remediate.

Personnel: Ant Ducker, Neal Iyer