Cisco Data Fabric Agentic SOC

Neal Iyer of Cisco outlined Cisco’s agentic SOC strategy for defending at machine speed. He covered autonomous defense that combines deterministic and agentic automation, tiered storage on the Cisco Data Fabric to keep costs from scaling with data, and the discovery and prioritization of exposures. Ant Ducker then demonstrated a triage agent investigating DNS tunneling in Cisco Cloud Control.

Iyer said autonomous defense only works at scale and with trust. That requires deterministic automation alongside agents, plus native agent observability and AI Defense to secure the agents themselves. Customers can build their own agents with Agent Launchpad or bring in third-party agents. One Fortune 500 customer saw two-thirds of its queue resolved as benign, with no false negatives over three months. Another customer verifies every recommendation and still cut mean time to disposition from 20 minutes to five. Cisco uses OpenAI models with proprietary small language models and limits itself to US models. It runs evaluations on every agent run using the Luna models from its Galileo acquisition. Tiered storage lets agents promote cold data only when an investigation needs it, which is the basis for Cisco’s goal of letting customers 10x their data without changing their bill.

Iyer predicted that detection engineers will shift from writing SIEM rules to recommending policy for firewalls and endpoints. On exposures, Exposure Analytics, built on IP from Discovered Intelligence, parses Splunk logs to map assets, identities, and IP addresses, with agents coming soon. That context drives prioritization, such as patching the hundred servers without EDR before the rest. Emerging threat response agents will check new intelligence for affected assets, active exploitation, and detection gaps. Red, blue, and green team agents will emulate adversaries to find gaps before attackers do. Cisco is also building cloud-connected and fully air-gapped versions with no hyperscaler or frontier model dependencies for sovereign customers. Ducker’s demo showed enriched Secure Firewall logs surfacing DNS tunneling and a triage agent laying out what happened, why it matters, and how to remediate.