Cisco Identity and Agentic Ops – Stop Attacks Everywhere

Gayathri Nagarajan of Cisco explained how Cisco surfaces identity-related risk to stop attacks everywhere. She covered Identity Services Engine, Cisco Identity Intelligence and its trust scores for human and non-human identities, and how Cisco firewalls use those scores in dynamic policy. She then demonstrated AgenticOps surfacing and remediating a risky administrator account in Cisco Cloud Control. Nagarajan, product management leader for Hybrid Mesh Firewall and AgenticOps, presented during Cisco Security’s appearance at Security Field Day 16. Her session picked up after Ant Ducker framed the compromised user identity as the first phase of the day’s attack scenario.

Nagarajan argued that attackers increasingly log in rather than hack in, using MFA fatigue, session hijacking, and privilege escalation that network-only controls struggle to catch. Identity Services Engine uses security group tags to follow users and devices across the network. Cisco Identity Intelligence, built from the Oort acquisition, pulls from sources such as Duo, Okta, Entra ID, Workday, Salesforce, GitHub, and AWS to build an identity graph. It assigns trust scores to human and non-human identities by assessing inherent, behavioral, and posture risk, such as missing MFA or unrotated service account credentials. Integrating it with Cisco firewalls creates four system-defined attributes for trusted and untrusted users and devices. These update in real time, so policy can block risky identities, step up their authentication, or selectively decrypt their traffic.

In her demo in Cisco Cloud Control, AgenticOps flagged a user risk spike: a new privileged account was using a bypass token from a denied country. AgenticOps recommended blocking the account, but a dynamic firewall rule had already blocked untrusted and questionable users automatically. Nagarajan said this matters because agents won’t wait for help desk tickets, so identity risk must be handled at machine speed rather than human speed. She noted that Identity Intelligence runs as SaaS without taxing endpoints, and it comes with Duo Premier licenses with no extra firewall license. It does not yet support air-gapped environments, which she said is on the roadmap.