Cisco Secure Networking Securing the Agentic Workforce

Hamzah Kardme and Nitin Kumar of Cisco explained how Cisco SASE is evolving to secure an agentic workforce. Kardme covered identifying and steering AI traffic at the edge, distributed security enforcement, and unified management in Cisco Cloud Control. Kumar detailed AI Access controls, agent identity, MCP server governance, and semantic inspection of agent tool calls. Both presented as part of Cisco’s appearance at Networking Field Day 41.

Kardme noted that a single question to a personal agent now fans out into many tool calls, API calls, and TLS sessions. Cisco SASE appliances use deep packet inspection with signatures fed from the cloud, so they can classify new AI tools without upgrades. That lets them steer enterprise AI to the best WAN path and limit consumer AI. One fulfillment-center customer’s robots became confused during latency spikes, which forced a 35-minute floor reset each time. Segmentation context from VPNs and security group tags now extends to SASE PoPs, so policy can follow a group tag rather than an IP address. In the demo, Kardme onboarded a London site through a guided workflow with automatic PoP selection, then used AI Canvas to trace Trojan traffic to a roaming client. Kumar described AI Access, which covers more than 3,800 AI applications. He demonstrated blocking unsanctioned tools, enforcing the corporate ChatGPT tenant, endpoint DLP, and guardrail alerts on prompt injection.

Kumar described the next step as zero trust for agents. An integration with Astrix pulls in signals from AI platforms, EDR tools, browsers, and non-human identity fingerprinting. Duo’s identity views showed 73 discovered agents, including a Cursor agent rated high risk because it used a deprecated MCP tool. Agent Gateway, now in beta, applies access policy and segmentation to the MCP servers customers build. Semantic inspection, which is already live, examines every agent tool call. It caught a weather MCP server being asked to harvest user data, and it also surfaces shadow MCP servers. Delegates asked about securing cloud-hosted agents and about forcing deployments through change control. Cisco deferred the first question to Security Field Day and acknowledged that it can’t yet enforce the second. Kumar closed by describing the combined networking and security stack as a unified platform rather than a point product, with zero trust for every agent as the goal.