Cisco Bets a Unified Security Platform on the Age of AI Attackers

Cisco says vulnerabilities are now being discovered that no human attacker would ever have found, and it is betting $1 of strategy on one answer: a unified, AI-powered security platform rather than a bigger pile of point products.

The line came from Jeff Schultz, SVP for Portfolio Strategy and Marketing at Cisco, speaking at Cisco Live 2026 in Melbourne on 12 November. "Vulnerabilities are being found that would never have been found by humans," Schultz said. The driver is AI. Attackers now use machine learning to find weaknesses at a scale and speed that human penetration testers cannot match, and each new AI project added to a technology stack widens the attack surface that security teams must monitor, maintain and defend.

That reality is pushing Cisco to fuse networking, security, observability and management into a single architecture. It is a strategic pivot for a company long criticized for sprawl, and it matters beyond Cisco's own walls: enterprises everywhere are drowning in stitched-together security tools while AI-accelerated attackers move faster than patch cycles.

What does the unified platform actually include?

Cisco's pitch rests on several concrete pieces announced and detailed at the Melbourne event:

• Security built into networking through capabilities such as a hybrid mesh firewall and smart switches, rather than bolted on afterward.
• Identity and segmentation extended beyond humans to cover AI agents and devices — not just employees logging in.
• Cisco Cloud Control as a common operational and management layer across the estate.
• Splunk supplying the data and intelligence that feeds security decisions across the platform.

"Security can't be an afterthought. It needs to be built in right from the beginning, especially on agents," said Oliver Tuszik, Cisco EVP and Chief Sales Officer.

Where does Anthropic fit in?

During Cisco Live, Cisco announced a partnership with Anthropic that brings Claude Mythos into Cisco's AI Defence red-teaming capabilities. It is the clearest signal yet of how seriously Cisco takes AI-on-AI security — using AI models to attack Cisco's own AI deployments before real adversaries do.

AI Defence, the product at the center of this strategy, discovers AI models, applications and agents running in an environment, tests them for vulnerabilities, and applies guardrails. When it finds a flaw, it does not just file a report. It puts a temporary shield in place to protect systems until a patch is released and applied.

"That shield can be automatically deployed and prevents a vulnerability from being exploited," Schultz explained.

Cisco said more than 600 customers have worked with AI Defence since its introduction.

Why is Splunk now central to the plan?

Cisco completed its acquisition of Splunk in 2024, and the company now positions Splunk as the intelligence engine of its cybersecurity strategy. Splunk provides the telemetry, observability and analytics required to support automated defence. Cisco's ambition is to combine signals from networking, security, applications and AI agents so threats get identified and addressed faster than any human team could manage.

The argument is concrete. Traditional security monitoring might establish that files were accessed, altered or deleted. It cannot tell you whether the deletion came from an external attack, a rogue AI agent, or a perfectly authorized instruction. "When you bring together security and observability you can actually see the intent," said Kevin Kennedy, Vice President of Cisco Security Strategy.

Schultz went further on where this is heading: "Splunk is really integral now to everything we are doing within the security story and within this platform for agentic trust. What we're finding is that the line between observing an agent and securing an agent is beginning to blur."

How did Cisco reorganize to sell simplicity?

Building a unified platform forced a significant reorganization inside Cisco itself. The company acknowledged that its own product portfolio had become part of the problem. Security leaders drowning in complexity faced a Cisco catalog that was hard to navigate and harder to integrate.

"Organisations spend more of their time trying to stitch things together and making them work than actually doing security," Kennedy said.

Cisco's response has three parts: improved product integration, a common management platform, and a fundamental change to its sales organization. The sales shift is the most telling. "Our portfolio was too complex, not integrated," Tuszik said. "Customers love what we're offering, but they were complaining about the effort they had to implement it. We decided to reduce the number of specialists and increase the number of front-end portfolio sellers because that's where we create our unique position."

In other words, Cisco is trading depth of specialist sellers for breadth of platform sellers — a bet that customers now buy outcomes and integration, not individual features.

What should organizations do right now?

Not every enterprise can afford to rebuild its security environment from scratch. Kennedy nominated two practical priorities for organizations that cannot: automated patching and retiring obsolete technology. He framed it as basic hygiene with outsized returns.

"Making sure you are conscientiously removing tech debt, and end of life software and systems are key," Kennedy said.

The urgency comes from both sides of the AI arms race. Threat actors are employing AI for vulnerability detection and for building attack tools, while defenders deploy their own AI to respond at machine speed. Kennedy sees the endpoint clearly: an environment where autonomous software agents attack and defend against each other.

"We're not there yet, but we are headed towards lots of agent on agent fighting," he said.

Cisco's wager, laid out in Melbourne, is that the winners of that fight will be the organizations with the least complexity — unified platforms where security observes everything, patches automatically, and trusts no agent by default.