Cisco adds Claude Mythos red teaming and agent observability to AI Defense

Cisco has announced a series of updates to its AI Defense platform, adding frontier-model red teaming powered by Anthropic's Claude Mythos, new Splunk Agent Observability capabilities, and expanded Cisco IQ integrations.

The additions are aimed at channel partners and enterprise customers grappling with the security and cost-governance challenges of deploying AI agents connected to complex tooling and sensitive data.

According to a global Splunk research report cited by Cisco, 81% of ITOps and engineering professionals report increased cooperation between security and observability teams as agent deployments grow.

Since its launch in January 2025, Cisco said AI Defense has helped hundreds of customers identify critical flaws in AI models, applications and agents before they reach production.

The platform's adaptive red teaming capability will now be augmented by Claude Mythos, which Cisco described as adding advanced adversarial reasoning to plan tests and translate findings into targeted attack ideas for each system.

Safeguards built into the Claude Mythos integration include operation exclusively against targets registered and authorised by the enterprise customer, cryptographic attribution to a named operator for every engagement, time-bounded sessions that can be halted on demand, and dual-layer oversight combining product-level controls with programme-level monitoring.

On the observability side, Cisco is extending Splunk Agent Observability with three additions.

A Tokenomics feature - coming to AWS Marketplace in private preview in December, with general availability in early 2027 - ties AI spend to output quality using data from Amazon Bedrock and Amazon CloudWatch.

New Eval-G1 evaluation models are designed to run evaluations and guardrails at up to 98% lower cost than a commercial large language model, with response times the company said are 2.5 times faster than traditional LLMs. An Evaluation Tuner, generally available this month, lets teams fine-tune evaluator models from agentic traces and subject-matter expert feedback.

Cisco is also extending Cisco IQ - which the company said covers more than 16,000 customers across close to 20 million devices - into enterprise security environments via new integrations.

These include a Cisco Data Fabric connector that ingests vulnerability, lifecycle and configuration data into the Splunk Platform; Model Context Protocol and ServiceNow connectors that translate exposure findings into asset-linked problem records; and an AI-powered resilient infrastructure playbook covering lifecycle vulnerabilities and quantum-safe cryptographic readiness.

"You cannot scale what you cannot secure, govern, or observe," said Jeetu Patel, president and chief product officer at Cisco.

"By uniting frontier-level AI runtime protections with machine-speed agent quality controls, we are building a continuous trust loop: protecting agents from compromise while ensuring every token spent delivers measurable business value."

"AI is shrinking the time organisations have to respond to threats, and knowing where you're exposed only matters if you can act on it," said Liz Centoni, executive vice president and chief customer experience officer at Cisco.

“Bringing Cisco IQ vulnerability insights into Cisco Data Fabric powered by the Splunk Platform gives analysts that context in the middle of an investigation, so they can decide what to do next."

Adaptive red teaming with Claude Mythos is coming soon for select enterprises. The Eval-G1 evaluation models and Evaluation Tuner are generally available now.