Key Points
- Cisco integrates Anthropic's Claude Mythos into AI Defense for automated security testing
- Tokenomics feature links AI agent spending to business outcomes, available December preview
- Cisco IQ now correlates vulnerability data across 22 million devices with live threat detection
Cisco has integrated Anthropic‘s Claude Mythos, an advanced reasoning model, into its AI Defense platform to help enterprises test the security of their artificial intelligence systems before deployment, the networking equipment maker announced on Monday.
The integration allows security teams to simulate attacks on AI agents, which are software systems that can take actions autonomously. Red teaming refers to the practice of deliberately attacking one’s own systems to find vulnerabilities before malicious actors do. Claude Mythos will generate multi-step attack scenarios tailored to each enterprise’s specific AI deployments, according to the company.
“You cannot scale what you cannot secure, govern, or observe,” said Jeetu Patel, president and chief product officer, Cisco. “By uniting frontier-level AI runtime protections with machine-speed agent quality controls, we are building a continuous trust loop: protecting agents from compromise while ensuring every token spent delivers measurable business value.”
The announcement comes as enterprises increasingly deploy AI agents that connect to sensitive data and business-critical systems. A global research report from Splunk, which Cisco acquired in 2024, found that 81 per cent of IT operations and engineering professionals cited increased cooperation between security and observability teams, the company said.
Agent observability
Alongside the security testing capabilities, Cisco announced new features in its Splunk platform to help organisations track the cost and effectiveness of AI agents. The company is calling this capability Tokenomics, a reference to the way AI models charge based on tokens, which are units of text processed by the system.
Tokenomics pairs each AI agent‘s cost with evaluations that grade the quality and impact of its work, giving organisations a single view of return on investment, according to Cisco. The feature will be available in private preview in December, with general availability expected in early 2027 through AWS Marketplace.
The company also introduced what it calls Eval-G1 evaluation models, which it says can execute quality checks on AI agent outputs at up to 98 per cent lower cost than commercial large language models while delivering response times 2.5 times faster. These evaluation models are generally available starting this month.
“Enterprises are increasingly building AI agents into their core operations and want to test those agents thoroughly before putting them into production,” said Michael Moore, cybersecurity lead, Anthropic. “By bringing Claude Mythos to Cisco AI Defense, Cisco can help security teams red team their agents with advanced reasoning that plans tests and generates attack ideas for each system.”
Security safeguards
Cisco said it has engineered multiple safeguards into the Claude Mythos integration. The system operates only against targets explicitly registered and authorised for testing by the enterprise customer, meaning it cannot scan arbitrary internet infrastructure. Every red teaming engagement requires authentication and is tied to a named enterprise operator, and sessions are time-bounded with the ability to halt on demand.
AI Defense, which Cisco launched in January 2025, has helped hundreds of customers identify critical flaws in AI models, applications and agents before they reach production, the company said. The adaptive red teaming framework allows security teams to build customised, multi-step attacks on target systems to uncover specific risks.
The Claude Mythos integration is coming soon for select enterprises, though Cisco did not specify an exact date.
Cisco also announced updates to Cisco IQ, its infrastructure intelligence platform that spans close to 17,000 customers across more than 22 million devices. The platform will now integrate directly with the Splunk security platform, allowing security operations teams to correlate live threat detections with underlying network vulnerabilities.
By the numbers
Key figures from this story- 22 million devices
- Cisco IQ coverage for vulnerability correlation
- 98%
- Cost reduction claimed for Eval-G1 vs commercial LLMs
- 81%
- IT professionals citing security-observability team cooperation
“AI is shrinking the time organisations have to respond to threats, and knowing where you’re exposed only matters if you can act on it,” said Liz Centoni, executive vice president and chief customer experience officer at Cisco. “Bringing Cisco IQ vulnerability insights into Cisco Data Fabric powered by the Splunk Platform gives analysts that context in the middle of an investigation, so they can decide what to do next.”
The integration includes connectors for ServiceNow, the IT service management platform, allowing vulnerability findings to be automatically translated into problem records for remediation without manual data reconciliation. Cisco also announced support for Model Context Protocol, which provides structured infrastructure context to AI agents.
The announcements were made at Cisco Live APJC in Melbourne.
Your Questions, Answered
What is red teaming in AI security?
Red teaming is the practice of deliberately attacking one's own AI systems to find security vulnerabilities before malicious actors can exploit them. Cisco's AI Defense platform automates this process using Anthropic's Claude Mythos to generate realistic attack scenarios.
What is Tokenomics in Cisco's AI observability tools?
Tokenomics is Cisco's feature that tracks how much enterprises spend on AI agent operations and links that spending to business outcomes. It measures cost per token processed alongside quality evaluations of the AI agent's work.
When will Cisco's Claude Mythos integration be available?
The Claude Mythos integration for AI Defense is coming soon for select enterprises, though Cisco has not announced a specific date. The Tokenomics feature enters private preview in December with general availability expected in early 2027.
How does Cisco IQ integrate with Splunk for security?
Cisco IQ now feeds vulnerability, lifecycle and configuration data from 22 million devices directly into the Splunk platform. This allows security teams to correlate live threat detections with underlying network vulnerabilities during investigations.
