Cisco announced on November 10, 2026, during Cisco Live APJC in Melbourne, that its AI Defense platform will add an adaptive red teaming service based on Claude Mythos, Anthropic’s frontier model, to run controlled attacks against companies’ AI agents before a real adversary does. The announcement comes alongside new Splunk features for tracking the cost and quality of those agents in production, though much of the package is not yet generally available.
Cisco AI Defense and Splunk in 20 seconds
- AI Defense will add adaptive red teaming with Anthropic’s Claude Mythos.
- It will reach select companies first, with no firm date.
- Splunk Tokenomics enters private preview in December.
- Eval-G1 models are already available as of November.
- Cisco has not published pricing.
The pitch starts from a simple idea: an agent that can read emails, query databases or trigger actions in internal systems expands an organization’s attack surface. Traditional security testing, with fixed lists of known attacks, falls short against a system that changes behavior based on context. Cisco argues that a model capable of reasoning like an attacker can find flaws that those static test suites miss, though for now that’s the company’s own claim rather than an independently measured result.
A frontier-model attacker, for select customers only
AI Defense’s adaptive red teaming will use Claude Mythos to generate attacks that adjust to the evaluated agent’s responses, rather than repeating a fixed script. Cisco describes it as a service that will reach a select group of companies soon. It doesn’t specify how many, by what criteria they’ll be chosen, or when it will open to the rest of its customers.
The nuance matters because Claude Mythos is not a generally available model. Anthropic keeps it within a small circle of organizations under its Project Glasswing initiative, aimed precisely at defensive cybersecurity uses. The alliance lets Cisco offer that capability packaged within its own platform, but the announcement doesn’t explain how customer data sent to the model during testing will be handled, or on what infrastructure it will run.
Michael Moore of Anthropic takes part in the announcement with supportive statements about the collaboration, as do Jeetu Patel, Cisco’s president and chief product officer, and Liz Centoni, the company’s chief customer officer. None provides figures on the system’s effectiveness compared with other testing methods.
Splunk wants to price and grade every agent
The second leg of the announcement is Splunk Agent Observability, the Cisco subsidiary’s toolset for monitoring AI agents in production. The most eye-catching addition is Tokenomics, a feature designed to attribute token consumption, and therefore cost, to each agent, workflow or team. It enters private preview in December, and Cisco expects general availability through AWS Marketplace in early 2027.
What is available as of November are the Eval-G1 models and the Evaluation Tuner tool, used to automatically score the quality of agent responses. According to Cisco, Eval-G1 cuts evaluation costs by up to 98% and is 2.5 times faster. The company doesn’t detail what alternative those figures are measured against or under what test conditions, so they should be read as what they are: vendor-supplied figures.
Cost control is a real concern for those already running agents in production. An agent that chains calls to a model can multiply consumption without anyone noticing until the bill arrives, which is why several observability vendors are adding per-token cost metrics to their dashboards.
Cisco IQ and connectors for the rest of the network
Cisco has also expanded Cisco IQ, its support and operations assistant, with Data Fabric and connectors based on the Model Context Protocol (MCP), the open standard that lets agents connect to external tools, plus an integration with ServiceNow. According to the company, Cisco IQ serves about 17,000 customers and covers roughly 22 million devices.
The package fits the strategy Cisco has been repeating since it acquired Splunk: bringing network, security and observability together under one offering for the moment when companies move from testing agents to deploying them at scale.
What’s missing from the announcement is almost everything a buyer needs: pricing, licensing terms, deployment requirements and firm dates for the red teaming piece. Until those arrive, the announcement mostly describes a product direction, with one piece already available (Eval-G1) and the rest at various preview stages.
Frequently Asked Questions
What is Cisco AI Defense’s adaptive red teaming?
It’s a service that uses Anthropic’s Claude Mythos to launch controlled attacks against AI agents and adjust each attempt based on the evaluated system’s responses.
When will it be available?
Cisco says it will reach a select group of companies soon. It has not given a general availability date.
What is Splunk Tokenomics?
It’s a Splunk Agent Observability feature that attributes token consumption and its cost to each agent. It will be in private preview in December, with general availability on AWS Marketplace expected in early 2027.
How much do these tools cost?
Cisco has not published pricing for any of the features announced at Cisco Live APJC.
Sources:
This article is also available in Spanish: «Cisco probará agentes de IA con Claude Mythos y amplía Splunk», on revistacloud.com.
