Cisco's November 9 announcement describes a loop that tests an AI agent, measures it, and closes the exposure it finds. The three parts of that loop sit at different stages of readiness.

Cisco will let select enterprises aim Anthropic's Claude Mythos at their own AI agents to find weaknesses before attackers do. The capability sits inside Cisco AI Defense and is the first of three items in the company's November 9 security announcement. The second adds cost and quality measurement for agents through Splunk, and the third connects Cisco IQ exposure findings to the teams that fix them. This post follows that order and notes where each item stands today.

Mythos plans the attacks inside AI Defense, and customers cannot prompt it

Cisco launched AI Defense in January 2025 and says hundreds of customers have used it to find flaws in AI models, applications, and agents before production (Cisco, 2026). Red teaming means attacking your own system on purpose to find weaknesses before someone else does. Standard tests cover thousands of categories and techniques in minutes. Adaptive tests start from criteria the customer writes in plain language, then refine or change tactics based on the target's responses.

Mythos joins the adaptive engine at the planning step. Amy Chang, Head of AI Threat Intelligence and Security Research at Cisco, and Vikram Varakantam, Senior Director of Product Management, write that the model's reasoning produces attack ideas as the engine works to understand a target system and plan tests. Cisco says the deployment has no open interface a customer could use to prompt it and that its activity stays confined to the authorized target rather than the wider internet. The company lists four safeguards:

• Registered targets. The model works against systems the customer has registered and is authorized to test.
• Named operators. Each engagement requires authentication and ties to a named enterprise operator with cryptographic attribution.
• Revocable sessions. Each engagement runs time-bound sessions against objectives a human sets, and Cisco can halt them on demand.
• Dual-layer oversight. Controls inside AI Defense sit alongside program-level safeguards and monitoring, and AI Defense records each testing action for audit.

Michael Moore, Anthropic's Cybersecurity Lead, said in the release that enterprises are building AI agents into their core operations.

Cisco reached this point through its own code. In June, Anthony Grieco, SVP and Chief Security and Trust Officer, wrote that a harness called the Foundry Security Spec scanned 1.8 billion lines of code in more than 25 languages in eight weeks with a false positive rate under 3% (Cisco, 2026). The scan would have taken Cisco's security research team eight years, he wrote, and Cisco tested the harness across six frontier models and calls it model-agnostic. The November announcement moves from scanning Cisco's own code to testing customers' agents.

Customers cannot buy this capability yet. Cisco's blog says broader availability for qualified customers is planned on a when-and-if available basis and that dates, scope, and region availability remain subject to change. I found no pricing in the release or the blog.

Splunk gives each agent a bill and a grade

Testing an agent before launch leaves the cost of running it unanswered. In Splunk's State of Observability 2026 report, 55% of respondents said their organizations cannot control AI costs, and 60% said surprise billing spikes strain operations more than high baseline costs (Splunk, 2026).

Tokenomics, a feature of Splunk Agent Observability, pairs each agent's cost with evaluations of its quality and impact. It uses usage data from Amazon Bedrock and Amazon CloudWatch and combines it with business KPIs the customer defines, such as Net Promoter Score or cost per claim, to report return on investment. The Splunk blog names only AWS services as inputs, and I found no mention of other platforms, so a team that runs agents elsewhere should ask what Tokenomics reads for them.

The Eval-G1 models are custom small language models that run evaluations and guardrails. Cisco says they cost up to 98% less than a commercial large language model, respond 2.5 times faster, and reach up to 95% accuracy (Cisco, 2026). Those are Cisco's figures, and I found no independent test of them. Cisco also released an evaluation tuner, generally available this month alongside Eval-G1.

Kamal Hathi wrote the Splunk blog, and his argument for the lower cost is coverage: teams can evaluate and guardrail 100% of their traffic instead of a sample. I met Hathi at Cisco Live in Las Vegas in June, where Cisco showed a refund agent that paid a customer $1,200 after a $700 payment. I covered that demo in Cisco Live 2026: When AI Agents Go Wrong And How Cloud Control Catches Them.

Cisco IQ links exposure to the people who fix it, and the fixing is a services engagement

Vikas Butaney, SVP of CX Product Management and Marketing at Cisco, cites Verizon's 2026 Data Breach Investigations Report: the median time to resolve vulnerabilities has risen to 43 days (Verizon, 2026). Jerzy Kramarz, Principal Engineer at Cisco Talos, argued in June that it no longer matters whether a human researcher wrote an exploit over three weeks or an AI wrote it in three minutes. Liz Centoni, Cisco's Chief Customer Experience Officer, adds in the release that "AI is shrinking the time organizations have to respond to threats."

Cisco IQ serves close to 17,000 customers across more than 22 million connected devices (Cisco, 2026). Cisco is integrating its vulnerability intelligence into Cisco Data Fabric, which runs on the Splunk platform, and says detections built in Splunk Enterprise Security bring exposure context into security investigations. APIs and Model Context Protocol support arrived at Cisco's October Partner Summit, and Cisco IQ findings connect to asset-linked ServiceNow problem records. Butaney also notes that exposure is not proof of exploitation, which is the case for pairing the two data sets.

Remediation runs through Cisco Partners and Cisco Professional Services. In my read, the last step of the loop is a services engagement carried out by people.

Cisco calls it a loop, and its coverage ends where Cisco's data ends

Jeetu Patel, Cisco's President and Chief Product Officer, says "we are building a continuous trust loop." The present tense in that sentence overstates the state of the product. Evaluation is available, exposure intelligence has shipped in parts, Mythos testing is limited to select enterprises, and cost reporting is still a preview away.

Each stage also draws on data Cisco already holds. AI Defense tests targets a customer registers, Splunk reads the telemetry a customer already sends it, and Cisco IQ covers devices that report to Cisco. A buyer gets one vendor to question about every stage, and an agent outside those three sources sits outside the loop. The Mythos stage adds a second dependency, because the capability rests on terms between Cisco and Anthropic that Cisco says can change.

I met Amy Chang and Kamal Hathi at Cisco Live in Las Vegas in June, and I met Amin Karbasi at Black Hat. Chang wrote the red-teaming blog and Hathi wrote the Splunk blog, so I have followed the people behind two of these three pieces since the spring. Cisco is also one of the 37 members of the open AI security coalition NVIDIA assembled in July, which I covered in NVIDIA Pools Cisco, Microsoft, and 35 More Into an Open AI Security Stack.

Ship dates for each piece

• This month: the Eval-G1 models and the evaluation tuner become generally available in Splunk Agent Observability.
• December: Tokenomics enters private preview, with general availability in AWS Marketplace in early 2027.
• Coming soon: adaptive red teaming with Claude Mythos for select enterprises. Pricing, regions, and the first customers have not been announced.