Cisco adds Claude Mythos to AI Defense for advanced red teaming

Simulating Advanced AI Attacks

Cisco recently announced that it is integrating Anthropic's Claude Mythos into its AI Defense platform. This specific addition is designed to help security teams perform red teaming, which is the practice of simulating adversarial attacks to find weaknesses in a system. By using Claude Mythos, the platform can mimic the reasoning of sophisticated hackers who target AI agents.

The framework focuses on realistic adversarial ideation. Instead of simple, one-off prompts, it generates multi-step attack paths that consider the complex architecture of an enterprise's AI deployment. This allows defenders to uncover subtle vulnerabilities that might be missed by traditional security testing methods.

To ensure safety, Cisco has built several guardrails into this process. Customers can only test targets they have explicitly registered and authorized, and the system does not allow for open-ended prompt access. Every engagement is cryptographically tied to a named operator and can be halted by a human user at any time.

Monitoring Costs and Quality

Beyond security, Cisco is introducing tools to help companies manage the economics of their AI usage. A new feature called Tokenomics will soon be available in the AWS Marketplace to help organizations track their spending. It connects the cost of every AI token used to the actual quality and business impact of the resulting output.

This system uses data from Amazon Bedrock and Amazon CloudWatch to provide a single view of return on investment. It helps teams understand which agents are delivering value and which are simply consuming resources. This is particularly useful as companies begin to deploy agents across various coding tools and internal workflows.

Additionally, Cisco is launching Eval-G1 evaluation models. These are small language models designed to execute guardrails and quality checks at a much lower price point than commercial models. They are intended to be 2.5x faster than traditional large language models while maintaining high accuracy for real-time agent control.

Accelerating Threat Remediation

Cisco is also updating its Cisco IQ service to help security and network operations teams react faster to threats. The system now correlates live threat detection data with information about potentially exposed network infrastructure. This allows teams to see exactly where a vulnerability lies within their millions of devices at machine speed.

The company is integrating this data into the Splunk Platform via open APIs. This means that security teams can see the underlying network exposure directly within their existing security environments. It helps bridge the gap between knowing a threat exists and knowing how to fix it across a large, complex estate.

New connectors for the Model Context Protocol and ServiceNow will also automate parts of this process. These tools can automatically translate infrastructure findings into service records. This coordination happens without the need for manual data reconciliation, allowing for faster updates to IT systems.

The Future of AI Trust

These updates are part of a broader effort to create a continuous trust loop for the enterprise. Cisco aims to provide a way to secure, observe, and govern AI agents simultaneously. As AI models become more capable of performing complex tasks, the window of time between a vulnerability being discovered and its exploitation is shrinking.

The company is positioning these tools to help organizations move from point-in-time audits to real-time protection. By combining red teaming with cost governance and infrastructure visibility, they want to give companies the confidence to scale their AI use. This approach addresses the need for both security and measurable business value.

While some features like Tokenomics are still in private preview, others are becoming generally available this month. Cisco plans to make the cost governance tools widely available in the AWS Marketplace by early 2027. The goal is to provide a unified framework for the next era of agentic AI deployments.

Infrastructure and Partnerships

Cisco is also emphasizing the role of its partners and professional services in these deployments. While the software provides the insights, partners help deliver the actual remediation at scale. They work with customers to modernize their infrastructure to meet the demands of the AI era.

The Cisco Data Fabric, powered by the Splunk Platform, serves as the backbone for these integrations. It allows for the ingestion of vulnerability and configuration data from Cisco IQ into a centralized environment. This ensures that security analysts have the necessary context in the middle of an investigation to decide on the next steps.

The company is also highlighting its commitment to quantum-safe cryptographic readiness. As part of its resilient infrastructure playbook, it surfaces critical lifecycle vulnerabilities and personalized alerts for known defects. This helps organizations prioritize their modernization roadmaps as they transition to more AI-accelerated environments.