Cisco integrates Claude Mythos to stress-test enterprise AI agents

Testing AI with 'Red Teaming'

Cisco is introducing Claude Mythos to its AI Defense platform to help organizations conduct red teaming. Red teaming is a security practice where defenders simulate attacks to find weaknesses in a system before hackers do. By using Claude Mythos, companies can test their AI agents against sophisticated reasoning that mimics real-world adversaries.

The tool is designed to create realistic, multi-step attack paths that target complex architectures. This helps security teams identify subtle vulnerabilities that might be missed by simpler tests. Because these agents are increasingly connected to sensitive data and internal tools, these tests are becoming a necessity for enterprise trust.

To ensure safety, Cisco built several safeguards into the AI Defense interface. Customers cannot use open-ended prompts and can only test targets they have explicitly registered and authorized. Every test session is cryptographically tied to a specific person and can be halted at any time by a human operator.

Measuring ROI and Token Spend

Beyond security, Cisco is launching features to help businesses manage the costs of running AI. A new feature called Tokenomics will help organizations track how much they spend on AI tokens compared to the actual quality of the work produced. This is intended to give leaders a clear view of the return on investment for their AI portfolios.

The system will use data from Amazon Bedrock and Amazon CloudWatch to pair costs with performance grades. This allows companies to see which agents are delivering value and which are underperforming. It builds on previous tools that already tracked costs for coding assistants and other AI-powered software.

Cisco is also introducing Eval-G1 models to handle these quality checks. These small language models are designed to execute guardrails and evaluations at a much lower cost than standard commercial models. They are reported to be 2.5x faster than traditional models while maintaining high accuracy for real-time control.

Closing the Security Loop

Cisco is also connecting infrastructure data with security actions to speed up incident response. The company is extending real-time intelligence from Cisco IQ, which monitors over 22 million devices, into the Splunk Platform. This allows security teams to see live threat detections alongside the underlying network vulnerabilities.

New connectors for the Model Context Protocol and ServiceNow will help automate this process. These tools can automatically translate a discovered vulnerability into a problem record in an enterprise's management system. This removes the need for manual data reconciliation between different security and IT teams.

This integration is meant to address the shrinking window between a vulnerability being discovered and it being exploited. As AI-accelerated threats move faster, Cisco aims to provide analysts with the context they need to make quick decisions. The goal is to move organizations from simply identifying risks to actively reducing them.

Timeline and Availability

The new capabilities are rolling out at different speeds depending on the specific feature. The evaluation models and the evaluation tuner are available starting this month for general use. These tools allow teams to turn expert feedback into fine-tuned models that enforce quality standards.

The Tokenomics feature will enter a private preview in December. It is expected to reach general availability in the AWS Marketplace in early 2027. This long lead time suggests a focus on refining the cost-attribution logic for complex enterprise environments.

Adaptive red teaming with Claude Mythos is currently coming soon for select enterprise customers. This phased rollout allows Cisco to provide high-level reasoning capabilities to those who need to stress-test the most capable AI agents first. These tools collectively aim to create a continuous trust loop for the agentic enterprise.