What happened
Cisco is integrating Anthropic’s Claude Mythos model into its Cisco AI Defense platform to perform automated, multi-step security testing on enterprise AI agents. The company also introduced 'Tokenomics' for Splunk Agent Observability to track AI agent costs and performance, alongside a new small language model, Eval-G1, designed for cost-effective agent evaluation and guardrail enforcement.
At the Cisco Live APJC event in Melbourne, Cisco announced the integration of Anthropic’s Claude Mythos model into its Cisco AI Defense platform. The primary function of this integration is to conduct advanced, multi-step security testing that simulates real-world attacks on AI applications and agents to identify potential vulnerabilities.
Cisco emphasized that these security tests are strictly controlled. They are limited to systems owned and approved by the client, require administrator authentication, and maintain a full audit trail. The company explicitly stated that scans of arbitrary internet infrastructure are restricted, and tests can be manually halted by administrators.
In addition to security, Cisco introduced 'Tokenomics' within its Splunk Agent Observability suite. This tool analyzes token consumption alongside work quality metrics using data from Amazon Bedrock and CloudWatch. It is designed to help enterprises track the operational costs and ROI of AI agents and coding tools, including Claude Code, Codex, and Cursor.
The company also unveiled Eval-G1, a small language model (SLM) trained on agent run logs and expert feedback. Cisco claims Eval-G1 can assess agent performance and apply guardrails at 98% lower cost and 2.5 times the speed of standard large language models. An 'Evaluation Tuner' will be provided to allow companies to customize the model to their specific quality standards.
Finally, Cisco is expanding the integration between Cisco IQ and the Splunk platform. By utilizing the Model Context Protocol (MCP) and a ServiceNow connector, the system will pipe vulnerability and configuration data into Splunk, linking security threats to specific IT asset and incident records to automate response workflows.
Source details: biz.chosun.com
Why it matters
As enterprises increasingly deploy autonomous AI agents that interact with sensitive internal systems, the risk of AI-enabled cyberattacks and uncontrolled operational costs has grown significantly. Cisco’s move to provide specialized red-teaming and observability tools addresses the critical need for governance in AI-driven workflows. By utilizing Claude Mythos for simulated attacks and Eval-G1 for performance monitoring, organizations can identify vulnerabilities and manage the ROI of their AI investments. This framework aims to provide the necessary security and oversight to scale AI deployments safely within complex corporate network environments.
The proliferation of AI agents within corporate environments has created a new attack surface that traditional security tools are often ill-equipped to handle. By leveraging Claude Mythos for red-teaming, Cisco provides a mechanism to proactively test how agents might be manipulated or exploited before they are fully deployed in production.
Operational visibility remains a major hurdle for AI adoption. Many enterprises struggle to quantify the cost-benefit ratio of their AI agents. The Tokenomics feature addresses this by providing a granular view of token spending, which is essential for financial governance as AI usage scales.
The introduction of Eval-G1 represents a shift toward specialized, smaller models for governance tasks. By offloading evaluation and guardrail enforcement to a faster, cheaper SLM, Cisco enables continuous monitoring without the latency or high costs associated with querying larger, more complex models for every transaction.
Cisco’s focus on a 'continuous trust framework' reflects a broader industry trend where security is no longer a perimeter-based concern but an integrated component of the AI lifecycle. Linking these security insights directly to IT asset management via ServiceNow and Splunk allows for faster remediation of vulnerabilities, which is critical when dealing with the speed of AI-driven operations.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').An agent must create a draft calendar event for Tuesday at 2 p.m. Which evidence would establish the requested result?
What to watch next
Cisco has outlined a staggered rollout for these new capabilities. Red-team testing using Claude Mythos is scheduled to reach select enterprise customers soon. The Tokenomics feature for Splunk is slated for a private preview in December 2026, with a broader launch on the AWS Marketplace expected in early 2027. Meanwhile, the Eval-G1 model and its associated Evaluation Tuner are scheduled for general availability starting in November 2026. Monitoring the adoption rates of these tools among Cisco’s existing 16,000 customer organizations will be key to assessing their impact on enterprise AI security standards.
The rollout schedule is a critical factor for enterprise planning. While Eval-G1 is expected to be generally available in November 2026, the Tokenomics feature will not reach the AWS Marketplace until early 2027. Organizations should monitor these dates to align their internal roadmaps with Cisco’s release cycle.
The effectiveness of Claude Mythos in identifying novel AI-specific vulnerabilities remains to be seen in real-world enterprise environments. As these tools reach select customers, the industry will be watching for reports on the accuracy of these simulated attacks and the ease of integrating them into existing CI/CD pipelines.
Cisco’s reliance on the Model Context Protocol (MCP) for its integrations suggests a commitment to interoperability. Future updates regarding the expansion of this protocol to other third-party platforms will be important for organizations that use a heterogeneous mix of AI tools and security vendors.
Pricing for these new features has not been explicitly detailed beyond the general availability timelines. Potential users should watch for forthcoming documentation regarding licensing requirements for the Splunk integrations and the usage costs associated with the Eval-G1 model.