Cisco Adds AI Agent Security Testing And Cost Monitoring Tools To Splunk

Cisco has announced new tools designed to help organisations assess the security and operating costs of artificial intelligence agents as businesses move more AI applications into production.

The announcements, made on 10 November, cover additions to Cisco AI Defense and Splunk Agent Observability. They target two growing concerns for technology leaders: protecting AI agents against attacks and measuring whether their operating costs are justified by the value they deliver.

On the security front, Cisco AI Defense is adding adaptive red-teaming capabilities powered by Anthropic’s Claude Mythos. The tool is designed to simulate multi-step attacks against AI applications and agents, allowing organisations to identify vulnerabilities before attackers exploit them.

The capability is expected to become available soon to select enterprises. Cisco says testing will be restricted to targets registered and authorised by customers, with each engagement linked to a named operator.

Cisco argues that AI is accelerating the time between vulnerability disclosure and exploitation, potentially reducing the window organisations have to respond from weeks to hours. This makes continuous security testing increasingly important as AI applications become more widely deployed.

Meanwhile, Cisco is expanding Splunk Agent Observability with tools for evaluating agent performance and costs. Two features, Eval-G1 and Evaluation Tuner, are now generally available.

Eval-G1 uses smaller models to run evaluations and apply guardrails. Cisco claims the models can cost up to 98% less and respond 2.5 times faster than commercial large language models. Evaluation Tuner allows organisations to customise evaluator models using their own agent activity records and expert feedback.

Another feature, called tokenomics, will connect an AI agent’s operating costs with quality assessments. It will use usage data from Amazon Bedrock and Amazon CloudWatch. The feature is scheduled to enter private preview in December, with general availability through AWS Marketplace expected in early 2027.

Cisco is also integrating vulnerability, lifecycle and configuration information from Cisco IQ into Splunk, alongside integrations with the Model Context Protocol (MCP) and ServiceNow. The company has not provided availability dates for these additions.

The announcements reflect the growing need for organisations to monitor AI agents beyond their initial deployment. As businesses adopt autonomous systems, technology teams will need to assess not only whether agents operate securely, but also whether their performance justifies the resources they consume.