MELBOURNE, Australia – November 10, 2026 -- Cisco is adding Anthropic's Claude Mythos to its AI Defense red teaming framework, giving security teams frontier-level adversarial reasoning to stress-test AI applications and agents, while Splunk and Cisco IQ updates tie agent cost and infrastructure exposure to remediation workflows.
Adaptive red teaming with Claude Mythos is coming soon for select enterprises. Cisco launched AI Defense in January 2025 and says it has since helped hundreds of customers find critical flaws in AI models, applications and agents before production.
Claude Mythos plans multi-step attacks under customer-side controls
The model augments AI Defense's adaptive red teaming by planning tests and translating results into attack ideas for each target system. Cisco lists three features: multi-step, contextual attack path generation; access only through AI Defense's structured interface, with no open-ended prompt access; and audit records of each testing action, with results carried into follow-up attack loops.
Cisco built four safeguards around the model. It runs only against targets the customer has registered, owns and authorized, and cannot scan arbitrary internet infrastructure. Each engagement is cryptographically tied to a named enterprise operator. Sessions are time-bound, run against fixed objectives set by the human user, and can be halted on demand. Product-level controls operate alongside program-level safeguards and monitoring.
Michael Moore, Cybersecurity Lead at Anthropic, said enterprises want to test agents thoroughly before production.
Splunk Tokenomics links agent spend to output quality, with private preview in December
Tokenomics pairs each agent's cost with evaluations grading the quality and impact of its work, using usage data from Amazon Bedrock and Amazon CloudWatch. It will enter private preview in December, with general availability in AWS Marketplace in early 2027. It extends token-spend attribution launched at .conf26, which tracks costs across agents and coding tools including Claude Code, Codex and Cursor.
Splunk Agent Observability also gains Eval-G1 evaluation models, small language models built from agentic traces and expert feedback. Cisco says they run evals and guardrails at up to 98% lower cost than a commercial LLM, with response times 2.5x faster than traditional LLMs. The models and the Evaluation Tuner, which turns traces and subject matter expert feedback into fine-tuned evaluators, are generally available this month.
A Splunk global research report published last month found that 81% of ITOps and engineering professionals cite increased cooperation between security and observability teams.
Cisco IQ feeds data on 22 million devices into Splunk Enterprise Security
Cisco IQ serves close to 17,000 customers across more than 22 million devices. Through Cisco Data Fabric integration, its vulnerability, lifecycle and configuration data flows into the Splunk Platform via open APIs. SecOps teams and AI agents can then correlate live threat detections with network exposure in Splunk Enterprise Security.
Model Context Protocol and ServiceNow connectors supply infrastructure context to supported AI agents and IT service management platforms. They convert exposure findings into asset-linked ServiceNow problem records without manual data reconciliation. An AI-Powered Resilient Infrastructure Playbook surfaces lifecycle vulnerabilities, personalized alerts for known defects and quantum-safe cryptographic readiness, so teams and certified partners can prioritize modernization roadmaps.
Cisco says AI-accelerated threats have compressed the window between vulnerability disclosure and exploitation from weeks to hours, leaving point-in-time audits inadequate. Liz Centoni, Cisco EVP and Chief Customer Experience Officer, said the aim is to move customers from identifying risk to reducing it, working with partners and Professional Services teams.