Cisco Security Strategy for Agentic AI

What Just Changed in AI Agents

The latest shift in the enterprise landscape isn't just about the raw capability of models like Claude 5 or GPT-5.6 Sol. The real transformation is the transition from passive chatbot interfaces to autonomous agents that perform tasks across production systems. Cisco's recent move to introduce Duo Agentic Identity signals a massive turning point: we have moved past the era where we could treat AI as a simple API call. We are now living in a world where autonomous entities, built on frameworks like LangGraph, CrewAI, and AutoGen, are operating inside our networks with the ability to query databases, trigger workflows, and make decisions without human oversight.

This isn't theoretical. Developers are deploying agents via Claude Cowork or Cursor Agent to automate code refactoring and deployment pipelines. The problem, as Cisco VP of Product for Identity Matt Caulfield highlights, is that these agents are essentially operating in a state of 'shadow IT' where they lack proper identity, ownership, or granular access controls. Traditional service accounts and static API keys simply cannot handle the dynamic, per-action verification required by an agent that might decide to reconfigure a cloud bucket or rotate a production credential at 3 AM.

How This Agent Actually Works - Architecture Explained

To understand the security crisis, you first need to look at the architecture of a modern autonomous agent. Unlike a standard script, these agents function through a continuous loop of observation, thought, and action. They rely on an orchestration layer, often powered by Semantic Kernel or Mastra, which manages the agent's interaction with external tools.

The architecture typically follows this pattern:

• Perception: The agent receives an input or a system event.
• Planning: Using a model like GPT-5.6 Sol Ultra, the agent decomposes a complex goal into a directed acyclic graph (DAG) of sub-tasks.
• Memory: Through RAG systems like Mem0 or Zep, the agent recalls past interactions to inform current decision-making.
• Execution: The agent invokes external tools via MCP (Model Context Protocol), which allows it to interface with disparate data sources securely.

Identity management for agents is not a static property; it is a per-action negotiation between the agent's intent and the infrastructure's security policy. - Cisco Engineering Lead

In a standard setup, an agent running on OpenClaw or Hermes Agent might inherit the credentials of the developer's local shell. This is a massive vulnerability. Cisco's approach changes this by introducing a layer of Zero Trust that sits between the agent and the resource, enforcing identity verification at the network level rather than just the session level.

Key Capabilities & Features

The move toward agentic governance includes several critical features designed to bring these autonomous actors into the light:

• Continuous Discovery: Rather than periodic scans, the system monitors network traffic to identify shadow agents in real-time.
• Agent-to-Agent (A2A) Protocols: Standardized communication channels that track how one agent delegates tasks to another.
• Build-Time Policy Enforcement: Embedding security constraints directly into the framework configuration so that agents are 'secure by design.'
• Lifecycle Management: Assigning a human owner to every agent, ensuring there is a point of accountability if a workflow triggers a breach.
• Granular Access Control: Moving beyond broad scopes to specific, per-action permissions.
• Automated Attribution: Linking every database query or system call back to the specific agent instance that initiated it.
• Resilience Monitoring: Protecting the agent's underlying infrastructure through tools like Cohesity's agent resilience features.
• Policy-as-Code: Allowing security teams to define 'guardrails' that the agent must respect during its planning phase.
• Telemetry Export: Integrating agent activity logs directly into SIEM tools for better observability.
• Credential Rotation: Automatically rotating keys for agents that only have a limited, task-specific lifecycle.

Real-World Use Cases & Benchmarks

The urgency here is driven by performance gains. Researchers at Salesforce recently demonstrated an agent capable of finishing 93% of browser tasks, up from 43.5%, by refining the underlying orchestration. When you scale this kind of performance, the risk grows exponentially.

Consider a developer using Devin or Goose to manage a migration. Without governance, the agent might inadvertently expose an internal API endpoint while trying to 'fix' a connectivity issue. With Cisco's approach, the agent's identity is verified via Duo Agentic Identity before it can touch the production network. If the agent attempts an action outside of its predefined scope, the request is blocked, and an alert is sent to the human owner.

How to Get Started - Practical Guide

If you are deploying autonomous agents, you need to stop treating them like static scripts immediately. Here is the path to securing your environment:

• Inventory your agents: Use network monitoring tools to identify all instances of LangGraph, CrewAI, or AutoGen running in your cloud VPCs.
• Map ownership: Assign a human developer to every agent. If you cannot find an owner, kill the process.
• Implement MCP: Transition your tool-use integrations to the Model Context Protocol to standardize how agents interface with data.
• Apply Least Privilege: Audit the credentials your agents are using. If an agent only needs to read a database, provide a scoped token, not a master key.
• Establish a Governance Stack: Use tools that integrate policy enforcement at the framework level, such as Cisco's new build-time policy tools.
• Monitor the 'Think' process: Log not just the output of your agents, but the reasoning process. This is where you identify potentially harmful intent before it executes.
• Automate recovery: Ensure your agent infrastructure is backed up and resilient against accidental deletion or state corruption.

Limitations & What's Not Working Yet

We are still in the early innings. Many of the current security solutions for agents suffer from high latency. Forcing an agent to perform a handshake for every single action can degrade performance in high-frequency tasks. Furthermore, there is no universal 'Identity Protocol' for agents yet. While A2A (Agent-to-Agent communication) is emerging, we are still seeing fragmentation across different frameworks.

The biggest risk isn't that the agent will go rogue; it's that the agent will be too efficient at doing the wrong thing. - Senior Security Architect

Another major hurdle is the 'context window' problem. When agents run for extended periods, they tend to accumulate 'context fatigue,' where they may lose track of the security policies initially assigned to them. Keeping these policies in the agent's short-term memory is a technical challenge that requires constant, real-time synchronization with the central identity provider.

What's Next: Where Agent Tech Is Heading

We are moving toward a future where Autonomous Governance is the norm. The next iteration of agent security will likely involve agents that are trained specifically to audit other agents. We are already seeing research into on-premise medical AI agents that require strict, localized decision-making, which will eventually force the industry to adopt more robust, hardware-backed identity solutions for AI.

As we head into 2026, expect the integration between Cisco Identity Intelligence and platforms like Cursor Agent to become the standard. The days of letting an agent run with a broad set of permissions are ending. If you want to harness the productivity gains of Claude Cowork or Hermes Agent, your security architecture must evolve to treat those agents as distinct, verifiable, and accountable entities. The competitive window is narrow, but the risk of ignoring governance is simply too high to justify the speed.