Cisco said on 9 November at Cisco Live APJC in Melbourne that it is adding Anthropic’s Claude Mythos to AI Defense, a security platform it says has helped hundreds of customers test AI systems since its January 2025 launch. The planned integration will give select enterprises a way to use Mythos to develop attacks tailored to their AI applications and agents.
Key points
- Cisco says Claude Mythos will help its adaptive red teaming framework plan multi-step tests for individual enterprise AI systems.
- Cisco plans to offer the Mythos integration to select enterprises soon, with access limited to authorised testing through AI Defense.
- Splunk Agent Observability’s Tokenomics feature is due for private preview in December and general availability on AWS Marketplace in early 2027.
Claude Mythos joins AI Defense testing
Cisco says AI Defense helps customers find flaws in models, applications and agents before they enter production. Its adaptive red teaming framework builds customised attacks against a target system. Mythos will add reasoning to plan those tests and develop further attack ideas from the results, according to the company.
DJ Sampath, Cisco’s senior vice president and general manager of its AI Software and Platform group, described the move from generic to adaptive red teaming in an interview with CRN. Customers can set testing criteria in plain language, after which the framework plans and runs multi-step attacks against their applications, CRN reported.
Sampath put AI Defense’s customer count at approximately 400 to 500, CRN reported. He said partners could use the Mythos integration to test client environments deploying agents. That would extend Cisco’s existing testing product through a model supplied by Anthropic rather than a new Cisco model.
Michael Moore, Anthropic’s Cybersecurity Lead, said the integration would help security teams plan tests and generate attack ideas for the agents they intend to deploy. Cisco says the Mythos capability is coming soon for select enterprises.
Palo Alto Networks has launched an annual AI security testing subscription, AI Affairs previously reported. Cisco’s announcement places the planned Mythos integration within AI Defense, which already offers red teaming for applications and agents.
Cisco limits Mythos testing to authorised targets
Cisco says enterprise customers will interact with Mythos through AI Defense’s structured interface, without open-ended access to the model. Tests will run only against targets that a customer has registered and authorised. Each engagement requires authentication tied to a named operator.
The company says a human user will define each job and its objectives. Sessions will be time-bound and can be stopped on demand. Cisco says AI Defense keeps an audit trail of each testing action and uses results to inform subsequent attack rounds. Cisco also says its product controls will operate alongside programme-level monitoring.
In the CRN interview, Sampath said Cisco was running Mythos in a sandbox with controls over its access, execution and creation of sub-agents. He called the integration “a game changer” for partners using AI Defense to secure clients’ agent deployments.
Splunk Tokenomics tracks agent cost and quality
Cisco also announced changes to Splunk Agent Observability. Its Tokenomics feature will use data from Amazon Bedrock and Amazon CloudWatch to pair each agent’s spending with evaluations of its output quality and impact, the company says. Cisco describes it as an extension of existing token-spend attribution across AI agents and coding tools.
Two other Splunk tools — Eval-G1 evaluation models and the Evaluation Tuner — are generally available from November, Cisco says. The company claims the models can run evaluations at up to 98% lower cost than a commercial large language model, with response times 2.5 times faster than traditional large language models. The tuner uses agent traces and expert feedback to create evaluator models.
Cisco is also connecting vulnerability and infrastructure data from Cisco IQ to the Splunk Platform. Cisco says IQ serves close to 17,000 customers across more than 22 million devices. The planned data connection will let security teams relate threat detections to network exposure, while connectors for ServiceNow will turn exposure findings into asset-linked problem records, according to the company.
Cisco plans to put Tokenomics into private preview in December and make it generally available on AWS Marketplace in early 2027.
