Cisco announced at its Cisco Live APJC conference in Melbourne on Monday that it is adding Anthropic's Claude Mythos to its AI Defense platform, putting one of the industry's most restricted AI models to work stress-testing the AI agents enterprises are rushing into production. The move pairs Mythos's frontier adversarial reasoning with Cisco's adaptive red-teaming framework, alongside new Splunk observability features that track what those agents cost and whether they are worth it.
The announcement lands a day after Anthropic launched Mythos 5.2, a model available only to vetted organisations through its verification programmes. Cisco is the first major security vendor to productise it — and the pairing is deliberate: Mythos was built to reason like an attacker, and Cisco wants it probing the agents that now touch sensitive tools and data inside large companies.
A restricted model, kept on a short leash
Mythos will not roam free inside Cisco's platform. Instead, it will plan tests and turn the results into attack ideas, while AI Defense runs the engagement against targets the customer has explicitly registered and authorised. Cisco says the model cannot scan arbitrary internet infrastructure, and the Mythos-powered red teaming will roll out to select enterprises first, with broader availability for qualified customers to follow — no committed date yet.
"Enterprises are increasingly building AI agents into their core operations and want to test those agents thoroughly before putting them into production," said Michael Moore, cybersecurity lead at Anthropic. Cisco launched AI Defense in January 2025, and says it has since helped hundreds of customers find critical flaws in models, applications and agents before they shipped.
Splunk now prices every agent's work
The same announcement extends Cisco's Splunk Agent Observability tools to the cost side of the agent boom. A new Tokenomics feature ties each agent's spending to the quality and impact of its output, using Amazon Bedrock and CloudWatch usage data. It enters private preview in December, with general availability in the AWS Marketplace in early 2027.
Also generally available starting this month are Eval-G1, a set of custom small language models that run evaluations and guardrails at up to 98 percent lower cost than a commercial large language model, and an evaluation tuner that turns agentic traces and expert feedback into those models. Cisco IQ, meanwhile, now correlates live threat-detection data with potentially exposed network infrastructure at machine speed to speed up remediation.
Why the timing matters
Agents are no longer demos: they book travel, move money, query internal systems and act on behalf of employees, which makes them a new attack surface that traditional security testing was not built for. A Splunk research report last month found 81 percent of IT operations and engineering professionals reporting increased cooperation between security and observability teams — a sign that the two disciplines are converging around the same problem.
Cisco's bet is that red teaming should become a continuous loop — find the risk, measure the value, prove the trust — rather than a one-off audit before launch. Whether Mythos-powered testing catches flaws that conventional scanners miss will be the test that matters, and the first select-enterprise deployments will be where that claim gets judged.
