{"resourceId":"checkable-ai-cisco-ai-defense-control-gaps-audit-attestation-20261019","versions":[{"version":"external-54fa35fdd97f558e0f229bfb4d4080d6080d3cfaf506dcf89b41bbf77b0b3a63","resource":{"id":"checkable-ai-cisco-ai-defense-control-gaps-audit-attestation-20261019","title":"Checkable AI: public-docs stack check finds Cisco AI Defense covers MCP runtime profiles and SOC export but not complete tamper-evident agent audit or public FedRAMP/IRAP/ISO 42001 attestation","organization":"Checkable AI","sector":"Independent AI controls knowledge base (docs-based product mapping)","geography":"Global product; Checkable regions include United States, EU, Australia","publishedAt":"Checkable AI knowledge base, last checked Oct. 19, 2026","publicationDate":"2026-10-19","eventDate":null,"sourceName":"Checkable AI","sourceLabel":"Cisco AI Defense: AI security controls and findings","sourceUrl":"https://checkableai.com/stack-check/platforms/cisco-ai-defense/","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["data-security","developers-agents","governance-procurement"],"finding":"Why now: Nov. 5 Partner Summit and Nov. 4 Splunk posts position Cisco AI Defense as the active protection layer for agentic AI. Checkable AI’s Oct. 19, 2026 public-documentation stack check (40 findings; not a live-tenant test) finds supported capabilities such as MCP Security Profiles/runtime tool blocking and SOC telemetry export to Splunk/ServiceNow, while marking not covered: agent identity issuance, credential brokerage, approval gates for proposed actions, sandbox/emergency stop, and a complete tamper-evident per-agent record of tool calls and data access (logs only for policy-triggering traffic; rule-only API evaluations write no event). It also reports no public IRAP, ISO 27001 or ISO/IEC 42001 attestation for AI Defense and notes event-log storage in the US with limited points of presence.","sledRelevance":"Directly material for SLED buyers evaluating AI Defense against audit, residency and authorization requirements when partners pitch “trusted AI.” Does not itself document a government deployment; it constrains what can be claimed from vendor marketing alone.","evidence":"Independent docs-based control mapping last checked Oct. 19, 2026. Explicitly not a penetration test or live deployment assessment; some Cisco securitydocs pages were inaccessible to Checkable.","architectureImplications":"AI Defense is strongest as inventory, red teaming, runtime/MCP traffic mediation and SOC export; agent lifecycle identity, approval and write-once audit need complementary systems.","governanceImplications":"Buyers should map required controls to AI Defense or named compensating controls before treating AI Defense as complete agent governance.","securityPrivacyImplications":"Policy-trigger logs are not a full agent action history; residency of AI Defense events and attestation gaps matter for regulated SLED workloads.","caveats":"Docs-only; dated Oct. 19 relative to Nov. 5 marketing; product may have changed; out-of-scope items are not automatically defects.","streamIds":["cisco"],"roles":{"sales":"Sales framing: why-now is Partner Summit and Splunk posts pitching AI Defense as the active protection layer. Checkable AI’s Oct. 19 public-docs stack check finds MCP runtime profiles and SOC telemetry export supported, but no complete tamper-evident per-agent action audit, no agent identity issuance, and no public FedRAMP/IRAP/ISO 42001 attestation. Use this to set honest scope with SLED buyers: AI Defense is traffic/policy mediation, not a full agent governance system of record.","engineering":"Engineering framing: map Checkable’s covered vs not-covered controls to your agent estate. Rely on MCP Security Profiles and runtime guardrails where documented; do not assume OBO delegation, credential brokerage, approval gates for proposed actions, sandbox/emergency stop, or write-once audit export exist in AI Defense alone. Plan complementary identity, PAM, SIEM retention and change-control systems for gaps the check marks not addressed.","delivery":"Delivery framing: before citing AI Defense in an agent production gate, produce a control matrix of Checkable findings against local requirements (audit completeness, residency, attestations). Security architecture owns the matrix; AI platform owns MCP inventory and policy attachments. Acceptance requires named compensating controls for every not-covered item that policy or auditors require."},"roleDetails":{"sales":{"customerProblem":"SLED buyers hear AI Defense closes the agent trust gap but need an evidence-based view of what the product actually documents.","stakeholders":["CISO","AI platform owner","Auditor/compliance","Procurement"],"discoveryQuestions":["Which agent audit and attestation requirements must you meet?","Do you need FedRAMP or equivalent evidence for AI runtime controls?","What compensating controls exist for agent identity and change approval?"],"valueHypothesis":"Independent public-docs mapping can prevent overselling AI Defense as complete agent governance; it is not a lab test of a live tenant.","potentialEngagement":"Control-gap workshop aligning AI Defense documented scope to agency agent-governance requirements.","unsupportedClaims":["Live-tenant verification by Checkable","That unsupported controls are defects rather than out-of-scope","FedRAMP authorization status beyond what Checkable found public"]},"engineering":{"fit":"Useful scrutiny source when designing agent controls alongside Cisco AI Defense.","architectureIntegration":"AI Defense for inventory, red teaming, runtime/MCP guardrails and SOC export; complementary systems needed for agent identity, approval gates and tamper-evident action ledgers.","prerequisites":["Inventory of MCP servers and agents","SIEM/ServiceNow integration plan","Written audit requirements"],"constraints":["Docs-based check, not penetration test","Last checked 19 Oct 2026","Some Cisco securitydocs pages inaccessible to Checkable"],"security":"Do not treat policy-trigger logs as a complete agent action history; design export and integrity separately if required.","proofOfValue":["Reproduce key Checkable findings against current release notes","Confirm which MCP profiles are attached in staging","Identify compensating control for administrative audit gap"]},"delivery":{"work":"AI Defense scope-and-gap matrix for agent production readiness.","dependencies":["Current AI Defense release notes","Agency audit policy","Identity/PAM owners"],"ownership":"Security architecture lead with AI platform and compliance","skillsAdoption":"Teams must distinguish traffic guardrails from agent lifecycle governance.","governanceCheckpoints":["Attestation evidence review","Audit-log completeness decision","Compensating-control sign-off"],"acceptanceCriteria":["Proposed: every required control mapped to AI Defense or a named compensating system","Proposed: no production expansion where audit gaps are unmarked"],"risks":["Stale findings after product updates","Docs-only blind spots","False assurance from partial SOC export"]}},"retrievedAt":"2026-11-06T04:08:23Z","enrichedAt":"2026-11-06T04:18:40Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"No workforce findings; control completeness affects auditor and operator workload more than end-user accessibility.","procurementImplications":"Require current release notes, Trust Portal evidence under NDA if needed, and contractual clarity on audit-log completeness and residency.","operatingModelImplications":"Separate traffic guardrail operations from agent identity, change approval and evidence retention owned by identity/PAM and compliance teams.","sourceVerification":{"responseId":"curl-checkable-ai-defense","openedUrl":"https://checkableai.com/stack-check/platforms/cisco-ai-defense/","referenceExcerpt":"Cisco AI Defense documents event and audit logs only for traffic that triggers policy, and API calls evaluated by rules alone write no event.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}