Strategic PartnersIssue 025 records
Cisco
Tonight’s Cisco edition is about the security of the platforms Cisco’s AI agents will run on. On Oct 28, Lumen’s Black Lotus Labs (independent) and Cisco Talos described state-backed attacks on Cisco Catalyst SD-WAN controllers. The attackers planted malware to steal encryption keys and targeted government agencies, universities and emergency services. Cisco also says AI Defense now feeds AI security findings into ServiceNow governance, though it offers no deployment data. The Register reports that Cisco’s researchers say Project Quarry is no substitute for human oversight and has not been tested against the incident used to illustrate it. Futurum’s Oct 30 analysis sees government AI infrastructure deals but questions whether partners have the skills to deliver them. There are no new SLED deployment metrics tonight.
- Evidence records
- 5
- Cross-source patterns
- 2
- Evidence classes
- 2 independent research2 vendor claim1 independent reporting
- Outcomes
- 3 emerging2 cautionary
- Source freshness
- 5 new this fortnight
- Research completed
- 2026-10-31
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
The management planes Cisco wants AI agents to operate are already prime state-actor targets
Lumen’s independent telemetry and Cisco Talos’s malware analysis agree that attackers went after Cisco SD-WAN control planes because one breach gives visibility, control and keying material across a whole network. Lumen names government, universities and emergency services among the victims. The archive shows Cisco adding MCP servers and agent access to these same planes. That makes control-plane hardening, patching and integrity checks a prerequisite for SLED AgenticOps pilots, not a follow-on.
Operating questionBefore granting any AI agent or MCP server access to network management, can the agency show its controllers are patched, not exposed to the internet, and checked against published indicators?
Supporting evidenceLumen Technologies (Black Lotus Labs)Cisco Talos
Cisco’s new AI security tools come with no published efficacy data and are framed as feeding human-run governance
AI Defense passes its findings to ServiceNow for human owners to fix. Cisco’s researchers tell The Register that Quarry rules do not replace human oversight and were not tested on the incident used to explain them. Neither source gives detection rates or deployment results. SLED buyers should treat both as pilots that still need local validation and named human reviewers.
Operating questionWhat local test data and which named human reviewers will validate AI security detections before they inform enforcement or compliance reporting?
Supporting evidenceCiscoThe Register (interviewing Cisco AI threat research)
Evidence ledger
Full record · every source keeps its link and limitations
Lumen Black Lotus Labs: Volt Typhoon’s “Silent Train” network targeted management and control-plane platforms, including Cisco Catalyst SD-WAN, across government, universities and critical infrastructure
Black Lotus Labs reports that since late 2023 it tracked Volt Typhoon’s “Silent Train” relay framework, notified hundreds of victims and supported investigations that uncovered four confirmed and one likely zero-day campaigns against endpoint/network management, SD-WAN and out-of-band platforms. It states Volt Typhoon exploited Cisco Catalyst SD-WAN through CVE-2026-20127 (CVSS 10.0) by late 2025 and continued after Cisco’s February 2026 disclosure. Listed victims include government, universities (notably those with ROTC/defense ties), emergency services and water, energy and transportation operators. Lumen also lists ServiceNow among technologies targeted.
Why it matters, evidence and limitations
- Why it matters
- Directly relevant to SLED network owners: state and local agencies, universities and critical-infrastructure operators appear in the victimology, and the targeted class (SD-WAN orchestrators, management planes) is the same class Cisco is now exposing to AI agents through Cloud Control and MCP servers. Interpretation: AI relevance is indirect; this is a control-plane security constraint, not an AI deployment.
- Evidence and measured results
- Three years of backbone telemetry and victim notifications by a non-Cisco research team; named CVEs and platforms; sector and regional victimology; defender recommendations. No victim counts by SLED sub-segment, no list of affected public entities, and telemetry could not always distinguish known from undisclosed vulnerabilities (stated by Lumen).
- Limitations and uncertainty
- Lumen is itself a network/security provider and this is self-published threat research, not peer-reviewed. The SD-WAN exploitation is described as historical and largely tied to a CVE disclosed in February 2026. It is not evidence about Cisco AI products.
Cisco Talos details KeyDrift, malware hidden inside Cisco Catalyst SD-WAN controllers to harvest keying material, with infrastructure overlapping Volt Typhoon’s Silent Train
Talos reports that actor UAT-11473 exploited CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller, and installed “KeyDrift”, a framework whose PolyFlame module is injected into vdaemon control-plane processes as a backdoor and intermediate C2, and whose LittleFilch module hooks SSL_read to extract data-plane keying material. Observed targeting spans space/satellite, defense/aerospace and policy research. Talos assesses with high confidence that the actor’s infrastructure overlaps Volt Typhoon’s Silent Train network, without saying they are the same group, and calls the activity historical.
Why it matters, evidence and limitations
- Why it matters
- Limited direct SLED victimology in this source, but Cisco Catalyst SD-WAN is widely used by state agencies, school networks and universities. Read together with Lumen’s research, it shows the Cisco control plane that AgenticOps tooling will sit on is an active espionage target.
- Evidence and measured results
- Malware reverse engineering with named components, file paths and behaviors, plus remediation pointers (patches and a hardening guide). No victim counts, timeline of intrusions or sector breakdown beyond the listed targeting.
- Limitations and uncertainty
- Vendor-authored research on a flaw in the vendor’s own product. Activity is described as historical with no dates; Talos did not recover the full configuration and does not attribute definitively.
Cisco AI Defense joins ServiceNow’s Control Tower Alliance as a founding member, feeding AI asset discovery and security detections into ServiceNow governance
Cisco says AI Defense is a founding member of the ServiceNow Control Tower Alliance. AI Defense discovers models, agents, datasets and MCP servers across clouds, scans models and MCP servers for supply-chain risks, runs automated AI red teaming before and after launch, and applies runtime guardrails. Two existing integrations on the ServiceNow Store send discovered assets to Control Tower inventory and route detections to ServiceNow AI Security Exposure Management for ownership and remediation. Alliance solutions are said to pass ServiceNow qualification and integration testing.
Why it matters, evidence and limitations
- Why it matters
- Many state agencies and universities run ServiceNow for IT service management and are standing up AI inventories required by state AI policies; this offers a path to tie AI security findings to owners and fixes. Relevance depends on a customer having both platforms.
- Evidence and measured results
- Vendor announcement only. No customer deployments, detection rates, red-team results or independent test data are given.
- Limitations and uncertainty
- Vendor marketing; “works today” claims are unverified; alliance qualification criteria are not published in the post. On-premises AI and non-cloud assets are not addressed.
The Register: Cisco says Project Quarry rules are not a substitute for human oversight and were not run against the OpenAI–Hugging Face incident data
Reporting on Cisco’s open-source Project Quarry (already archived from Cisco’s blog), The Register adds stated limits from Cisco’s researchers: they have not run Quarry against data describing the OpenAI–Hugging Face intrusion and only suggest where rules would likely have flagged steps; rules are not a substitute for chain-of-thought monitors or other human oversight; and Cisco’s head of AI threat research says, “Do we have all the answers? No.”
Why it matters, evidence and limitations
- Why it matters
- Agencies and universities piloting agents (including through Cisco MCP servers) should treat Quarry as an early, community detection layer, not a validated control. The added limitations are what is new versus the archived Cisco announcement.
- Evidence and measured results
- Interview-based reporting with a vendor spokesperson; hypothetical walk-through of an incident; no test results, false-positive rates or deployments.
- Limitations and uncertainty
- The Register relays Cisco’s statements; it did not test Quarry. Hypothetical incident mapping is not evidence of detection.
Futurum: Cisco’s partner-led AI push reaches government and sovereign deals, but partner skills for rack-scale AI and Splunk attach remain open questions
Futurum reports Cisco said channel bookings were about 90% of FY26 bookings, channel growth slightly above 17%, and Splunk grew 13% in the second half of FY26. Cisco turned on orderability for full-stack AI infrastructure with Supermicro rack-scale SKUs, and Model Foundry GA is planned for June 2027. Futurum says partners see AI infrastructure deals in government and sovereign cloud, but asks how many partners have rack-scale AI skills, notes Cisco acknowledged moving slowly on Splunk, and flags whether Splunk attach rises after compensation changes.
Why it matters, evidence and limitations
- Why it matters
- SLED buyers mostly purchase Cisco through partners and cooperative contracts; Futurum’s point that rack-scale AI skills differ from campus/branch practices is a direct delivery-risk signal for state and university AI infrastructure projects. Model Foundry GA in June 2027 bounds near-term SLED use of it.
- Evidence and measured results
- Analyst event analysis citing Cisco-reported figures (bookings share, growth) and Futurum’s own market forecast (AI data center networking spend over $117B in 2026). No SLED-specific data; figures are company-reported, not audited.
- Limitations and uncertainty
- Futurum discloses that it engages or has engaged with many companies mentioned; analysis is opinion based largely on Cisco-provided information. Not SLED-specific.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Independent research
- Research conducted outside the implementing organization.
- Vendor claim
- A supplier-provided assertion that has not been upgraded to independent evidence.
- Independent reporting
- Independent reporting with attributable sources but without a formal evaluation design.