Strategic PartnersIssue 035 records
Cisco
Tonight’s Cisco edition looks at an AI claim inside Cisco itself. Fortune reports that Cisco’s president gave a two-person team unlimited AI tokens and a four-week proof period toward refactoring 98% of Cisco’s legacy code in 24 months. He later said this could speed moves to memory-safe languages. Independent sources push back: a modernization firm notes that the 98% is a target with no reported test method, and a preprint found automated C-to-Rust tools carried over or added memory-security bugs. Independent reporting says Cisco’s ServiceNow alliance mainly formalizes connectors that already existed. No new U.S. SLED deployment metrics surfaced.
- Evidence records
- 5
- Cross-source patterns
- 1
- Evidence classes
- 2 vendor claim2 independent reporting1 academic research
- Outcomes
- 2 emerging2 cautionary1 mixed
- Source freshness
- 4 new this fortnight1 recent
- Research completed
- 2026-11-02
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
Cisco’s AI code-rewrite and memory-safety claims are targets; independent evidence says rewritten code must be proven on behavior and security
Cisco’s president describes a goal of refactoring 98% of legacy code in 24 months, starting with a four-week proof, and says the work could speed migration to memory-safe languages. Neither report gives results, scope or a test method. An independent modernization firm says the 98% is a target, not a result, and that rewritten code can pass review and still behave differently. A preprint found automated C-to-Rust tools kept original memory-security bugs in 177 of 464 outputs and introduced 77 new bugs. For SLED teams running Cisco gear, upgrade regression testing and advisory tracking stay essential, and their own AI modernization pilots should be judged on equivalence and security tests, not on how much code was rewritten.
Operating questionBefore crediting any vendor or in-house AI rewrite with better reliability or security, what behavior-equivalence and known-vulnerability tests will we require, and who signs off?
Supporting evidenceCisco (reported by Fortune)Cisco (reported by India Today)Axio Intelligence (software modernization consultancy)Hung-Mao Chen, Xu He, Bo Lu, Xiaokuan Zhang, Kun Sun (arXiv preprint)
Evidence ledger
Full record · every source keeps its link and limitations
Fortune: Cisco gives a two-person team unlimited AI tokens and a four-week proof period toward refactoring 98% of its legacy code in 24 months
Fortune reports Cisco president and chief product officer Jeetu Patel’s account, given at a roundtable dinner, that he gave Padmanabhan “Paddy” Krishnamurthy, a 27-year-old former EzDubs co-founder, unlimited AI tokens to refactor code. Krishnamurthy believed a two-person team could rewrite Cisco’s legacy code; there is a four-week window to prove the approach and an end goal of refactoring 98% of Cisco’s legacy code within 24 months. The piece is mainly about hiring early-career staff. Every figure is a goal stated by a Cisco executive. No results, tools, codebases, test methods or products in scope are reported.
Why it matters, evidence and limitations
- Why it matters
- Limited and indirect. SLED agencies, campuses and school districts run Cisco routers, switches, firewalls, ISE and collaboration software. A large AI-assisted rewrite of Cisco’s code would eventually show up in the software releases those teams patch and certify. Nothing here changes current SLED products, contracts or support terms.
- Evidence and measured results
- News reporting of an executive’s on-record remarks at a small roundtable. There is no Cisco press release, no technical description, no baseline or measure of what counts as “refactored,” and no independent assessment in the article.
- Limitations and uncertainty
- Executive remarks to the press. 98% and 24 months are targets, not results. The four-week proof had not reported. Scope (which products, which languages) is undefined. Large parts of the article cover hiring philosophy, not engineering.
India Today: Patel says the AI code-rewrite team will hand ownership to Cisco’s core engineers and could speed migration to memory-safe languages
India Today reports a follow-up post on X by Jeetu Patel. He describes the AI code-rewrite effort as a two-to-three-person team meant to “catalyze” change, with ownership of the final product handed to Cisco’s core engineering teams. Patel said the approach could help Cisco carry out more migrations to memory-safe programming languages, and acknowledged that not every experiment will work. The report repeats the 98%/24-month target and the four-week proof period from Fortune. These are claims of intent. No language, product or measured security result is given.
Why it matters, evidence and limitations
- Why it matters
- Limited but security-relevant. Memory-safety is a recurring theme in U.S. secure-by-design guidance, and SLED agencies run Cisco devices whose vulnerabilities often reach CISA’s exploited-vulnerability catalog. If Cisco moves code to memory-safe languages, it could matter to state and local security teams over time. This report only shows an executive’s stated possibility.
- Evidence and measured results
- News report of an executive social-media post, with quotations. No Cisco engineering documentation, roadmap or metrics.
- Limitations and uncertainty
- Secondary report of an X post; I did not open the post itself. Claims are stated possibilities (“could help”). No products, languages or timelines for memory-safe migration are specified.
Axio Intelligence: Cisco’s 98% is a target, not a result; a four-week AI-rewrite proof should be scored on behavior equivalence, data checks and rollback
Writing the same day as the Fortune report, Axio says the 98% is a target, not a result, and that nothing has been reported from the four-week proof or about how rewritten code will be tested. It argues AI-generated code can compile, pass review and existing unit tests and still behave differently, because legacy behavior lives in edge cases, undocumented rules, integrations and data. It recommends scoring a proof on behavior-equivalence tests against production-derived golden-master data, coverage of changed modules, integration and data reconciliation and a rehearsed rollback, followed by staged cutover. It notes C++ undefined behavior matters most in embedded and networking software.
Why it matters, evidence and limitations
- Why it matters
- Directly useful to SLED IT leaders who are being asked “why aren’t we doing that?” about AI rewrites of their own legacy systems (benefits, licensing, student information and finance systems). The checklist is a practical acceptance framework for any state, local or campus AI modernization pilot, separate from Cisco’s own effort.
- Evidence and measured results
- Practitioner guidance and analysis of public reporting. No original data, case results or measured outcomes. The author’s firm sells modernization services.
- Limitations and uncertainty
- Commercial blog from a firm that sells modernization sprints (includes a call to action). Guidance is generic and not peer reviewed. It interprets, but has no inside knowledge of, Cisco’s project.
Preprint: automated C-to-Rust refactoring tools left original memory-security bugs and introduced new ones on 116 NIST Juliet test programs
Preprint, not peer reviewed. The authors evaluated four automated C-to-Rust refactoring approaches (C2Rust-analyze, CROWN, C2SaferRust and FLOURINE), some using LLMs, on 116 C programs with memory security bugs from the NIST Juliet Test Suite, producing 464 Rust programs. 342 failed to compile, 177 inherited memory security bugs from the original C, and 77 new Rust bugs were introduced. They conclude the tools deliver memory safety as they define it, but not broader memory security. Why now: Cisco’s president said on Oct. 30-31 that AI-assisted rewriting could speed Cisco’s migration to memory-safe languages; this is the most relevant independent evidence on that claim.
Why it matters, evidence and limitations
- Why it matters
- Gives SLED security leaders an independent check on vendor claims that AI or automated translation into memory-safe languages makes software safer. It applies to Cisco’s stated direction and to agencies considering similar modernization of their own C/C++ code.
- Evidence and measured results
- Empirical study on a standard synthetic test suite (116 programs, four tools, 464 outputs), measuring compilation, inherited bugs and new bugs. Read from the arXiv abstract page.
- Limitations and uncertainty
- Preprint, not peer reviewed; I read the abstract page, not the full paper. Juliet programs are small synthetic test cases, not production networking code. The tools studied are research tools, not Cisco’s (unknown) toolchain. The study does not evaluate the general-purpose LLM coding agents Cisco may use.
Superpower Daily: Cisco’s ServiceNow Control Tower Alliance membership formalizes connectors that already existed; customers should check entitlements and release compatibility
Superpower Daily reports that Cisco’s Oct. 28 founding membership in ServiceNow’s Control Tower Alliance builds on two connectors already available on the ServiceNow Store. One adds Cisco AI Defense-discovered assets to the Control Tower inventory; the other routes AI security detections into ServiceNow for owner assignment and fix tracking. What the alliance adds is process: ServiceNow qualification, certification and integration testing, shared standards for agent identity and guardrails, and joint sales and support. The article concludes that membership does not mean the connectors are new, and that customers should first check ServiceNow entitlements and release compatibility. This is independent context on a Cisco announcement archived in the Oct. 30 edition.
Why it matters, evidence and limitations
- Why it matters
- Many state agencies and universities use ServiceNow for IT service management. The article helps SLED buyers separate what is available now (two Store connectors) from what the alliance promises (testing and joint support), and points to entitlement and version checks that affect procurement.
- Evidence and measured results
- Independent news analysis of Cisco’s announcement and the ServiceNow Store listings as described. No customer deployments, testing results or pricing.
- Limitations and uncertainty
- Short article from an AI news site; it relies on Cisco materials and Store listings and does not test the connectors. Alliance testing requirements are described at a high level.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Vendor claim
- A supplier-provided assertion that has not been upgraded to independent evidence.
- Independent reporting
- Independent reporting with attributable sources but without a formal evaluation design.
- Academic research
- Research produced through an academic institution or peer-reviewed venue.