Strategic PartnersIssue 095 records
Cisco
Nov. 6 Cisco IT published a cisco-on-cisco AI factory story claiming GPU utilization rose from ~15% to ~50% (peaks ~80%) while hosting MyAgent for 90,000 employees and Cisco IQ production, with AI Defense, planned Hypershield, Live Protect and Splunk observability in the stack—self-reported and unfinished on Tokenomics. The same research window’s Nov. 5 Splunk GSO Customer Zero post reports SOC triage handle time falling 15.4→5.6 minutes (64%) and detection authoring from ~2 hours to under 10 minutes under delegated/guided/bounded autonomy, with cloud ES tier gates and an alpha workflow builder called out. A Nov. 5 Webex customer story details Saudi HRSD’s in-house migration to Webex Suite/Calling (11,000+ users; 662,900 meetings; Virtual Branch citizen services), useful as international government collaboration evidence with explicit U.S. transferability limits. Anton Chuvakin’s Nov. 5 firewall essay reframes enforcement around agent task and delegated authority as AI traffic moves inward. Independent scrutiny comes from AI Security Platform’s Nov. 3 documentation review (7.6/10) newly paired against the AI Defense push: strong framework mappings and MCP/BOM coverage, but SSE dependency for workforce controls, private-offer pricing and no lab benchmark. All quantitative outcome claims tonight are vendor-reported except the docs review’s qualitative gap analysis.
- Evidence records
- 5
- Cross-source patterns
- 2
- Evidence classes
- 4 vendor claim1 independent research
- Outcomes
- 3 effective1 emerging1 mixed
- Source freshness
- 5 new this fortnight
- Research completed
- 2026-11-07
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
Cisco and Splunk Customer Zero posts publish measured agent/infrastructure gains—still self-reported, still useful as pilot templates
The Nov. 6 AI factory post (GPU utilization ~15%→~50%, denser on-prem inference) and Nov. 5 Splunk GSO SOC post (triage 64% faster; detection authoring ~12x) show Cisco-family teams quantifying agent/infra outcomes on their own estates. Both are vendor-reported without independent audit. For SLED, copy the measurement discipline (baseline handle time or GPU util, human approval gates) rather than the headline percentages.
Operating questionWhich single SLED workload will you baseline this month so vendor Customer Zero percentages are replaced by your own evidence?
Supporting evidenceCisco IT says its multi-tenant enterprise AI factory tripled GPU utilization to ~50% and hosts MyAgent plus Cisco IQ at 99.99%+ SLASplunk (Cisco)
AI Defense is being embedded in Cisco’s AI factory and trust story, while independent docs review and firewall essay demand honest scope—including SSE and task-aware network enforcement
Cisco IT embeds AI Defense in its AI factory narrative and Chuvakin argues network enforcement must judge agent authority, yet AI Security Platform’s Nov. 3 docs review flags SSE dependency for workforce controls, opaque pricing and missing lab benchmarks. SLED programs should separate custom-app runtime guardrails from workforce shadow-AI use cases and require independent tests plus coverage proof on the network path.
Operating questionIs tonight’s AI Defense discussion about app/agent runtime, workforce shadow AI (SSE), network task enforcement—or all three conflated?
Supporting evidenceCisco IT says its multi-tenant enterprise AI factory tripled GPU utilization to ~50% and hosts MyAgent plus Cisco IQ at 99.99%+ SLAAnton Chuvakin argues AI-era firewalls must judge agent task and delegated authority, not only identity, as AI traffic moves inwardAI Security Platform
Evidence ledger
Full record · every source keeps its link and limitations
Cisco IT says its multi-tenant enterprise AI factory tripled GPU utilization to ~50% and hosts MyAgent plus Cisco IQ at 99.99%+ SLA
Cisco IT describes moving from project-specific GPU silos to a pooled multi-tenant AI factory after MyAgent rollout to 90,000 employees and Cisco IQ production hosting. Self-reported results: GPU utilization from ~15% to ~50% (peaks ~80%); active GPUs from ~250 to 1,568 without new real estate via rear-door heat exchangers; preference for ~80% steady-state inference on-prem; 99.99%+ SLA for MyAgent and Cisco IQ. Stack cited: Silicon One fabric, UCS-X with NVIDIA/AMD GPUs, Cisco AI Defense runtime guardrails, planned Hypershield segmentation, Live Protect on Nexus, Splunk Observability/Cloud/ITSI with Agent Observability and Tokenomics still expanding.
Why it matters, evidence and limitations
- Why it matters
- Relevant as an architecture pattern for SLED agencies and research campuses building on-prem/hybrid AI factories on Cisco networking and Splunk observability, not as a measured SLED deployment. Transferability requires matching power/cooling, multi-tenancy, FedRAMP/state privacy constraints and independent verification of utilization claims.
- Evidence and measured results
- Vendor-reported metrics and architecture narrative from Cisco IT authors; no independent audit, baseline methodology detail or third-party measurement of GPU utilization or SLA.
- Limitations and uncertainty
- Self-reported Cisco IT results; power, cooling and GPU supply assumptions may not hold in typical state data centers; Agent Observability/Tokenomics not finished.
Anton Chuvakin argues AI-era firewalls must judge agent task and delegated authority, not only identity, as AI traffic moves inward
Chuvakin contends autonomous agents expand the unit of risk from session to task, so firewalls must ask whether an actor behaves within delegated authority—not only whether identity and destination are allowed. He highlights inward AI traffic (user→agent→internal model→MCP→app→data), Hybrid Mesh Firewall distribution, virtual patching/SnortML for shrinking exploit windows, structured denials for agents (not silent drops), and an observe→attribute→assess→inspect→enforce→learn loop with coverage proof about what is unseen. No measured customer outcomes are presented.
Why it matters, evidence and limitations
- Why it matters
- Useful framing for SLED CISOs designing controls for internal agents and MCP tools on government networks; does not document a state/local deployment or FedRAMP boundary change. Pair with procurement language that demands explainable denials and independent network telemetry for agent investigations.
- Evidence and measured results
- Conceptual vendor analysis referencing Cisco Secure Firewall capabilities (Encrypted Visibility Engine, SnortML, Hybrid Mesh Firewall); no benchmarks, audits or named agency results.
- Limitations and uncertainty
- Essay without empirical evaluation; Cisco product references are illustrative; silent on FedRAMP/CJIS specifics.
Saudi HRSD reports in-house Webex Suite/Calling migration to 11,000+ users with custom device monitoring and Virtual Branch citizen services
Webex’s Nov. 5 customer story says Saudi Arabia’s HRSD migrated calling, meetings and messaging from on-prem to Webex Suite and Webex Calling for 11,000+ users (~28% growth from ~8,600), with 662,900 meetings and 20.8M meeting minutes (Sep 2025–Sep 2026) and 400,000+ calls/month. HRSD’s in-house team executed the migration without an external implementer and built a custom API monitoring/backup engine for Cisco collaboration devices. Virtual Branch extends Webex to remote beneficiary services. AI Assistant transcription/translation is under cybersecurity review; Webex Contact Center is being tested pending local availability. Story won a 2026 Webex Customer Award (Bold Explorer: Government & Public Sector).
Why it matters, evidence and limitations
- Why it matters
- Illustrates government collaboration cloud migration, citizen-facing virtual services and in-house delivery capacity. U.S. SLED applicability is limited by jurisdiction (FedRAMP/Webex for Government, records retention, accessibility and procurement differ). Treat metrics as vendor-reported international evidence with transferability caveats, not U.S. agency results.
- Evidence and measured results
- Vendor blog with attributed HRSD quotes (Rashed Alzannan) and quantitative usage claims; no independent audit of uptime, cost savings or citizen outcomes.
- Limitations and uncertainty
- International vendor story; cost predictability claims lack dollar figures; AI and Contact Center still evaluative; not a U.S. SLED deployment.
Splunk GSO Customer Zero: SOC agents cut triage handle time 64% and detection authoring from ~2 hours to under 10 minutes
Splunk’s Nov. 5 post describes its Global Security Organization running as Customer Zero for Enterprise Security agents across three autonomy modes: delegated (triage), guided (Automation/Connector Builder) and bounded (Detection Builder). Measured claims: triage average handle time 15.4→5.6 minutes (64% faster) with zero misclassifications of benign activity in production-like tests; phishing playbook built in 8m31s; detection authoring from ~2 hours to under 10 minutes (~12x), with agent completing 75% of tasks unaided and 90% after prompting. Features tied to ES Essentials/Premier on Splunk Cloud (version gates noted); Agentic Workflow Builder called alpha/under development.
Why it matters, evidence and limitations
- Why it matters
- Directly relevant to SLED SOCs evaluating Splunk ES agentic tiers—methods (match autonomy to task; trust-but-verify) transfer even when metrics are vendor self-reported. Confirm Cloud vs on-prem entitlements, CJIS/FedRAMP boundaries and that alpha features are excluded from production acceptance.
- Evidence and measured results
- Self-reported Splunk GSO timings and classification results; sample sizes and full methodology not published; not an independent SOC study.
- Limitations and uncertainty
- Vendor Customer Zero; cloud-only version gates; Agentic Workflow Builder alpha; no external replication.
AI Security Platform’s Nov. 3 docs review scores Cisco AI Defense 7.6/10, flagging SSE dependency, opaque pricing and missing lab benchmarks
Newly relevant against Nov. 5–6 Cisco AI Defense pitching (Partner Summit residual and AI Factory embedding): AI Security Platform’s Nov. 3 documentation review scores Cisco AI Defense 7.6/10. Strengths cited include MITRE ATLAS/OWASP LLM/Agentic/NIST AI RMF mappings, AI BOM/MCP Catalog supply-chain coverage, free Explorer Edition red teaming and VPC/AI POD options. Gaps: workforce shadow-AI controls require Cisco Secure Access SSE; pricing is private-offer only; some announced features still in development; file-upload inspection, coaching and M365/Google Workspace app governance not documented; no independent detection benchmark; governance scorecard/attestation only partial. Reviewers state no lab access or vendor demo.
Why it matters, evidence and limitations
- Why it matters
- Gives SLED evaluators an independent control checklist when Cisco packages AI Defense with networking/Splunk narratives. Highlights procurement and architecture dependencies (SSE) that affect non-Cisco-centric agencies. Does not replace agency ATO testing.
- Evidence and measured results
- Public documentation, product/pricing pages and press as of Nov 2026; explicit Documentation Reviewed track, not lab tested.
- Limitations and uncertainty
- Docs-only review; scoring rubric is the site’s own; may miss unpublished capabilities; published just before last cisco edition but not previously archived—included for independent scrutiny of current AI Defense push.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Vendor claim
- A supplier-provided assertion that has not been upgraded to independent evidence.
- Independent research
- Research conducted outside the implementing organization.