Strategic PartnersIssue 106 records
Cisco
Cisco used Cisco Live APJC (Nov. 9 U.S. time) to announce Anthropic Claude Mythos inside AI Defense adaptive red teaming (registered targets, named operators, audit trails; coming soon for select enterprises), Splunk Tokenomics ROI for AWS-hosted agents (preview December, GA early 2027), and Cisco IQ exposure data flowing into Splunk. Independent coverage (The Register, CRN) adds that Mythos-backed testing is planned under existing licenses and via partners, with roughly 400 to 500 AI Defense customers, but there is no independent testing or public-sector reference. Splunk's own documentation shows Tokenomics costs are vendor-reported and unaudited, and federal reporting from June shows government policy for Mythos-class tools lagging access. The one SLED deployment item is a Welsh county council's Webex contact-center consolidation (175,000 calls/month, 76% answer rate, vendor-reported) that is only beginning to explore AI agents. No new U.S. SLED Cisco AI deployment results were found.
- Evidence records
- 6
- Cross-source patterns
- 2
- Evidence classes
- 3 vendor claim3 independent reporting
- Outcomes
- 4 emerging2 cautionary
- Source freshness
- 4 new this fortnight1 undated1 older, newly relevant
- Research completed
- 2026-11-10
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
Frontier cyber-model testing reaches public-sector buyers through a vendor wrapper before agencies have policy for it
Cisco's Nov. 9 release and CRN/Register coverage describe Mythos-backed red teaming inside AI Defense with vendor-designed controls (registered targets, named operators, audit trails), partner delivery, and inclusion under existing licenses, but limited to select enterprises with no public-sector references. Nextgov's June federal reporting shows government users already struggled with unclear guidance and with validating AI-flagged findings. Together they suggest SLED agencies may gain access by default through existing contracts before their own authorization, subprocessor and remediation rules exist.
Operating questionBefore any Mythos-backed or partner-run AI red-team test touches your systems, who approves it, which subprocessors handle the test data, and who will remediate what it finds?
Supporting evidenceCisco Systems (with Anthropic; Splunk by Cisco)The Register (reporting on Cisco, Anthropic and IBM)CRN (interview with Cisco SVP DJ Sampath)Nextgov/FCW (reporting on federal CIOs, ONCD, CISA)
Agent ROI dashboards are being marketed while the underlying cost data remains vendor-reported and unaudited
The Nov. 9 announcement promises Tokenomics as a single view of AI ROI tying agent cost to quality and KPIs (preview December, GA early 2027), while Splunk's own documentation states Tokenomics relies on vendor-reported or estimated costs, does not audit them, counts bot and service accounts, and does not backfill late data. For SLED budget offices, these tools can support visibility but need invoice reconciliation and agency-defined KPIs before ROI claims are used in budget justification.
Operating questionWhich AI spend figures will you reconcile to invoices, and which outcome KPI will you define, before any agent ROI dashboard is cited in a budget request?
Supporting evidenceCisco Systems (with Anthropic; Splunk by Cisco)Splunk (Cisco) Agent Observability documentation
Evidence ledger
Full record · every source keeps its link and limitations
Cisco adds Anthropic Claude Mythos to AI Defense adaptive red teaming, extends Splunk Tokenomics to AWS agents and feeds Cisco IQ exposure data into Splunk (vendor announcement)
Cisco says AI Defense's adaptive red teaming will add Anthropic's Claude Mythos to generate multi-step, system-specific attacks against customers' own AI apps and agents, restricted to registered and authorized targets, tied to a named operator, time-bound, revocable and audited, with no open prompt access. Mythos red teaming is 'coming soon for select enterprises'. Splunk Tokenomics will pair agent cost (Amazon Bedrock/CloudWatch usage) with quality evaluations and customer KPIs (private preview December, AWS Marketplace GA early 2027); Eval-G1 evaluator models and an evaluation tuner are GA this month. Cisco IQ vulnerability, lifecycle and configuration data will flow into Splunk via Cisco Data Fabric, with MCP and ServiceNow connectors.
Why it matters, evidence and limitations
- Why it matters
- SLED agencies and universities piloting citizen-facing or internal AI agents need pre-production adversarial testing and cost accountability. The announcement offers a vendor-managed path to frontier-model red teaming without the agency holding the model, but availability is limited to select enterprises, and no public-sector customer, FedRAMP/StateRAMP status, or test results are given. Cisco IQ-to-Splunk exposure correlation is relevant to state and campus networks with large Cisco estates.
- Evidence and measured results
- Vendor press release. Vendor-stated figures: AI Defense helped 'hundreds of customers' since January 2025; Cisco IQ close to 17,000 customers across more than 22 million devices; Eval-G1 up to 98% lower cost than a commercial LLM and 2.5x faster; 81% of ITOps/engineering respondents cite more security-observability cooperation (Splunk survey). No benchmarks, sample, methodology or customer outcomes are published.
- Limitations and uncertainty
- Announcement-only; timelines explicitly subject to change. 'Hundreds of customers' (press release) and '400 to 500' (CRN interview) are vendor numbers. Accuracy claims for Eval-G1 differ across Cisco/Splunk pages ('high accuracy' vs. 'up to 95%'), and Tokenomics preview timing differs between Splunk pages (November vs. December). No public-sector authorization status stated.
The Register: Cisco exposes Mythos functionality inside AI Defense under existing licenses without giving customers the model; IBM follows with Concert
The Register reports that Cisco AI Defense red teaming will be able to call Anthropic's Mythos to test customer setups, and that Cisco will offer it under users' existing licenses at no additional cost. It frames Mythos as a model whose distribution has been controlled (Project Glasswing) because it could help attackers, notes the Cisco deal exposes functionality without model access, and reports IBM announced a similar Concert integration hours later. Anthropic says demand has created a long queue of buyers.
Why it matters, evidence and limitations
- Why it matters
- If Mythos-backed testing arrives under existing AI Defense licenses, SLED customers with AI Defense may gain access without a new procurement, which affects budget and contract review. It also signals that frontier cyber-capable models will reach public-sector environments through vendor products before agencies set their own policies.
- Evidence and measured results
- Reporting with on-record quotes from Cisco SVP Jeff Schultz and Anthropic APAC head of applied AI Natalie Mead; no hands-on testing, metrics or customer evidence. Anthropic declined to say whether similar third-party deals exist.
- Limitations and uncertainty
- Pricing statement ('without additional cost') is vendor-stated and may change; availability is still limited to select enterprises per Cisco. The article's Mythos 5.2 pricing details concern Anthropic's direct API, not Cisco's product.
CRN: Cisco says partners can use Mythos through AI Defense to red team client agent rollouts; AI Defense has roughly 400 to 500 customers
CRN reports Cisco runs Mythos in a sandbox with control over what it can access, how it executes and how its sub-agents are spun up, and that partners can use Mythos through AI Defense to red team every client environment rolling out agents. Cisco says AI Defense has approximately 400 to 500 customers since launch, now supports Amazon Bedrock and CloudWatch for token-spend/ROI dashboards, and sits within Cisco Cloud Control. Availability remains 'coming soon for select enterprises'.
Why it matters, evidence and limitations
- Why it matters
- SLED buyers will likely meet Mythos-backed testing as a partner-delivered service. The 400 to 500 customer figure gives a more concrete scale than the press release's 'hundreds', but it shows AI Defense is still a young product with no stated public-sector reference base.
- Evidence and measured results
- Vendor executive interview reported by trade press; figures and claims ('no other red teaming service' with a model that powerful) are Cisco's, not CRN's findings. No customer, sector or outcome data.
- Limitations and uncertainty
- Interview-based; customer count is vendor-stated and unaudited; 'every client environment' is aspirational partner positioning. Dates, scope and regions subject to change.
Splunk Tokenomics documentation: costs are vendor-reported or estimated and not independently audited; daily refresh, no backfill, bot accounts counted
Splunk's own Tokenomics documentation says the feature uses each AI vendor's reported or estimated cost and activity data and does not independently audit or recalculate spend or token counts. It does not identify or exclude headless, bot or service accounts; data refreshes daily at 12:00 a.m. PDT; late provider data is not backfilled; GitHub Copilot cost can show $0 while included credits remain; workforce filters require an imported org chart. Supported coding-tool providers are Codex, Claude Code, Cursor, GitHub Copilot and Windsurf.
Why it matters, evidence and limitations
- Why it matters
- Why now: Cisco and Splunk pitched Tokenomics on Nov. 9 as giving organizations 'a single view of AI ROI'. For SLED finance and IT governance, the documentation shows Tokenomics is a reporting layer over vendor bills, not an audit, and that user counts may include service accounts, which matters for per-user chargeback and budget justification.
- Evidence and measured results
- Vendor documentation describing product behavior and limitations; no accuracy testing or customer results.
- Limitations and uncertainty
- Undated page; covers the coding-tool Tokenomics surface; the AWS Bedrock/CloudWatch ROI extension announced Nov. 9 is in preview and may document different behavior.
Cyngor Gwynedd (Wales) retires 16-server phone system for Webex Calling and Contact Center, reports 175,000 calls a month at 76% answer rate, and begins exploring AI agents (vendor case study)
Cisco reports that Gwynedd Council replaced a decade-old, 16-server on-premises telephony system with Webex Calling, Webex Contact Center, Cisco devices and Control Hub, integrated Cisco Call for Microsoft Teams for 1,700 users, and localized the Webex app, Control Hub and desk phones in Welsh. It now manages 175,000 calls a month at a 76% answer rate. AI is at an early stage: the council is exploring AI-driven agents and citizen self-service through workshops with 50 employees across education, social care, highways and other departments.
Why it matters, evidence and limitations
- Why it matters
- A concrete local-government example of the cloud contact-center foundation that precedes AI agents, including mobile field staff (social workers, highways crews) and language access. For U.S. counties and cities, the relevant lesson is sequencing (platform consolidation and live contact-center data before AI self-service) and language-access design; there is no AI outcome evidence yet.
- Evidence and measured results
- Vendor case study with council quotes. Reported metrics: 175,000 calls/month, 76% answer rate, 16 servers retired, 1,700 Teams-integrated users. No pre-migration answer rate, cost, staffing or resident satisfaction baseline is provided; AI work is exploratory.
- Limitations and uncertainty
- Vendor-authored marketing; no baseline for the 76% answer rate; UK procurement and regulatory context; AI agents not yet deployed, so no AI benefit claims are supported.
Nextgov/FCW: federal CIOs report no clear White House guidance on accessing or using Anthropic Mythos; sources caution flagged vulnerabilities still need validation
Nextgov/FCW reported that federal CIOs were frustrated by a lack of White House ONCD guidance on accessing and implementing Anthropic's Mythos to scan agency networks, while some parts of government already had access. A source cautioned that Mythos is not a silver bullet because agencies would still have to validate the vulnerabilities they flag and determine how to respond, and that readiness varies with cybersecurity maturity.
Why it matters, evidence and limitations
- Why it matters
- Why now: on Nov. 9 Cisco announced Mythos-backed red teaming inside AI Defense under existing licenses. That creates an indirect route for state and local agencies, universities and districts to use Mythos capabilities. The federal experience suggests public-sector policy and validation capacity may lag access; SLED agencies should set their own rules before adopting.
- Evidence and measured results
- Anonymous sourcing from five people familiar; ONCD did not comment; Anthropic declined. Federal-only context, published five months before the Cisco announcement.
- Limitations and uncertainty
- Federal context; anonymous sources; June 2026 and may be outdated; does not assess Cisco's product. Included only for governance context tied to the Nov. 9 announcement.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Vendor claim
- A supplier-provided assertion that has not been upgraded to independent evidence.
- Independent reporting
- Independent reporting with attributable sources but without a formal evaluation design.