Strategic PartnersLatest editionIssue 11
Cisco
Cisco Live APJC (Melbourne) coverage tonight centers on constraints rather than outcomes. Independent reporting shows Cisco Cloud Control is still U.S.-only (Australia/EU/UK Feb.
Full research summary
Cisco Live APJC (Melbourne) coverage tonight centers on constraints rather than outcomes. Independent reporting shows Cisco Cloud Control is still U.S.-only (Australia/EU/UK Feb. 2027), that customers allow autonomous network actions only for low-risk fixes, and that Splunk's agent-evaluation claims depend on customer-defined standards. An independent analyst note shows Cloud Control's Splunk integration is limited to Splunk Cloud on U.S. commercial AWS, and Cisco's own Omdia survey headline (51% agentic AI in production) conflicts with its per-process data and a 5% figure cited on stage. For research universities, the Cisco-backed NIIN sovereign AI cloud in Australia reached prototype with sensitive-data use cases but no outcomes. No new U.S. SLED Cisco AI deployment results were found.
Read the edition Previous: Issue 10, November 9All Cisco editions
What this stream covers
Cisco AI networking, collaboration, security and infrastructure platforms. Separate vendor claims from independent deployments, benchmarks and limitations. Explain Government/Education applicability where supported, without forcing irrelevant news into a SLED use case. Dedicated security vendors belong in their respective streams.
- Evidence records
- 7
- Cross-source patterns
- 2
- Also published November 10
- AnthropicAWSCampus OperationsCitizen Engagement & ServicesCrowdStrikeDellEmergency ServicesEverpureGoogleHealth & Human ServicesK–12Local GovernmentMicrosoftNetAppNVIDIAOpenAIPalo Alto NetworksPublic SafetyRed HatResearch UniversitiesServiceNowState GovernmentStudent SuccessTransportationUtility ManagementVAST Data
- Subscribe
- Atom feed for Cisco
What the evidence supports, and what it leaves open
2 patterns this edition will stand behind, each carried by at least two independent sources. Every one arrives with the question it has not answered.
- Agentic network-operations adoption claims diverge from the bounded autonomy customers actually grant
Operating questionWhich specific network actions would you allow an agent to take without approval, and what local baseline will show whether that is working?
- Cisco's agentic platform value is gated by regional availability, cloud stack and integration scope
Operating questionWhich of your data sources and agent platforms are connected to Cisco's agentic tooling today, rather than promised on a roadmap?
Research through your lens
Every resource includes source evidence and takeaways for all three roles.
Evidence in this micro-vertical
55 resources
Follow the outcomes
55 resources across outcomes in your selection. Counts include all outcomes.
Refine by evidence type and topic
- Source
- Cisco
- Published
- 2026 (PDF undated; file metadata indicates creation July 2026 and modification Sept. 2026)
Cisco/Omdia 'The Impact of Agentic AI on Network Operations' (2026): vendor-commissioned survey claims 51% run agentic AI in production NetOps, yet per-process use is 14–18%
The report states Omdia surveyed over 1,000 IT and network operations leaders at organizations with 500+ employees across North America, Western Europe and Asia-Pacific, supplemented by Cisco Meraki telemetry analysis. It claims 51% are running agentic AI that takes action in production and 84% expect an AI-led operating model within 12 months, while its own process-level chart shows only about 14–18% using agentic AI today for any single NetOps process (e.g., 18% remediation actions). It reports 46% of network alerts are closed without investigation that 67% say the generative AI boom significantly increased network complexity, and that 70% say AI adoption increased NetOps workloads.
Limitations & uncertainty
Vendor-commissioned; no public-sector breakdown; definitional gap between headline 51% and process-level 14–18%; undated PDF, so publicationDate is null.
- Source
- Splunk Agent Observability Docs
- Published
- Undated documentation page (retrieved November 10, 2026 UTC)
Splunk Tokenomics documentation: costs are vendor-reported or estimated and not independently audited; daily refresh, no backfill, bot accounts counted
Splunk's own Tokenomics documentation says the feature uses each AI vendor's reported or estimated cost and activity data and does not independently audit or recalculate spend or token counts. It does not identify or exclude headless, bot or service accounts; data refreshes daily at 12:00 a.m. PDT; late provider data is not backfilled; GitHub Copilot cost can show $0 while included credits remain; workforce filters require an imported org chart. Supported coding-tool providers are Codex, Claude Code, Cursor, GitHub Copilot and Windsurf.
Limitations & uncertainty
Undated page; covers the coding-tool Tokenomics surface; the AWS Bedrock/CloudWatch ROI extension announced Nov. 9 is in preview and may document different behavior.
iTWire: Cisco Cloud Control, GA in the US since Aug. 25, targets a sovereign Sydney instance in Feb. 2027 with five or six Australian beta customers; Model Foundry GA slated June 2027
iTWire reports Cloud Control reached U.S. general availability on August 25, 2026, with an Australian sovereign instance in Sydney targeted for February 2027 alongside the EU and UK, and Japan, India and Canada in May. Cisco is working with five or six Australian beta customers. ThousandEyes in Wi-Fi 6E/7 APs with eligible licenses targets general availability in December 2026; Experience Metrics became GA in Meraki Dashboard on Nov. 9. Model Foundry (controlled availability, partners first, optional fine-tuning on customer data) is slated for GA in June 2027. Schultz cited OpenRouter data that agentic API keys used about seven times the tokens of human keys in late September.
Limitations & uncertainty
Timelines are targets; the article mixes 'Cisco Live Melbourne 2027' wording with 2026 dates (editorial inconsistency). Australian focus; U.S. state data-residency needs are not addressed. OpenRouter token data is a third-party service sample, not network telemetry.
- Source
- iTWire
- Published
- 11 Nov 2026 (AEDT); 2026-11-11T00:07Z, i.e. Nov. 10, 2026 evening U.S. Central
iTWire: Cisco-backed NIIN Sovereign AI Cloud reaches live prototype with four university research use cases; production criteria, funding and access still undecided
iTWire reports that NIIN's Cisco-infrastructure Sovereign AI Cloud is now a live prototype (with partners Xenon and Sharon AI), with the University of Queensland announced as a second node. Four use cases test requirements: a UTS emergency-services AI/cyber testbed that currently trains on single-GPU desktops, Curtin mining hazard vision with identifiable images, RMIT/Austin Health de-identification of identifiable health records, and UQ enzyme discovery on commercially sensitive data. Production is the next phase; Cisco's Stefan Leitl said production criteria, funding and access arrangements will decide that move.
Limitations & uncertainty
International prototype; no measured outcomes. Relies on vendor executive statements. U.S. transferability is limited by different research-data regulation (HIPAA, FERPA, state privacy laws), funding models and procurement rules.
- Source
- iTWire
- Published
- 11 Nov 2026 (AEDT); 2026-11-11T02:40Z, i.e. Nov. 10, 2026 evening U.S. Central
iTWire: Cisco's Joe Vaccaro says customers permit autonomous agent actions only for low-risk fixes such as VLAN mismatches, port bounces and AP reboots; agents must show evidence
Cisco SVP Joe Vaccaro says customers already allow autonomous actions for issues such as VLAN mismatches, port bounces and access-point reboots, but more advanced autonomy carries a different risk profile, so agents must show the signals, evidence and workflow behind a fix. Cisco's AgenticOps sequence is sense, locate, plan, validate, deploy, using deterministic execution workflows from customer policies, digital-twin testing before changes and ThousandEyes checks after. He cites Cisco/Omdia research that 46% of network alerts are closed without investigation, and suggests engineers document expertise as Markdown skills while enforceable permissions and approvals remain separate.
Limitations & uncertainty
Vendor executive opinion; 'customers' unnamed; digital-twin capability is described as what 'the system will use' (future tense). Omdia figure is vendor-commissioned.
- Source
- iTWire
- Published
- 11 Nov 2026 (AEDT); 2026-11-11T00:35Z, i.e. Nov. 10, 2026 evening U.S. Central
iTWire: Splunk Tokenomics and Eval-G1 aim to show whether AI agents earn their keep; usefulness depends on customer-defined standards and evaluator performance
iTWire describes Splunk's Tokenomics (cost-to-outcome view) and Eval-G1 small evaluator models with Evaluation Tuner. It reports Splunk's claims of 2.5x faster responses than LLM judges and accuracy of up to 95%, and Cisco's claim of up to 98% lower evaluation cost, while noting usefulness depends on the standards supplied and evaluator performance on actual work, and that customers must define what makes work worthwhile. It cites Splunk's State of Observability 2026 (Oxford Economics, 2,050 IT operations/engineering professionals in 10 countries, Feb–Mar 2026): 55% could not control AI costs; 60% said billing spikes caused more strain than baseline costs. Agent Launchpad access via Codex and Claude Code is scheduled for November.
Limitations & uncertainty
Accuracy and cost claims are vendor-stated; 'up to' qualifiers; survey not public-sector specific; preview/GA timing per vendor.
Network World (ZK Research): Cisco Live Melbourne frames agentic AI as a network problem; Cloud Control still US-only, lock-in skepticism, conflicting readiness figures
Kerravala summarizes Cisco's Melbourne keynote: ThousandEyes telemetry added to Wi-Fi 6E/7 access points at no extra cost for eligible Networking Essentials/Advantage licenses; Cloud Control as the 'single front door', with Schultz saying no new Cisco product ships without Cloud Control integration; Cloud Control available only for US-based infrastructure, with Australia/EU/UK in February 2027 and Japan/India/Canada in May. Cisco executives cited IDC data that 9% of regional organizations feel networks are fully ready, and research that 85% experiment with agents but only 5% deploy to production. The analyst agrees with the thesis but says lock-in-concerned customers will be skeptical and the open-ecosystem story is unproven.
Limitations & uncertainty
Analyst provides services to vendors (disclosed bio describes advising vendors); no hands-on testing; statistics are second-hand from keynote; private-sector customer examples only.
- Source
- Cisco Newsroom
- Published
- November 9, 2026 (U.S. newsroom date; dateline Melbourne Nov. 10)
Cisco adds Anthropic Claude Mythos to AI Defense adaptive red teaming, extends Splunk Tokenomics to AWS agents and feeds Cisco IQ exposure data into Splunk (vendor announcement)
Cisco says AI Defense's adaptive red teaming will add Anthropic's Claude Mythos to generate multi-step, system-specific attacks against customers' own AI apps and agents, restricted to registered and authorized targets, tied to a named operator, time-bound, revocable and audited, with no open prompt access. Mythos red teaming is 'coming soon for select enterprises'. Splunk Tokenomics will pair agent cost (Amazon Bedrock/CloudWatch usage) with quality evaluations and customer KPIs (private preview December, AWS Marketplace GA early 2027); Eval-G1 evaluator models and an evaluation tuner are GA this month. Cisco IQ vulnerability, lifecycle and configuration data will flow into Splunk via Cisco Data Fabric, with MCP and ServiceNow connectors.
Limitations & uncertainty
Announcement-only; timelines explicitly subject to change. 'Hundreds of customers' (press release) and '400 to 500' (CRN interview) are vendor numbers. Accuracy claims for Eval-G1 differ across Cisco/Splunk pages ('high accuracy' vs. 'up to 95%'), and Tokenomics preview timing differs between Splunk pages (November vs. December). No public-sector authorization status stated.
CRN: Cisco says partners can use Mythos through AI Defense to red team client agent rollouts; AI Defense has roughly 400 to 500 customers
CRN reports Cisco runs Mythos in a sandbox with control over what it can access, how it executes and how its sub-agents are spun up, and that partners can use Mythos through AI Defense to red team every client environment rolling out agents. Cisco says AI Defense has approximately 400 to 500 customers since launch, now supports Amazon Bedrock and CloudWatch for token-spend/ROI dashboards, and sits within Cisco Cloud Control. Availability remains 'coming soon for select enterprises'.
Limitations & uncertainty
Interview-based; customer count is vendor-stated and unaudited; 'every client environment' is aspirational partner positioning. Dates, scope and regions subject to change.
Cyngor Gwynedd (Wales) retires 16-server phone system for Webex Calling and Contact Center, reports 175,000 calls a month at 76% answer rate, and begins exploring AI agents (vendor case study)
Cisco reports that Gwynedd Council replaced a decade-old, 16-server on-premises telephony system with Webex Calling, Webex Contact Center, Cisco devices and Control Hub, integrated Cisco Call for Microsoft Teams for 1,700 users, and localized the Webex app, Control Hub and desk phones in Welsh. It now manages 175,000 calls a month at a 76% answer rate. AI is at an early stage: the council is exploring AI-driven agents and citizen self-service through workshops with 50 employees across education, social care, highways and other departments.
Limitations & uncertainty
Vendor-authored marketing; no baseline for the 76% answer rate; UK procurement and regulatory context; AI agents not yet deployed, so no AI benefit claims are supported.
- Source
- The Register
- Published
- November 10, 2026 00:00 UTC (November 9, 2026 evening U.S. Central)
The Register: Cisco exposes Mythos functionality inside AI Defense under existing licenses without giving customers the model; IBM follows with Concert
The Register reports that Cisco AI Defense red teaming will be able to call Anthropic's Mythos to test customer setups, and that Cisco will offer it under users' existing licenses at no additional cost. It frames Mythos as a model whose distribution has been controlled (Project Glasswing) because it could help attackers, notes the Cisco deal exposes functionality without model access, and reports IBM announced a similar Concert integration hours later. Anthropic says demand has created a long queue of buyers.
Limitations & uncertainty
Pricing statement ('without additional cost') is vendor-stated and may change; availability is still limited to select enterprises per Cisco. The article's Mythos 5.2 pricing details concern Anthropic's direct API, not Cisco's product.
Cisco IT says its multi-tenant enterprise AI factory tripled GPU utilization to ~50% and hosts MyAgent plus Cisco IQ at 99.99%+ SLA
Cisco IT describes moving from project-specific GPU silos to a pooled multi-tenant AI factory after MyAgent rollout to 90,000 employees and Cisco IQ production hosting. Self-reported results: GPU utilization from ~15% to ~50% (peaks ~80%); active GPUs from ~250 to 1,568 without new real estate via rear-door heat exchangers; preference for ~80% steady-state inference on-prem; 99.99%+ SLA for MyAgent and Cisco IQ. Stack cited: Silicon One fabric, UCS-X with NVIDIA/AMD GPUs, Cisco AI Defense runtime guardrails, planned Hypershield segmentation, Live Protect on Nexus, Splunk Observability/Cloud/ITSI with Agent Observability and Tokenomics still expanding.
Limitations & uncertainty
Self-reported Cisco IT results; power, cooling and GPU supply assumptions may not hold in typical state data centers; Agent Observability/Tokenomics not finished.
Anton Chuvakin argues AI-era firewalls must judge agent task and delegated authority, not only identity, as AI traffic moves inward
Chuvakin contends autonomous agents expand the unit of risk from session to task, so firewalls must ask whether an actor behaves within delegated authority—not only whether identity and destination are allowed. He highlights inward AI traffic (user→agent→internal model→MCP→app→data), Hybrid Mesh Firewall distribution, virtual patching/SnortML for shrinking exploit windows, structured denials for agents (not silent drops), and an observe→attribute→assess→inspect→enforce→learn loop with coverage proof about what is unseen. No measured customer outcomes are presented.
Limitations & uncertainty
Essay without empirical evaluation; Cisco product references are illustrative; silent on FedRAMP/CJIS specifics.
Cisco Partner Summit 26 pitch: close the agentic trust gap with security, Splunk observability guardrails and tokenomics/ROI visibility
On Nov. 5, 2026, Cisco’s Partner Summit recap says partners must close an agentic “trust gap” by combining three pillars: security (including Cisco AI Defense and the Splunk-powered Cisco Data Fabric), observability (operational guardrails for autonomous agents with transparency and human oversight), and tokenomics/ROI visibility so AI spend maps to business value. The post frames early agentic adoption and partner services revenue; it does not publish customer measurements or SLED deployments.
Limitations & uncertainty
Partner marketing; no performance data, pricing, entitlement mapping or SLED examples.
iTWire: Splunk ANZ leaders say Tokenomics, Galileo evaluation and Cisco network intelligence are needed to move agents out of pilot
On Nov. 5, 2026, iTWire reported interviews with Splunk ANZ executives describing a shift from capability demos to proving agents operate reliably, within policy and at acceptable cost. The article details Tokenomics attribution by request/model/agent/workflow with thresholds; Galileo evaluation and guardrails (including a vendor-told Fortune 500 bank accuracy lift from 90% to 95%); Cisco network intelligence bringing Meraki, Catalyst Center and SD-WAN Manager topology into Splunk (third-party later); and Cisco AI POD for Splunk for on-premises, private-cloud and air-gapped Splunk AI. Machine Data Lake/Catalog are said generally available in Sydney since Aug. 4, 2026. No U.S. SLED deployments are documented.
Limitations & uncertainty
ANZ interview context; bank metric unverified; third-party topology not yet available per article; no U.S. SLED case.
Splunk GSO Customer Zero: SOC agents cut triage handle time 64% and detection authoring from ~2 hours to under 10 minutes
Splunk’s Nov. 5 post describes its Global Security Organization running as Customer Zero for Enterprise Security agents across three autonomy modes: delegated (triage), guided (Automation/Connector Builder) and bounded (Detection Builder). Measured claims: triage average handle time 15.4→5.6 minutes (64% faster) with zero misclassifications of benign activity in production-like tests; phishing playbook built in 8m31s; detection authoring from ~2 hours to under 10 minutes (~12x), with agent completing 75% of tasks unaided and 90% after prompting. Features tied to ES Essentials/Premier on Splunk Cloud (version gates noted); Agentic Workflow Builder called alpha/under development.
Limitations & uncertainty
Vendor Customer Zero; cloud-only version gates; Agentic Workflow Builder alpha; no external replication.
Saudi HRSD reports in-house Webex Suite/Calling migration to 11,000+ users with custom device monitoring and Virtual Branch citizen services
Webex’s Nov. 5 customer story says Saudi Arabia’s HRSD migrated calling, meetings and messaging from on-prem to Webex Suite and Webex Calling for 11,000+ users (~28% growth from ~8,600), with 662,900 meetings and 20.8M meeting minutes (Sep 2025–Sep 2026) and 400,000+ calls/month. HRSD’s in-house team executed the migration without an external implementer and built a custom API monitoring/backup engine for Cisco collaboration devices. Virtual Branch extends Webex to remote beneficiary services. AI Assistant transcription/translation is under cybersecurity review; Webex Contact Center is being tested pending local availability. Story won a 2026 Webex Customer Award (Bold Explorer: Government & Public Sector).
Limitations & uncertainty
International vendor story; cost predictability claims lack dollar figures; AI and Contact Center still evaluative; not a U.S. SLED deployment.
Cisco says Cisco IQ now exposes production REST APIs and an MCP server, and that scripted tests cut agent tool calls from 256 to 36
Cisco says Cisco IQ, generally available since April 2026 and deployed by over 16,000 customers, now offers production REST APIs and a Model Context Protocol server built from one canonical domain model. Agents connecting over MCP inherit the calling principal's permissions through Cisco Unified Identity, with action-level permissions and validated queries that fail loudly rather than being rewritten. In scripted tests on a 17-scenario benchmark corpus, Cisco reports tool calls fell from 256 to 36 and approval prompts from 181 to 1. Live-agent results are not yet published.
Limitations & uncertainty
Self-reported scripted benchmark; 16,000-customer figure unverified; no SLED examples.
Splunk: scale agents only with cost-per-successful-outcome metrics, Agent Observability guardrails, AI Defense and SOAR-backed response
In a Nov. 4, 2026 Splunk blog, Jeffrey Baez argues executives should track AI agents by cost per successful outcome rather than time saved alone, use Splunk Agent Observability (including Tokenomics for coding-agent spend attribution) and guardrails to block unsafe actions, apply Cisco AI Defense to supported LLM and MCP interactions, and connect suspicious agent behavior into Splunk Enterprise Security and SOAR playbooks with humans in the loop. The article is operational guidance; it presents no measured customer results.
Limitations & uncertainty
No customer metrics; AI Defense coverage limited to supported interactions; SOAR value depends on tested playbooks and reliable identifiers.
THE Journal: Cisco introduces Privileged Infrastructure Access, giving admins and AI agents short-lived, task-scoped, recorded access to network gear
THE Journal, an education-technology outlet, reports that Cisco has introduced Privileged Infrastructure Access: administrators, delegated AI agents and automation scripts get temporary, task-specific privileges tied to cryptographic identity, sessions are recorded, and privileges expire when the task ends. For Cisco ISE and TACACS+ customers it can reuse existing policy and device context for routers and switches, and Cisco says the model extends to servers, Kubernetes and cloud resources. The article notes the Cisco post gives no performance measurements for the workflow. It follows Cisco's Teleport partnership.
Limitations & uncertainty
Restates vendor claims; the comparison with vault-based PAM is Cisco's framing and is not tested against current PAM products.
- Source
- AI Security Platform
- Published
- November 3, 2026 (initial review; last updated November 3, 2026)
AI Security Platform’s Nov. 3 docs review scores Cisco AI Defense 7.6/10, flagging SSE dependency, opaque pricing and missing lab benchmarks
Newly relevant against Nov. 5–6 Cisco AI Defense pitching (Partner Summit residual and AI Factory embedding): AI Security Platform’s Nov. 3 documentation review scores Cisco AI Defense 7.6/10. Strengths cited include MITRE ATLAS/OWASP LLM/Agentic/NIST AI RMF mappings, AI BOM/MCP Catalog supply-chain coverage, free Explorer Edition red teaming and VPC/AI POD options. Gaps: workforce shadow-AI controls require Cisco Secure Access SSE; pricing is private-offer only; some announced features still in development; file-upload inspection, coaching and M365/Google Workspace app governance not documented; no independent detection benchmark; governance scorecard/attestation only partial. Reviewers state no lab access or vendor demo.
Limitations & uncertainty
Docs-only review; scoring rubric is the site’s own; may miss unpublished capabilities; published just before last cisco edition but not previously archived—included for independent scrutiny of current AI Defense push.
OpenAI customer story: Cisco says pairing its network telemetry with OpenAI models (Daybreak, GPT-6 Astra) speeds vulnerability finding and response
In an OpenAI-published customer story, Cisco President Jeetu Patel says combining Cisco network telemetry with OpenAI models lets Cisco correlate weak signals, and calls Daybreak and GPT-6 Astra step-function improvements for Cisco and customer security posture. Cisco and OpenAI are exploring a Daybreak Defense Network to triage exposure and enforce controls in Cisco Cloud Control. The story cites OpenAI zero-data-retention terms. It gives no metrics, timelines, customer deployments or availability.
Limitations & uncertainty
Customer story published by OpenAI; exploratory program; no independent validation; GPT-6 Astra and Daybreak specifics not documented on the page.
TechTarget: Cisco says AI network agents should sense, diagnose and plan, but act through predefined deterministic workflows
TechTarget reports that enterprises are growing more comfortable letting AI change networks without human approval, while networks still need deterministic outcomes. Cisco SVP Joe Vaccaro describes a four-stage framework (sense, diagnose using cross-domain telemetry, plan remediation, act) and says Cisco builds determinism into the action stage through predefined workflows rather than letting agents improvise changes. Alert volume is cited as the driver.
Limitations & uncertainty
Visible text is short; the remainder required newsletter sign-up and was not read. No figures on adoption or outcomes.
Cisco introduces AI Transit to extend existing SD-WAN policy to NeoClouds, private/sovereign AI clouds and AI factories
Cisco describes AI Transit, which lets existing Cisco SD-WAN customers bring AI workloads in NeoClouds, private and sovereign AI clouds and enterprise AI factories onto their fabric, deployed as physical or virtual appliances (as-a-service virtual router in participating NeoClouds). It names Armada, Cirrascale and Latitude as providers and highlights geographic intent for controlling where AI traffic travels. No availability date, pricing, performance data or customer deployment is given; the FAQ tells architects to confirm supported environments and controls.
Limitations & uncertainty
Vendor claim; product status, supported providers and pricing unstated; listed providers are not typical SLED contract vehicles.
Cisco says SnortML blocked a novel PHP2Shell exploit attempt within 24 hours of disclosure and Splunk now has 10+ post-exploit detections
Cisco states that in under 24 hours after PHP2Shell (CVE-2026-109618/109619) disclosure, SnortML, the machine-learning engine in Cisco Firewall 10.1 intrusion prevention, caught and blocked a novel exploit attempt in customer telemetry, alongside day-zero Snort signatures. SnortML is on by default only for 10.1 customers using the security-over-connectivity policy. Cisco also says customers have more than 10 Splunk detections for post-exploit activity. No counts of blocked attempts, false positives or affected customers are given.
Limitations & uncertainty
Vendor claim; no metrics; one detection event; day-zero claim not independently verified; AI-accelerated-threat framing is asserted, not evidenced in the post.
Cisco makes generally available a Cloud Intelligence Add-on that brings AI Assistant, AI insights and cloud administration to on-premises UCM
Cisco announced general availability of a Cloud Intelligence Add-on for Cisco Unified Communications Manager. It bundles Webex Calling Professional features, Cisco AI Assistant for Calling (captions, translation, transcripts, summaries, action items), Control Hub cloud administration, Real-Time AI Insights on calling patterns and anomalies, an alert center and AI Canvas troubleshooting, without moving call control to the cloud. Cisco claims lower total cost through consolidation. A footnote says administration features require 60% or more of UCM users to have the add-on.
Limitations & uncertainty
Cost-reduction claim unquantified; admin features gated by 60% user coverage; no SLED references.
- Source
- Cisco Talos Intelligence Blog
- Published
- Cisco Talos blog, Saturday, Oct. 31, 2026, 08:00 (Talos RSS: 12:00 GMT)
Cisco Talos: VOLTA infostealer sends stolen victim data to commercial LLMs through OpenRouter to rank victims by monetization value, with a three-model fallback when a model refuses
Talos researcher Ryan Fetterman describes VOLTA-AUTODOXER, a self-deleting Windows infostealer found through Talos’s CAIRN effort. It steals browser passwords, cookies, payment cards, wallet seed phrases, Microsoft OAuth tokens, SSH and cloud keys, Slack, Discord, Telegram, Steam and Roblox sessions, Wi-Fi passwords and screenshots. It then uses stolen sessions to enrich a profile (for example, searching Gmail receipts to confirm a home address) and POSTs the bundle to OpenRouter with a prompt telling the model to act as “a forensic intelligence analyst drafting a target assessment,” with sections on what the victim is worth and their opsec. The default model is anthropic/claude-opus-4.6, falling back to moonshotai/kimi-k2 and google/gemini-2.5-flash when refusal phrases are detected; temperature is 0.2. A six-slot template suggests a builder sold to customers. All observed endpoints are third-party; there is no actor-owned infrastructure. Sample PE timestamp Aug. 17, 2026; first seen Oct. 11, 2026 (UTC). Talos recommends application control restricting which processes may launch Chrome with --headless (blocking the App-Bound Encryption bypass), alerting on headless Chrome from unknown processes, and hardware-backed credential storage.
Limitations & uncertainty
Vendor research about one sample; Cisco also sells the security products used to detect this kind of threat. Prevalence, delivery and in-the-wild use are not reported. Model names are those hardcoded in the sample and do not show that any provider’s safeguards failed. Published Oct. 31 at 08:00, before the last completed Cisco run began (Oct. 31, 22:06 CT), but not captured by that edition or anywhere in the archive; independent coverage continued on Nov. 1, which is why it appears now.
India Today: Patel says the AI code-rewrite team will hand ownership to Cisco’s core engineers and could speed migration to memory-safe languages
India Today reports a follow-up post on X by Jeetu Patel. He describes the AI code-rewrite effort as a two-to-three-person team meant to “catalyze” change, with ownership of the final product handed to Cisco’s core engineering teams. Patel said the approach could help Cisco carry out more migrations to memory-safe programming languages, and acknowledged that not every experiment will work. The report repeats the 98%/24-month target and the four-week proof period from Fortune. These are claims of intent. No language, product or measured security result is given.
Limitations & uncertainty
Secondary report of an X post; I did not open the post itself. Claims are stated possibilities (“could help”). No products, languages or timelines for memory-safe migration are specified.
Superpower Daily: Cisco’s ServiceNow Control Tower Alliance membership formalizes connectors that already existed; customers should check entitlements and release compatibility
Superpower Daily reports that Cisco’s Oct. 28 founding membership in ServiceNow’s Control Tower Alliance builds on two connectors already available on the ServiceNow Store. One adds Cisco AI Defense-discovered assets to the Control Tower inventory; the other routes AI security detections into ServiceNow for owner assignment and fix tracking. What the alliance adds is process: ServiceNow qualification, certification and integration testing, shared standards for agent identity and guardrails, and joint sales and support. The article concludes that membership does not mean the connectors are new, and that customers should first check ServiceNow entitlements and release compatibility. This is independent context on a Cisco announcement archived in the Oct. 30 edition.
Limitations & uncertainty
Short article from an AI news site; it relies on Cisco materials and Store listings and does not test the connectors. Alliance testing requirements are described at a high level.
WIRED: Talos says VOLTA-Autodoxer uses AI to profile victims and lowers the bar for less skilled attackers, but Talos did not track whether it has been used in the wild
WIRED’s Lily Hay Newman and Matt Burgess report the Talos finding, shared exclusively with their newsletter, with on-record comments from Fetterman. WIRED adds context Talos’s post does not: Talos did not track whether Volta has been used in the wild; the prompt is about 240 words and “carefully crafted not to imply anything overtly malicious”; the stealer’s targets appear geared to younger, very online users; and Fetterman suspects it was built for sale to many attackers. Fetterman argues faster triage lets attackers use stolen tokens before they expire or passwords change, and that advanced capability is reaching less sophisticated attackers. WIRED places this alongside CrowdStrike reports of four hacking groups using AI tools against targets including government entities and health care businesses.
Limitations & uncertainty
Relies on Talos as its only primary source for VOLTA; the CrowdStrike context is a separate vendor claim. No prevalence data. Published Oct. 31 morning, before the last completed Cisco run, but not previously archived; included because it carries the in-the-wild limitation that bounds the Talos claim.
Stream editions
Each edition carries its own synthesis and evidence ledger.
November 10, 20261 edition
November 9, 20261 edition
November 6, 20261 edition
November 5, 20261 edition
November 4, 20261 edition
November 3, 20261 edition
November 2, 20261 edition
November 1, 20261 edition