Cisco unveils network security upgrades for AI-driven threats

Cisco has announced a series of updates aimed at addressing security challenges faced by enterprises in the era of agentic artificial intelligence (AI).

Fusing security into the network

The company is expanding its focus on embedding security directly into networking infrastructure, with a particular emphasis on meeting the changing needs brought about by widespread adoption of AI and increasingly sophisticated cyber threats. The latest portfolio enhancements cover the Hybrid Mesh Firewall and Universal Zero Trust Network Access (ZTNA) solutions, which are designed to deliver improved policy management, greater visibility, and streamlined security operations across hybrid and distributed environments.

According to Cisco, the evolution of the threat landscape — driven by both the adoption of AI in legitimate enterprise contexts and its use by cyber attackers — requires a new level of integration between security and networking. The company's approach centres on zero trust architectures, advanced policy tools, and improved observability for security teams.

"Safety and security are the defining challenges of the AI era — and agentic AI multiplies the risk, as every new agent is both a force multiplier and a fresh attack surface," said Jeetu Patel, President and Chief Product Officer, Cisco. "At the same time, threat actors are already leveraging AI tools to launch more sophisticated attacks than ever. To help IT and security teams fight back, Cisco is reimagining how we secure networks, protect AI apps and models, manage identity, and equip security teams with the AI tools they need to meet the moment."

Hybrid Mesh Firewall enhancements

Cisco's Hybrid Mesh Firewall portfolio now incorporates the Secure Firewall 6100 Series, targeting data centre environments with high performance demands, capable of delivering up to 200 Gbps per rack unit and scalable modular deployment. For distributed branches, the Secure Firewall 200 Series provides advanced on-box threat inspection and software-defined wide area network (SD-WAN) integration, promising up to three times price-performance compared to competitors.

The announcement also includes new enforcement points for Security Cloud Control, allowing unified policy management to cover platforms such as Cisco Catalyst SD-WAN, the Cisco 8000 Secure Router Series, Hypershield-ready C9000 Smart Switches, and Application Centric Infrastructure (ACI) data centre fabrics. The new Mesh Policy Engine provides the ability to define a single intent-based policy that is enforced across both Cisco and third-party firewalls.

This approach is intended to simplify operational complexity for security teams and allow organisations to shift enforcement points as needed, without the need to rewrite security policy with each change.

Universal Zero Trust Network Access

Cisco's Universal ZTNA offering aims to support seamless, identity-driven access for users, devices, and AI agents. With the addition of Secure Access Service Edge (SASE) integration, all Cisco SD-WAN offerings, including Meraki, are now aligned with Cisco Secure Access. This aims to enable optimal branch connectivity while enforcing unified security policies.

The latest release of Duo Identity and Access Management (IAM) turns Duo into an identity broker, supporting passwordless authentication and a proximity verification capability, which will provide phishing resistance without dependence on physical hardware tokens.

Securing agentic AI

Acknowledging the emerging risks posed by agentic AI — autonomous AI agents with decision-making capabilities — Cisco is updating its Universal Zero Trust architecture to address security, identity, and monitoring requirements for these agents. Features include automated agent discovery, delegated authorisation, secure zero trust agentic access, and native support for the Model Context Protocol (MCP). Underpinning this architecture are technologies such as Cisco Duo IAM, Identity Intelligence, Secure Access, and AI Defense.

By unifying these capabilities via the Security Cloud Control interface, Cisco aims to provide comprehensive tools for adopting agentic AI safely within enterprise contexts.

"The AI era demands a transformative approach to security. Organizations need distributed, identity-based, zero trust protection for applications, users, AI models and agents, supported by a unified policy framework," said John Grady, Principal Analyst, Enterprise Strategy Group. "Cisco is in a very unique position to support this with its ability to embed advanced protections directly into the network through innovations like Hybrid Mesh Firewall and Universal Zero Trust Network Access, which safeguard AI models and applications, manage identity, and simplify policy management across distributed environments."

"As AI continues to evolve at an unprecedented pace and new cybersecurity challenges emerge, it's even more important to fuse security into the very fabric of the network," said Chris Konrad, Vice President, Global Cyber, World Wide Technology. "Cisco is redefining security for the AI era with its latest innovations from Hybrid Mesh Firewall to Universal Zero Trust Network Access. This integrated approach will help our customers to prepare for an AI-driven future and achieve better outcomes, by protecting AI models and applications, managing identity, and providing essential tools to combat increasingly complex threats."

Expanded Splunk integrations

Collaborative efforts between Cisco and Splunk are aimed at advancing threat detection, investigation, and response by unifying and enriching data from firewalls, AI defence mechanisms, and application platforms. These integrations will allow customers using Cisco Secure Firewall to access deeper threat insights in the Splunk platform, automate containment actions, and gain visibility into application-layer vulnerabilities through event forwarding from Secure Application to Splunk AppDynamics.

Additional integration through Security Orchestration, Automation, and Response (SOAR) playbooks will allow security teams to automate responses such as isolating hosts, blocking connections, and applying policy controls, with the aim of reducing manual workload and expediting resolution of threats.