Cisco announced on November 9 that it is adding Anthropic's Claude Mythos to Cisco AI Defense, its platform for testing AI models, applications and agents before they reach production. Announced at Cisco Live APJC in Melbourne, the move will let select enterprises use frontier adversarial reasoning to simulate real-world attacks on their own agents, Cisco said AI Defense, launched in January 2025, has already helped hundreds of customers find critical flaws before production.
The Mythos integration sits inside the adaptive red teaming framework in AI Defense, which builds customized, multi-step attacks based on how a target system responds. Cisco said Mythos will generate realistic, contextual attack paths, help identify subtle vulnerabilities across complex architectures, and translate results into new attack ideas for each system. Customers do not get open-ended prompt access to the model. They interact only through the structured interface in AI Defense, every testing action is recorded for audit, and results can be carried over to inform follow-up attack loops.
Cisco stressed the safeguards around that capability. The system operates exclusively against targets that are explicitly registered, owned and authorized for testing by the enterprise customer, and it cannot scan arbitrary internet infrastructure. Every engagement requires authentication and is cryptographically tied to a named enterprise operator. Sessions are time-bound, run against a fixed job and objectives defined by a human user, and can be halted on demand. Product-level controls in AI Defense operate alongside program-level safeguards and monitoring, in what Cisco called dual-layer oversight.
Anthropic's cybersecurity lead, Michael Moore, said enterprises are increasingly building AI agents into their core operations and want to test those agents thoroughly before putting them into production. Cisco President and Chief Product Officer Jeetu Patel framed the announcement as a trust problem, saying organizations cannot scale what they cannot secure, govern or observe. That framing explains why Cisco paired the red teaming news with observability and remediation tools, rather than presenting Mythos as a standalone feature.
The second part of the announcement covers Splunk Agent Observability. A new Tokenomics capability ties agent cost directly to output quality and return on investment in real time, using usage data from Amazon Bedrock and Amazon CloudWatch. Cisco also announced Eval-G1 evaluation models, which it said can run evaluations and guardrails at up to 98 percent lower cost than a commercial large language model and respond 2.5 times faster, and an evaluation tuner that turns agentic traces and expert feedback into fine-tuned evaluator models. The evaluation models and the tuner are generally available starting this month.
The third part connects findings to fixes through Cisco IQ, which Cisco said serves close to 17,000 customers across more than 22 million devices. Cisco IQ vulnerability, lifecycle and configuration data will now flow into the Splunk platform through Cisco Data Fabric, so security teams can correlate live threat detections with underlying network exposure inside Splunk Enterprise Security. Connectors for the Model Context Protocol and ServiceNow will turn exposure findings into asset-linked problem records, and a new playbook surfaces critical lifecycle vulnerabilities, including alerts for known defects and quantum-safe cryptographic readiness.
The pieces arrive on different schedules. Adaptive red teaming with Claude Mythos is coming soon for select enterprises, with no general availability date announced. Tokenomics enters private preview in December, with general availability in AWS Marketplace in early 2027. For enterprise teams deploying agents connected to sensitive data, testing, cost control and remediation now have to operate as one continuous loop at machine speed.