Cisco, which provides networking and security infrastructure for organizations, is combining its extensive network telemetry with OpenAI models to make defenses more adaptive to machine-speed threats. The company argues that as attackers use AI to scale automated attacks and create exploits quickly, defenders must leverage similar capabilities to keep up.
OpenAI’s enterprise privacy model — emphasizing zero data retention, strict customer data boundaries, and verifiable isolation — gives Cisco confidence to deploy frontier AI across mission-critical systems without exposing customer priorities or sensitive telemetry.
Defense at the network layer
Cisco’s approach focuses on the network as the primary battleground. Patel describes a move away from a single security perimeter toward controls distributed across microservices, containers, and clusters. “We can put a mini security stack in front of every microservice, every Kubernetes container, and every Kubernetes cluster, and fuse security into the fabric of the network,” he says.
Application-level controls can limit each service to only the connections it requires, reducing the paths attackers can use for lateral movement. Security teams can isolate compromised systems more selectively, allowing unaffected services to continue operating while investigations and responses proceed.
Correlating signals at machine scale with AI
By combining network intelligence with OpenAI’s models, Cisco says it can correlate signals at machine scale. “Two signals might seem benign in isolation, but together they can reveal a meaningful pattern. Network intelligence allows us to correlate data across the network and derive insights to inform secure operations,” Patel notes.
He highlights a persistent challenge: the gap between how fast attackers can exploit a vulnerability and how long organizations take to patch it. Patel sees AI as a tool to narrow that gap by enabling teams to investigate more threats and respond faster. “AI hands attackers speed and scale. Using AI for defense is a prerequisite for staying safe,” he says.
Initiatives and integration with existing workflows
Patel points to initiatives such as Daybreak and GPT‑6 Astra as advances that bolster security for Cisco and its customers. “We’re able to find and patch vulnerabilities more efficiently, while shortening the time needed for investigation, response, and remediation,” he says.
He envisions adoption that builds on existing vulnerability-finding and remediation processes, so teams do not need to fundamentally change their workflows to use these capabilities.
Autonomous agents, telemetry, and three priorities
As agents become more autonomous, security teams must distinguish malicious interference from an agent pursuing a legitimate goal in an unintended way. Patel argues that requires security telemetry alongside observability data so teams can assess both threats and agent behavior.
He outlines three priorities: protect agents from malicious attacks, detect and intercept unintended behavior, and operate in near real time. These priorities are driving the move toward policies and controls that can adapt as agents act.
Daybreak Defense Network and Cisco Cloud Control
Through the Daybreak Defense Network, Cisco and OpenAI are exploring how to help security teams triage exposures faster and enforce appropriate controls through Cisco Cloud Control. For Patel, these efforts can help shift the advantage back to defenders.
Overall, Cisco aims to reduce response times, increase investigation efficiency, and enable application-level adaptive controls by marrying its network telemetry with frontier AI while preserving customer data protections.
