# Securing Agentic AI at Enterprise Scale

**Podcast:** Chain of Thought | AI Agents, Infrastructure & Engineering
**Published:** 2026-10-29

## Transcript

We've deployed this inside of Fortune 100 companies.
They're giving us a ton of feedback about the kind of guardrails that you need, whether it's PII, PCI data, whether you're operating with specific types of tool poisoning or somebody's trying to hijack your context window.
They're trying to do some memory attacks.
Cisco is giving every one of its 90,000 employees an AI agent.
Meanwhile, some of those same employees are connecting agents from outside of the security boundary without asking IT.
The security model for the agentic enterprise has to handle both.
Welcome to Chain of Thought.
I'm your host, Conor Bronsden.
Great to see you.
Cisco has spent the last year betting that agents will run alongside people across IT, security, engineering, marketing, every department, and that the company has to prove it on itself.
Today, we get the inside view here at Cisco's offices in San Francisco.
Joining me is DJ Sampath, the general manager of AI software and platform at Cisco and at SVP.
DJ, thank you so much for having us here.
Hey, thanks so much for having me.
It is actually our pleasure, I'll say, because I think Cisco's rollout of personal agents is so fascinating.
It's one of the most scale rollouts in the entire world.
And I want to understand...
What has to be in place for a company like Cisco to be comfortable with this kind of role, given your security background?
Listen, first of all, I think you need a fundamental mindset shift in terms of saying you can leverage AI to be able to do valuable work.
From a mission statement perspective, what we're trying to articulate here is to say, hey, every single thing that we do is to be able to drive towards that mission of, hey, can we leverage AI to be able to do?
valuable work.
And we have a phenomenal IT team that said, listen, we're up to that challenge and let's go out and let's try this out.
Historically, you'd see IT teams kind of struggle with like, oh, this feels hard or this feels like we're not ready.
We should wait and watch.
But at Cisco, we have an unbelievably forward-thinking IT team that said, you know what?
Game on.
Let's make this happen.
But they did need a certain sort of requirements.
They wanted to make sure that, hey, we need to secure every single prompt that's coming in and out.
We need to make sure that there's the appropriate sandbox that we provide to these agents so that these agents are not going rogue.
And we needed to make sure that, hey, your agent is separate from my agent.
You know, it's funny, we call it my agent.
It's called Cisco My Agent.
But we want to make sure that each one of our agents are separate and they're in a multi-tenancy from the get-go.
So, you know, things are not getting unnecessarily, you know, polluted by the context and memory that you are, you know, having that you may not necessarily be sharing.
We also had to reimagine, like, how do we start to think about, like, you know, agents collaborating with each other?
So a number of different steps we had to get through, but I think the most important one was to make sure that each individual brings their skills in.
If they are looking at, say, a GitHub repo and they're grabbing a skill and they're throwing it in, you got to make sure that those skills are appropriate.
The skills are not malicious, they're not vulnerable.
So you needed a skill scan, right?
You also needed to make sure that you're scanning the tools that you're using because every single one of these agents are calling tools to be able to...
access an API, get credentials approved.
And identity is sort of a very, very important thing when you start to think about how these agents are going out and starting to operate.
So the important thing that the team did was to be able to lean on a bunch of different frameworks that we've already put in place.
So we sort of saw this coming in some ways.
So like in 2024, we announced this product called AI Defense.
So Cisco AI Defense is sort of a product that looks at the entirety of your supply chain.
It looks at models, understands, if models are vulnerable because models could potentially have been trained on something that's malicious.
So you want to algorithmically red team these models because guess what?
There are no CVEs for models, right?
I mean, you look at a vulnerable package.
By the way, yesterday was a, oh my God, what a day.
So CVEs are going to start showing up every single way you look at it.
But with models, it's so hard because there are, you know, billions, if not trillion, parameter models.
And so the only way that you figure out what's really going on is to algorithmically ret-team these models and figure out what those gaps are.
But beyond that, as part of AI defense, we said, hey, we're going to have to build guard routes.
At runtime, you want to make sure that these don't get accidentally prompt injected.
You know, one of the things that happens when you think about a personal agent, or even if it's an agent that you're bringing from the outside, the very first integration that you end up doing is to connecting it to your emails.
All right.
Do you use Muse or Instinct?
I have tried Muse.
I've tried Instinct.
I've tried GrokBot.
I've tried a little bit of Dot.
All right.
Nothing stuck with me yet except for GrokBot has, I have to admit.
Okay.
All right.
I'm a Muse fan.
Okay.
Interesting.
Yeah.
And more recently, ever since Dot's got announced because of the fact that it seamlessly connects to my ecosystem inside of Codex.
It's starting to really stick.
But I think one of the interesting things that you probably notice is as soon as you got your GrokBot, you probably connected it to your emails and your calendars.
And so think about it.
I come from an email security company.
I sold an email security company to Cisco.
I was a founder, CEO of Armor Blocks.
And I think about emails a lot, a lot more than a normal person would.
And so inside of an email, if I were to send you an email right now that had a prompt injection, it just simply said, Hey, Connor, great to meet you.
And in complete white colored text at the bottom of my signature, I put in a prompt injection attack.
Your agent's going to read that.
It's true.
So it becomes incredibly important when you start thinking about these agents, what kind of guardrails do you have in place to be able to secure them?
And so that was a big part of the conversation with our IT team as well, saying, hey, we built this thing at Cisco AI Defense.
We've deployed this inside of Fortune 100 companies.
um they're giving us a ton of feedback about the kind of guardrails that you need whether it's pii pci data whether you're operating with like you know specific types of tool poisoning or somebody's trying to like you know hijack your context window they're trying to do some you know memory attacks by the way we've seen crazy amounts of attacks in the wild that are targeted at these ai systems and then compromising and getting these ai systems to respond back in ways that um you know the world's not fully understood, you know, the extent to which these systems can be, you know, made to do things.
So we put together an AI research team to be able to understand all of these things.
Now, the very first thing we had to solve for before we even got here was to be able to come up with the right kind of taxonomy to be able to describe these issues.
Hey, you know, what is tool poisoning called as?
What is, you know, we've always had this with regular security stuff.
You know, if you remember the OWASP top 10.
These were like nice bullets of like, hey, here are the things that you care about, cross-site scripting, you know, you cared about SQL injection attacks, all of those things.
We needed a taxonomy for the industry to be able to start talking about this effectively together.
So we put out a website.
If you go search for Cisco AI safety taxonomy, you'll see that it's public, it's open.
And we collaborated with NIST, MITRE, OWASP that really gave confidence to our IT team to say, hey, wait a minute, A, you have the right taxonomy, B, you've built, you know, things that help us understand the supply chain.
See, you've got the guardrails in place.
Let's take all of these pieces.
And then on top of it, from an agentic perspective, we open source a project called Defense Claw.
If you haven't tried it, you should try it.
I actually have.
Oh, you have?
Oh, that's amazing.
I'm a big fan of a lot of Cisco's open source work.
I have contributed to the agency project for multi-agent orchestration.
So I really have been impressed with some of the open source work you all have been doing.
And I hear you have some new news on that, too, to maybe share with us.
Yes, there's something really, really cool that we're working on.
And it's sort of like...
ties all these pieces together, right?
I think we've been so deep in terms of understanding, you know, what are the things that we need to do to make sure that these agents are behaving the way that they should, you know, making sure that you can delegate actions to these agents in a trusted fashion.
You know, we've been very thoughtful about some of that.
you know, work.
As you probably know already, you know, we made a number of acquisitions in the space.
We acquired this company called Galileo.
I was at Galileo, actually.
So I left shortly before Cisco acquired Galileo.
Hang on a second, time out.
And I would be remiss if I didn't give a quick thank you to our sponsors this episode, VIX, Lawless Memory, Ingest, our season presenting sponsor of Chain of Thought.
And thanks to Wisdom AI, the agentic analytics platform for trusted enterprise intelligence.
And I will say, by the way, I've been really impressed by the thought process that Cisco has been taken in general.
And like I said, I've enjoyed the open source work, but I loved the metaphor that.
due to Patel used on this show when he came on the president and CPU of Cisco.
If you haven't watched that episode, check it out.
Or he calls agents unruly teenagers that need guardrails and rules.
And I think I hear that from what you're saying, not only because the agents will go out and misbehave, but also because people will attack them and they may not have the knowledge of the world that they need to adjust to that.
That's exactly right.
They don't understand consequences, right?
I mean, as humans, a lot of times there's a anthropomorphization of agents that says it's exactly like humans.
But the reality is it's more like teenagers, you know, that you give a credit card to and say, you know, don't, you know, don't spend it on crazy things.
But, you know, what is the definition of crazy?
It's very hard to define it with a teenager, you know.
And so it's a lot like that with these agents.
They've got very little amount of understanding of consequences.
So like you mentioned, from a context perspective, so it's really important to understand.
Are they doing the things that they said that they were going to do?
And so evals becomes a really core important part of this.
And as we looked at the market and we said, hey, who are the best people to be able to go out and solve for these things?
Vikram, Yash, and Athen were like phenomenal people that are now driving that inside of Cisco.
And so when you look at that whole spectrum of, hey, how do we secure AI?
How do we start to think about the models, the red teaming part of it?
We acquired a company called Robust Intelligence that brought in some amazing talent over there.
And then we said, hey, how do we think about evals as we evolved the guardrails?
And that's how we acquired Galileo.
But we also recognize that identity is a huge part of this story, right?
How do we make sure that these agents, when they're acting on behalf of you, they're doing the right types of things?
When these agents are acting autonomously by themselves, are they using system accounts the right way?
And so we acquired this company called Asterix, which is a phenomenal company, Asterix Security.
And, you know, they've been thinking about non-human identities for a very long time.
With agents, that becomes really front and center.
And we've already had a good book of business from Duo and Identity Services Engine.
So it made sense for us to be able to say, listen, we understand this really well.
But when you start putting all of these pieces together, we have arguably the most comprehensive way of being able to understand an agentic view, like agent behaviors.
And that's really what unlocked, you know, the kind of success that we're seeing with.
the rollout of 92,000, 90 plus thousand agents to our employees.
But one of the things that we've noticed is that the open source contributions that we've been doing, they've been extremely well-received.
Like we have over 5,000 plus GitHub stars on the AI defense projects, you know, collectively.
And so we recognize that there's now a moment in time where we have to step up and say, hey, how do we start to describe the behaviors that you want an agent to take?
in a very prescriptive way that the agents themselves understand that that is sort of their scope of what they need to perform.
So we basically said there needs to be a domain-specific language that describes these agentic behaviors.
And that's sort of what we're launching as an open source initiative.
And that's the news that you were referring to.
It allows us to be able to do really interesting things because when you describe that, hey, here's what you love to do.
It suddenly changes the agent's behavior when it has a certain amount of token budget.
And it says, okay, you know, I say, for instance, that the agent wants to self-sacrifice itself for the larger good.
Ah, like kind of like the meter investigation of open-air agents into the Hugging Face hack.
That's right.
You can now basically define a policy in a DSL that says, hey, that is not an acceptable thing.
And it's going to define how the agent looks at that and goes, wait a minute, these are the set of instructions.
that I have, in addition to the goal that I have been given right now to be able to go out and execute, my policy prevents me from doing this.
So we expect that, you know, the DSL is a way that you can describe these agent behaviors.
We're hoping that this basically is something that we can share with other industry partners to be able to help define these things, researchers, security researchers, you know, folks that are building, you know, operators, get them all together to be able to say, hey, provide that specification.
and help everybody start to understand that your agents can be governed a lot better when you start using this domain-specific language.
Season four of Chain of Thought is presented by Ingest.
Long-running agents need endurance.
They must endure waiting for users and weather tool failures.
They must take each new jump in model intelligence in stride.
Ingest makes long-running agents durable, observable, and improvable over time.
Check out their generous free tier and a sleek local dev server for testing your workflows.
Grab the ingest link in the description or visit ingest.link slash C-O-T dash pod to get started.
Build for the long run with ingest.
I'm really excited to check this out because, you know, something I've talked about on my newsletter on the show is the preponderance of various coding agents I'm using across multiple model families.
And governance and orchestration are huge challenges.
You know, it is really cool to see the advancements happening in the open here.
So very excited to try this out.
And I will definitely link this in the show notes of people who are listening and want to give it a whirl or just read a bit about what Cisco's up to here.
Apple can consume it.
But I'd love to frame this a bit more.
So we're talking a lot about agents and how to govern them and why that matters.
And obviously you're learning a ton of lessons, it sounds like, from this rollout of personal agents across Cisco.
What are these personal agents doing at Cisco?
What's the actual work that they're achieving?
You talked about being mission-driven and value-aligned.
How are personal agents being used at Cisco today?
Yeah, one of the big things we discovered, you know, the primary goal was just to be able to...
allow people to like you know first retrieve information our initial hypothesis was that hey people are going to want to retrieve a um a presentation or a document or a prd you know and so make it easy for them to be able to ingest this inside of an agentic framework ask questions so that they don't have to keep copy pasting these files into different harnesses uh however what we learned very quickly um where people started really using this um was the minute i think the teams activated a cron job the ability to actually execute a schedule task I know that sounds very obvious when you think about it, but it's sort of one of the basic functions that we start using it for like daily briefs and like summaries at the end of the day for meeting notes.
I think one of the biggest unlock that happened was a lot of times at work were in meetings, right?
And in the case of Cisco, we're doing a lot of WebEx meetings, right?
And so every single one of these WebEx meetings now has the ability to get transcribed.
And at the end of the day, when you have an agent that can hook into that over APIs, collect all of the notes, take all of the actions, summarize it for you, and keep track of those actions so that you know which ones you've completed, which ones you have not, reminds you as part of your daily brief, man, that just changed the way we thought about productivity inside.
And DJ, I do have to admit here, as much as I am a fan of the security work being done at Cisco and the open source work with agent orchestration, I'm not a big WebEx guy.
I'm more of a Google Meet guy.
I'm hooked into my Gmail.
You'd be shocked how good WebEx is.
It's been a couple years.
I think you should try it out.
We have arguably some of the best devices.
Now I'm just going to go ahead and pitch.
Anytime somebody tells me this, I got that.
All right, next question.
Listen, we have arguably some of the best devices, like the quality of the devices, the microphones.
We use AI to be able to do like...
automatic framing of people depending on where you are into the conference rooms.
Noise cancellation is off the charts.
It's one of the best on the planet.
And it's really simple to use.
And, you know, by the way, our devices support Teams and Slack and like, you know, Zoom.
You know, no other device out there does that.
So we're pretty cool.
Okay.
And so you're connecting these devices and all the inputs and outputs from them to these personal agents so people can ingest meeting notes and have actions tracked.
What are other use cases you're seeing from personal agents throughout the organization?
One of the biggest things that we're seeing from the engineering side of the house is they're using this to be able to track their, you know, the work out, but like, hey, which JIRA tickets are getting solved?
They're hooking up these agents to their Codex agents.
And so as they're looking at like, hey, there's a pull request that's coming in.
Hey, can you tell me like, you know, what are the biggest sort of changes?
And so a lot of people initially thought that Codex was sufficient, right?
I could just use Codex.
But then came the issue of like, hey, how do I do this remote management of codecs?
And as much as the remote options that Codex natively provides is good, we had concerns around like, how do we make machines accessible over VPN?
My agent solved a lot of that part of the problem.
So engineers are using that for that purpose.
Non-engineering staff is using it for creating like presentations.
The most interesting thing that we've seen people use it is to be able to create like dashboards on the fly.
hey, what is just happening with the latest pipeline?
Tell me where we are in this quarter, how many deals have closed, what kind of customers, give me a quick information about this customer that I'm about to go out and meet.
And so it's hooking into Salesforce at the back and it's pulling in information that tells them exactly what is the last most recent touch and what happened to that customer.
And so I think we're starting to see the usage.
The way I know this personally is like, well, this rollout was happening.
My team is responsible for securing the use of it.
And so the number of tokens that we were starting to see flow through this on a weekly basis skyrocketed from like, you know, a small number of tokens to like two trillion tokens in a single week.
And so they're using it for pretty much any use case that you could imagine.
It's currently being used for that.
And again, these are very obvious use cases, but we're unlocking them with company proprietary data, which I think makes all the difference.
I want to ask about Codex in particular because as we speak, we're what, a block, two blocks from OpenAI offices.
And my understanding is that Cisco was an early design partner on Codex Heteri.
But access helped shape this incredible product, which by the way, insane that it only came out in February.
Yeah.
Just mind-blowing how much progress has happened this year.
OpenAI's case study with Cisco wrote that more than 95% of new AI features at Cisco are being shipped with Codex.
What does a human engineer's day look like now with personal agents connecting their codex instances?
How has this all changed over the year as you've gone from design partner and maybe helping shape the early pieces of product to now securing this ever-evolving scope of agents that are also leveraging codex to code?
You know, when we got started with the OpenAI team, it was phenomenal.
Their willingness to like say, hey, listen, this thing is super early.
It's probably going to break, but would you like to test it out?
And the response from Cisco and my team has always been yes, and.
We completely recognize that this is early, but what that resulted in our conversations with them and working closely with them was that it was the lived experiences of the team members inside of OpenAI.
How they were using Codex was extremely informative for us to be able to say, oh, that's how they're thinking about it.
That's how they've automated the CI-CD pipeline.
That's how they're thinking about the tickets.
And that evolution that happened inside of OpenAI was so rapid and learning from that was extremely beneficial for a large part of our team members going, oh, wow, I didn't realize you could do that.
You know, all of the bottlenecks that were, you know, we kind of had to take our priors and wipe them out.
and say, hey, these priors no longer hold true, and this is sort of how we need to operate.
I think we're all having to do that, frankly.
And we're having to do that so often.
Every couple weeks.
Every couple weeks, right?
And so this was one of those moments for us.
One of the things as we brought Codex in, as people have started using it pretty much to do all of the coding work, you know, the pull request reviews at this point in time, I think the big aha moment was like with each and every single generation model that comes out.
You also have to kind of wipe out, just like you're wiping out your priors, you have to wipe out your skills files because you've built a lot of these things thinking that, hey, I'm going to need help with some of these things.
So they've built some capabilities around the harness itself to be able to solve certain problems for them.
And we've had to completely wipe that out and say, hey, new model came out.
This new model is more capable.
Season four of Chain of Thought is presented by Walrus Memory, the portable memory layer for AI agents.
Your agent has learned your code base and how you work.
Now you want to use that context in another tool.
Exporting a file gives you a snapshot, but what happens when the context changes?
Walrus memory is a portable memory layer that lets your agents store context for later use across tools.
Python and TypeScript SDKs plus native MCP support let you connect it to your agents no matter where they are.
You said who can read and write, so sharing context doesn't mean opening up your whole memory store.
If you are building across tools or model families, take a look at Walrus memory.
Learn more at walrus.xyz slash C-O-T.
That's walrus.xyz slash C-O-T.
Any frontier model can query your data, but can you trust its answers?
This episode's sponsors Wisdom AI put that to the test in their latest benchmark study.
Alone, Claude Code topped out at 73% accuracy.
Wisdom AI closed the gap, delivering accurate answers 3x faster at a third of the cost.
I sat down with Kapil Chhabra, Wisdom AI's co-founder and CPO for episode 75, and he explained the analytics architecture that makes these kind of results possible.
Check it out for a full deep dive, plus get the blueprint for trusted AI analytics at wisdom.ai slash bedspark so you can deliver accurate answers on Claude, Chetupiti, or wherever your business gets their insights.
Download your copy at wisdom.ai slash benchmark.
I admit I'm less convinced on this argument, so I want to unpack this a little bit because I totally agree.
You need to reassess with each new model generation the rate of intelligence, the cost of intelligence are both changing rapidly.
But I don't think you should throw your skills out wholesale.
I know a lot of people are giving that advice.
my opinion is you should be refactoring them every time.
It's a good point that you bring up.
I think you're right.
I think refactoring is definitely one of those things.
I think that the thing that I struggle mostly is with people getting very, how do I say this?
Like attached to a workflow.
Attached to their workflows.
You have to change.
You've got to change because there is no point in getting attached to your workflows because you know, I've seen people go like, oh, you know, they give names to their, you know, just like the way they name their personal assistants.
They have their own bot that's running, that's customized.
And it's like, oh, you know, here's my personal PR bot.
I'm going to call it Jarvis.
I think that's our problem right there.
And so what we're trying to tell people is like, say, hey, listen, the things that you're building, you got to refactor them.
In fact, I'll give you a simple example, right?
So a lot of times in the first iterations, it wasn't doing very specific types of security checks in the source code that you would have had.
So you've created the skill file, you know, which is pretty large.
And so what ends up happening is that every time a pull request was happening, you are now loading this inside of your context window for every single back and forth that's going on because that is important for it to be able to go out and assess.
That consumed a lot of tokens.
It consumed a lot of back and forth that's happening.
It reduced the attention on the, especially if your code base is starting to grow in sizes or your pull request is a pretty large.
Which if you're coding with agents, you definitely have a growing code base.
That's right.
And you have large pull requests coming in.
pull requests are like 40,000 lines of code.
Well, you can limit that if you have good rules for your agents.
Right.
But you might want to start like tuning all of that stuff because guess what?
The context window sizes for these models are growing with each and every single iteration.
But it doesn't mean that having a lot of context does not make it less efficient at times.
That's right.
To your point.
So you just have to like come back and say, hey, what if, you know, I didn't need to do these things because the next generation model already comes in with a lot of these security checks baked into it.
It comes with...
new types of unit tests that you never thought about because it's thinking through all those things, which meant that you can go back and say, hey, I don't need these things that I put in there anymore.
To your point, you're right.
Don't throw them away, but it's worthwhile coming.
Be willing to, though, too, to your point.
There's some things that you might have to throw away, some things you want to refactor, say, hey, you know what?
Here's the context that you need to go get.
Here are the tools that I'm using.
There might be some custom dependencies that you want to still be able to declare.
But I think the most interesting part is people are starting to bring in workflows from like, you know, there are agents that are not necessarily just the my agents, the thing that we rolled out, but there are other agents that they want to start to.
Someone's bringing their Muse workflow in, for example.
Right.
We haven't quite unblocked people bringing in Muse into the workplace just yet, but historically they've had their own bots that they've built using, you know, OpenClaw that hooked up the APIs into, you know, either an agent SDK that came from, you know.
you know, OpenAI or Anthropic, and they were using that to be able to perform a lot of the workforce they needed.
And because the existing, you know, bots, I mean, the MyAgent that we rolled out just happened, you know, a few weeks ago.
So they already had these pre-existing bots in place.
And so they were starting to connect each one of these things, you know, together.
Now, there are agents inside of the SaaS software that we purchased, right?
Always, yeah.
There are agents inside of Salesforce or agents inside of Notion.
And so we had to come up with a more thoughtful way of saying, hey, how do we first of all recognize and discover these shadow agents, if you will?
And it's a very common problem that used to exist before called shadow IT.
We're using the same moniker to be able to describe shadow agents.
And these are agents that have come in via some other sources.
So what you got to do is to make sure that A, you discover them.
And then once you discover them, you want to apply like certain rules of how and what they operate on.
And then you got to also provide, you know, hey, which identities are you allowed to?
emulate to be able to get your tasks done.
And so once you have those three things locked in, then you go out and say, okay, listen, I'm going to make sure that I'm constantly observing the actions that these agents are taking.
And if they start to deviate, you want to be able to send out an alert saying, hey, is this something that you intended for this agent to do?
How are you enforcing mechanisms against these shadow agents that may not be as tuned to the security, observability, and evaluation measures that Cisco has with my agent?
Cisco has a zero trust solution that we use internally, the wheel to sell.
It's called Cisco Secure Access.
And we have a mechanism of being able to say, hey, listen, here are the agents that we love and here are the agents that we don't love.
These are not as...
fine-grained or granular as you would like, and we're constantly adding capabilities.
And so stay tuned for some pretty cool stuff that we're going to do over there to be able to look at how do you love nuanced actions that the agents are taking.
Right now, when we see that somebody's using an agent inside of a solution that is not approved, we just go ahead and simply put in a policy to say, nope, that's blocked.
And so when you try to access that feature, it just wouldn't pop up.
I'd say, hey, sorry, this is being blocked.
The core belief that we have internally for ourselves and what we believe everybody should have is they shouldn't see security as a roadblock you got to be able to use security as an accelerator somehow um you know and and so this is one of those rare occasions where you're going to notice that you know agent safety and security is actually going to accelerate adoption um because it's going to give people the confidence to be able to use these tools.
And what we're doing is to unlock that for every single agent that we're bringing into our enterprise, whether it's agents that the enterprise is building themselves or agents that they are consuming from a SaaS provider or personal agents that they want to bring on board.
And you'll notice that the industry is sort of moving in the direction where they're opening up like hotel exporters.
you know, capabilities and endpoints where you understand exactly what the agents are doing and you have the ability to ingest that and say, you know what, I can now ingest this inside of my data lake.
I can ingest this inside of my Splunk instance and I can observe what's really happening because that increases the level of confidence that you get in terms of using these agents.
Season four of Chain of Thought is delivered by Sphix.
We spend a lot of time talking about what agents need in production and one of the least glamorous answers is Yvette's.
Your customers want agent workflows that react to things happening inside your system, which means your API needs webhooks that actually work.
Not just a post request and a prayer.
Retries, ordering, idempotency, replay protection.
Sphix does that as a service, and they wrote standard webhooks.
The spec that Anthropic, OpenAI, and Google bailed against.
So if your API doesn't have reliable webhooks, that's turning into a lost deal.
Join Brex, Drada, Daytona, and many others on Sphix.
Get started at link.svix.com slash C-O-T, or go to the show notes to grab the link.
Qualified startups will get $12,000 in credits, $50,000 for YC companies.
I can't recommend Sphix enough.
I'm a huge fan of their open source project.
I've actually contributed a bit myself, and they're so easy to integrate with.
I think you'll really enjoy it.
Check out Sphix.
Head.
link.svix.com slash C-O-T.
And I think this is a really key point we should drill in on a bit because the confidence piece I think is underrated.
We've talked on this show before for the last couple of years about how important it is to have confidence that your agents are going to perform in production.
And this was stopping a lot of agentic rollouts, particularly in enterprises, in 2025 and I think early 2026.
No, 100%, right?
I think you're going to see this evolution, right?
We started out with chatbots.
We're evolving to agents.
They're doing a bunch of things.
We're very quickly going to start to see physical AI become a real thing.
And I think what you're seeing that is, you know, you're constantly increasing the amount of autonomy that you're giving to machines, you know, starting with like agents in an environment to like...
you know, agents that are going to run inside of, you know, robots that are going to move around, do things that are going to interface with you in the physical world.
I think what's going to happen is that it's going to become increasingly important to understand that slider scale of like, you know, how much of autonomy and agency are you providing to these systems to be able to effectively do tasks on your behalf?
I think it's going to be the reinstatement of dependable systems.
You know, we've always done the study of...
dependable systems.
I think we're now going to start to see security and safety unlocking how we think about dependable systems from the ground up.
So I want to ask about dependability here because one aspect of that, and a lot of our audience knows about this, is the engineering side and code review, ensuring accuracy, ensuring you don't have bugs that get in.
What's the approach that Cisco is taking to code review at scale, particularly when I know Codex is driving a lot of your development?
But my understanding is you also work with Anthropic and other model providers as well.
We do, yeah.
You know, I think we're constantly assessing which models are best for which tasks.
Now we're using our frontier models.
We're using, you know, open source, open rate models.
We're building, you know, models ourselves, which are, you know, post-trained models on top of, you know, some of the open rate, open source models like Mematron.
And we're using those to be able to perform very specific types of tasks that's trained on proprietary data that we have.
And so we're always picking and choosing the best models for the best type of task.
Now, in the case of pull requests, man, you know, PRs became a bottleneck very quickly as the agent started, like, pushing out a lot of code.
Now, every single person has their own respective PR bots, which provides a little bit of taste and judgment that each and every single engineer has in terms of, like, how they like to review code.
And they have, like...
put those agents.md files that actually describe how they like to do the reviews.
And so you will see that every once in a while, the review bot comes in with requests that you've normally seen that same person submit, but it's essentially talking to the agent that actually submitted the pull request.
And so even though you look at that and you go, yeah, that's interesting, but the agents are the ones that are coming up with the PR fixes and pushing changes back in and then starting to do the merges.
I think we've gotten to a level of maturity at this point that the pull request reviews are being done by agents, but with very specific sort of instructions in terms of how you want to think about security, how do you want to think about code clarity, are you thinking about...
in a modularity.
Are you making sure that it's checking through like packages that they've used before?
Are you making sure that you're using open source packages with the right licenses?
There are a lot of these instructions that are constantly being shared amongst teams that make its way inside.
And on top of that, there's always some amount of like, hey, I like using the single tick sources, double ticks.
It's like a lot of those nuances start to creep in from a taste and judgment perspective, which is kind of cool.
But that's sort of how we solve it, right?
And again, Sometimes it's different models.
Like, you know, if you're using Astro to code it up, you know, your office, you know, is probably doing the pull-to-cursor review.
We try to change some of these models.
Multi-model family helps a ton because you catch bias across the families.
And sometimes there are some teams that actually switch between model providers.
um and sometimes now they're using you know open source open made models you know to be able to do this gotta give a self plug here that if you're interested in great code review i have a whole article on that on my newsletter newsletter.chainofmod.show so definitely check that out and i am curious to hear from you dj is your team also then taking the data from your pull requests and creating evals based off of that to then apply all the time you know i think we're you know A, we're looking at pull requests.
B, we're also like, you know, a lot of times what ends up happening is this kicks off our CD workflows, right?
You know, we're constantly doing continuous integration into our existing systems, continuous deployments.
And so as we do that on our sandbox environment, we're collecting the traces of how these things are running, using that to understand like, hey, are they behaving the way that they should be as part of those test deployments, even before we move something into production.
And so there's a lot of that.
that's going on.
We built the pipelines.
It took a good chunk of time to be able to get those pipelines right.
And it's worth that investment.
But then it starts to speed things up, you know, from all the way from like spec design to like being able to see that work product that shows up at the end.
One of the biggest things we've also unlocked is once the code delivery happens is to go back and say, hey, rewrite the spec for this at this point in time.
And so you can see the spec drift that happens from like the initial starting point to like where it landed.
and recognize and reconcile like, hey, wait a minute, this is not what I asked for, or I didn't even realize that we've evolved at this point in time.
So the retros look a lot different because you're just looking at spec drift.
And you're also starting to look at, hey, how do I retool this entire process?
And so we've done a lot of work on that front.
And I think we've had these big aha moments where we've had to sit back and go, wow, that's not the way I thought we were going to evolve.
This is such a brand new paradigm of how we work today.
And I've heard you say before that security today can no longer run at human speed.
And that has so many implications.
But for the security team members listening, for the CISOs listening, how should they be thinking about this next era?
Listen, I think yesterday was a very, very interesting day.
Railway, PHP, so many other examples.
So many examples in a single day.
And I think, you know, a lot of people sort of started to understand that this is sort of the new normal.
Greg Brockman talked about the defender's window.
These models became so powerful at some point that they said, hey, there's going to be a finite amount of time that you have from a defender's perspective to be able to leverage these powerful models to be able to go out and figure out where you have vulnerabilities and go start to fix them.
Cisco has been part of both the Glasswing and the Daybreak projects.
And from both Anthropic and OpenAI to be able to use these models to be able to find vulnerabilities and fix them and sort of be part of that community.
I think one of the big things we learned from that whole part of the process is that, you know, and we kind of knew this even before, was the amount of time it takes, you know, for an exploit to show up in the wild from the time that a CVE was announced.
It used to be months, you know, and if not, sometimes in some cases, those are years.
And now it's like sub eight minutes and it's only decreasing.
So which means the minute you publish something, like when the PHP, like one of the interesting data that came out that...
uh you know matthew prince was talking about it from with cloudflare was they saw some amount of attacks on the php stuff like you know and it was non-trivial amounts but the minute the cve was published and it became a thing that number went into the millions or people that became aware of this bot started reading these things and instantly started exploiting you know any open websites that were still using phps right so so this is sort of like a very uh interesting thing to keep in mind when you think about attacks are now starting to happen at agent speed you know your defenders need to start moving at agent speed as well.
And to do that, you're going to need to invest in agents that understand your security posture, agents that understand the context of how your applications are being deployed, being able to recognize the kind of access that you have, the identity that you have, and then coming up with a mechanism of being able to say, hey, hang on, this doesn't look quite right.
When you looked at the Microsoft attack that just happened, you know, and, you know, with the whole, you know, the swarm.
I think the thing that it did first was, you know, it attempted 120,000 logins, you know, that were failing logins, but it still attempted that.
You know, I think this is a really interesting exercise in recognizing that if you knew that there are failed logins that are starting to show up, you now have to start thinking about, hey, what do I need to do to be able to completely retool my systems so that, you know, You just block them further and further, you know, farther and farther away from the perimeter.
So I think that is really a reimagination of how you can start operating at agent speed, right?
You got to get, you know, really smart about account compromises.
You got to get really smart about specific kinds of breaches that you're going to start to see.
You got to get smart about east-west traffic as you start to think about how attacks start to propagate.
You got to get smarter about, you know, workplace protection.
And then a lot of these things will start to come together inside of an agentic SOC.
And that's really how, you know, we at Cisco have been thinking about how do you start reacting at agentic speed is about understanding each and every single one of these pieces and then stitching them together collectively.
I think it's so interesting to explore the incredible security rollout you've had to do for 90,000 personal agents across the organization with my agent.
And DJ, thank you so much for having us here to the Cisco offices today to explore this topic.
And I do want to say a quick thank you to our presenting sponsors, Ingest, who do incredible work around long-running agents for helping make this show happen.
DJ, where can folks go to follow your work?
Hey, you should check out Cisco.com.
We put out a lot of interesting blog posts.
Twitter handle is Cisco AI.
And I'm at DJ Sumpet.
I'd love to hear from our listeners here as well.
Are you using Codex today?
Cloud Code?
T3 Code?
some other open code?
What's the harness that you're using for your coding agents?
Or have you converted to assigning work to coding agents from your personal agents?
We're very curious to hear from our listeners.
So let us know in the comments on Spotify, on LinkedIn, Twitter, X, or YouTube, wherever you're listening.
We'd love to hear from you.
DJ, I'd love to understand from your perspective, as codecs and AI coding models have accelerated what you're able to deliver on the engineering side with Cisco, while also accelerating the pace and scale of attacks.
What are you doing to enhance Cisco Cloud Control and enable defense around the entire enterprise?
Yeah, listen, you know, Cisco Cloud Control was this project just to ground, you know, the audience on this as well.
You know, Cisco has over like 130 plus SKUs over, you know, 74 different products over 17 different kinds of platforms.
it was really important to start to bring all of these pieces together.
And, you know, so one of the missions that my team embarked upon was this thing about saying, hey, we're going to bring all of these pieces together and we're going to build this thing called Cisco Cloud Control.
Now, at that point in time, this was, you know, summer of last year, agent decoding quite wasn't real.
It's kind of crazy to think about, like...
Just 12 months ago, or a little over 12 months ago, everybody was vibe coding at that point in time, right?
And agentic engineering wasn't a thing.
And we started hammering away at it.
And roughly around October, November was when we started getting our hands on the previews of some of the agentic coding capabilities.
And boy, we lucked out, right?
I think it was one of those moments where we had set ourselves a 12-month deadline to be able to do something that was next to impossible.
And we were rescued by agentic coding because all of a sudden we started seeing this throughput go up.
In fact, we, in record time, in a little over eight months, were able to start stitching, you know, all of these different parts of the portfolio together and start to offer an experience to our customers where they go, oh my God, this thing is really, really cool.
I didn't know that I could like troubleshoot and debug from like networks to like security to like observability is a single shot.
And they started seeing these things come together in ways that fundamentally altered how you thought about the infrastructure that you're deploying inside of an office like, you know, on our Cisco campus right here.
So that really was something that was remarkable about what we could do with agent decoding.
And then we took that harness and we said, listen, we're going to put these agent decoding inside of Cloud Control.
So you, you know, Ms.
Customer or Mr.
Customer, you can now deploy your own sets of capabilities.
You can almost sort of think about Cloud Control as a secure harness for you to build.
agentic experiences on top of this that solves your needs, your work, your problems in meaningful ways.
And I know it can be scary because we are seeing these incidents and there's concerns and we should address them.
But this is also the most exciting time ever to be building because so much more is possible today.
And I would just encourage our listeners and everyone who's out there coding today to be more ambitious because the models are capable of more than you think.
You can give it all the context you need and your, your taste, your knowledge, your thought processes, your architectural thinking is so much more valuable today because you can accelerate your execution with agents.
And, uh, I, I couldn't be more excited for the future.
And TJ, thank you for sharing your thoughts on it today.
A hundred percent.
You know, it's time to build.