How Cisco defends at machine speed with OpenAI

Cisco builds the networking and security infrastructure that organizations rely on to connect and protect their systems. As adversaries leverage AI to scale automated attacks and craft exploits at machine-speed, defending enterprise infrastructure must evolve. Pairing Cisco’s vast network telemetry with frontier AI reasoning gives defenders the toolkit necessary to outpace emerging threats. OpenAI’s rigorous approach to enterprise data privacy—centered on zero data retention, strict customer data boundaries, and verifiable isolation—means Cisco could confidently deploy frontier intelligence across mission-critical systems without compromising customer priorities or sensitive telemetry.

Connecting network intelligence for stronger defense

Cisco’s defense starts where threats move: the network. Patel describes a shift from a single security perimeter to controls distributed across microservices, containers, and clusters. “We can put a mini security stack in front of every microservice, every Kubernetes container, and every Kubernetes cluster, and fuse security into the fabric of the network,” he says.

Controls at the application level can restrict communication to the connections each service needs, reducing the paths an attacker can use to spread. Security teams can also isolate affected systems more selectively, allowing unaffected services to keep running while they investigate and respond.

Combining that network intelligence with OpenAI’s models allows Cisco to correlate signals at machine scale, Patel says. “Two signals might seem benign in isolation, but together they can reveal a meaningful pattern. Network intelligence allows us to correlate data across the network and derive insights to inform secure operations.”

Patel points to a pressing challenge for defenders: the gap between how quickly attackers can exploit a vulnerability and how long organizations take to patch it. He sees AI as a way to help narrow that gap, giving defenders the capacity to investigate more threats and respond faster. “AI hands attackers speed and scale. Using AI for defense is a prerequisite for staying safe,” he says.

He describes initiatives like Daybreak and GPT‑6 Astra as advances that strengthen security for both Cisco and its customers. “We’re able to find and patch vulnerabilities more efficiently, while shortening the time needed for investigation, response, and remediation,” Patel says.

“Daybreak and GPT-6 Astra have been step function improvements, not just for our security posture, but for our customers’ security posture.”

—Jeetu Patel, President and Chief Product Officer at Cisco

Patel sees a path to adoption that builds on the processes teams already use to find and address vulnerabilities. “These capabilities can fit into your existing scanning workflows, so you don’t have to fundamentally change how your team works.”

Rethinking security for an agentic world

As agents become more autonomous, security teams also need to distinguish malicious interference from an agent pursuing a legitimate goal in an unintended way. Patel says that requires security telemetry alongside observability data, so teams can assess both threats and agent behavior.

He outlines three priorities: protect agents from malicious attacks, detect and intercept unintended behavior, and operate in near real time. These priorities are guiding the shift towards policies and controls that can adapt as agents act.

Through the Daybreak Defense Network, Cisco and OpenAI are exploring how to help security teams triage exposure faster and enforce the right controls in Cisco Cloud Control. For Patel, that can help shift the advantage back to defenders.

“OpenAI is shifting the advantage to defenders by allowing us to operate at machine speed and scale.”