Reimagining Cisco Security with Jeetu Patel and Peter Bailey

Thanks.

Just came back from Germany.

Yeah, yeah, I have not slept in a while. That's okay. Listen, the last 75 days have, you know, changed so much and the whole security market and the problem set is getting redefined around Mythos and agentic security. And, you know, Mythos really announced to the world that the frontier models are now good enough to do the things we've been afraid they were going to do for a long time, which is to penetrate all of our defenses and penetrate applications. And, you know, the world we have built to date is one for human speed, and whether that's policy or reaction or what have you, and it all needs to get rebuilt for this machine speed. And so we've been talking to customers about that a lot, how to get ready for that. I think that the thing that is coming first, the first wave is vulnerabilities. The perimeter has to be patched. Products have to be patched. The second wave is going to be internal vulnerabilities. Think open source, which is a huge, huge problem as well. And then you think about how you're going to actually improve your defenses and in the short term put up walls because we know lots of things we can do around zero trust, around segmentation, around walling off, you know, the crown jewels that can survive these attacks. But everything has to get rethought along the lines of how you're going to have comprehensive visibility, real-time policy and enforcement everywhere. And of course, that's in our view kind of advantage Cisco because the network is everywhere. Network can't be compromised. The host can be compromised. We have visibility everywhere. We have the opportunity for enforcement everywhere. Things like the smart switch, putting a firewall on a campus switch, all the things we're working on or have announced. This is about distributed enforcement everywhere so that we can, you know, protect at the edge, protect at the core because you're going to need all those protection points to be able to fend off AI-based attacks. And ultimately to safely use AI in the organization as well. And so this is what we've been talking to our customers about and it's obviously, you know, going to be I think what we're talking about for the next, you know, 12 months if not longer.

Yep.

Yep. Yep.

Yep.

Yeah. So let me kind of touch the product evolution. And so, you know, the traditional on-ramps we talk about are firewall, right? Our zero trust, our identity, right? And network detection and response, and email security. And, you know, we spent the last year plus really dialing in on what we think we can be the best in the world at where we can lead, right? And really have focused in on network security, focused in on zero trust, and obviously identity is a substrate and I'll come back to that. And obviously, you know, network detection and response I would add to that as well. But ultimately, you know, you take a real big step back, I think everything we do can be categorized as either visibility, policy, or an enforcement. You got Splunk really as a visibility layer across the organization and your entire state. We have policy models all over the place, right? And you got it in network, you got it in security, and everywhere. And our opportunity and superpower is to create a singular policy plane that can talk to everything else. And so that as a security professional or network professional, you can create policy and enforce it everywhere, which across a very diverse environment, a large environment, is very challenging today. And so when we think about whether it's ICE and security group tags, right? And doing segmentation in the campus, we think about the Nexus smart switch and doing, you know, segmentation in the data center. We think about firewalls, we think about workloads, right? The ability to problem solve with policy and then having this broad landscape for enforcement. And again, that's really a superpower. So the things we are working on and talking about is how do we think about that more holistically? How do we think about not just a firewall as a hardware appliance sitting in the center of a network, but how do we think about sensors and enforcements and decomposing that and putting that everywhere? And so you've seen that start to happen with HyperShield, which is on the smart switch now. You're going to see more of that at the workload level. You're going to see more of that embedded in our switch infrastructure as well. So it's really taking what are kind of these historical on-ramps and starting to decompose them to some extent, but push them into the network, push them out to the edges, and distribute that because we know that data volumes are going to be enormous and just putting a bigger firewall is not the answer, right? You're not going to get a 10x more capacity firewall. You're going to have to have distributed security. And so migrating...

It's hyper-distributed...

...and it's having a real-time view of your environment so that you can have the visibility and the policy and enforcement when we...

When we think about AI. And so to have that, you have to have identity. You have to have identity or the network has to be aware of identity. Everything has to have an identity. Has to be a cryptographic credential that's ephemeral in nature, just-in-time. All those things we talk about is the way we're going to secure this environment such that we can safely use AI. We know what should talk to what, what should not talk to what, have pattern recognition. And so, you know, I talked to my team about, you know, again, I kind of try to simplify it because it's complicated, you know, visibility, policy, and enforcement. And that's kind of been our world for a long time. But then we did these verticals of firewall and email and network detection response and secure access and identity and they all have elements of visibility, policy, and enforcement. But between them all are gaps. The data planes aren't merged together. And between them all is where AI is going to operate. So we have to have more holistic views, breadth and depth, and the ability to build a knowledge graph in the background that can look across that and see those real-time interactions such that you can put intelligence and policy on top of it. And that is what we are building. That's what we need to build to really enable the safe use of AI.

Sure.

Yeah. So you said a really important word there, which is trust. And again, we need to think about identity as sort of the new trust layer. And to the extent that the network is aware of that, you got to trust anchor in the network, you got to trust anchor in identity. And that's going to be super important going forward. So when we think about building, you know, the ability to use agents safely and you think about the examples you gave like a tightly bound agent, right? They can do one thing, right? And that feels like something we could sort of authenticate it, monitor it, and it's only allowed to do that one thing. It has policy controls around it so it can't do anything else. Maybe it lives actually in a container, it lives in a sandbox environment, right? I think we have solutions that can deal with that today and that's really built in a way we think about discovering and authenticating and authorizing an agent on the network. Then you go to the other end of the spectrum like open cloud. And why have we not seen dramatic usage of open cloud? Why are they sitting on your desktop, you know, side computer? It's because they have broad capability. And so for broad capability, you really need not just the ability to see the behavior and take action, you have to do that at machine speed. And ultimately, you're going to have to be able to write policy and enforce policy at machine speed, which means using an LLM to watch an LLM ultimately, right? And so where we are as an industry is still wanting a deterministic step in there, whether it's policy or in changing policy, and not leaving it all up to an LLM watching an LLM. And so that's that next step. And so our team has built what I would sort of say is the steps to, like I said, discover, authenticate, authorize, and monitor behavior and take action. But today those are still at human speed. They're not yet at machine speed, and that's where we're going to have to get to to really enable broad use of these broadly capable AI agents across the network.

Yep.

Yeah, so we got to meet the customer they are, right? Like you said, these are big estates, big investments, very complicated. In the perfect world everything's standardized and, you know, homogeneous rather, it's not.

Yeah, so when we approach a customer, we are trying to think about how we can bring obviously our products to bear and wrap it around the customer, but then allow them to still work within their current environments. I'll give you an example. So, you know, firewall, right? We've got northbound perimeter firewalls, you have zone firewalls, you have firewalls that are put in switches and workloads. And the thing I said early on is the key is there is policy. Policy is the platform. And so, we have built a policy engine as an example that can write policy and push it down not just our firewalls, but third-party firewalls as well. So, give the customer an opportunity for policy integration. And so, I think working with Cisco is working with a company that's open that, you know, works in an ecosystem that is used to working in an ecosystem, and you can create simplification while still not having rip and replace everything. And obviously, over time, we think our products are better. We want you to kind of continue to add those in the world, but that's an example of how we are approaching it.

Absolutely. So we are doing things that we think are unique to us, right? We have built, you know, very unique ML models. We built the EVE encrypted visibility engine looking at encrypted traffic. We were able to detect things on the network that others are not able to detect, and we've seen that in performance reviews again and again. But what I would say is that again, the power, I believe, is going to be in this policy unification, the policy plane, because that's the intelligence layer. And so, you want to build simplification into your strategy. You want to build the ability to have an intelligent layer, because over time, as you know, at some point that's going to be AI that's driving that. And so, to do that, you have to unify, you know, the substrate, the data, and unify a platform there that you can actually put AI on top to drive policy. And that's really what we're building.

No. I mean, you took it beyond firewall and hit some really important points. And the thing I would add that you didn't say is that now with cloud control, having this all brought together, right? And so having unification of management of data planes, control planes, is going to allow us to also drive different outcomes in the future, easier outcomes in the future, too. And so the thing I'm also hearing from customers is, as you know, that was by far the biggest thing we announced at Cisco Live US was really Cisco is finally serious about this. They've taken the steps to reorganize the business a couple years ago to do this, but they're now seeing that things are coming together. And I had partners and customers say to me like, 'We get it. We get it now. We're back in. You know, we understand the value of that.' And so I think all of the things you said and the platform reality that we're introducing now are all very powerful messages.

Yeah. So I think as you said like we have probably one of the best kept secrets in the industry, right? We have Talos, the 500 person threat intel that, you know, sees as much as anybody. I, you know, in my background I've been in a couple of big shops that have done that kind of work, some of the best in the world. And...

So before Google was with Mandiant, before that with FireEye. And so have had a chance to see a lot of things at scale, a lot of things from a threat intel and incident response perspective. And so have a sense for kind of what that looks like. And the Talos team is excellent, right? And the Talos team is writing those ML models for our firewalls, etc., right? And so when I want to educate customers, you first of all understand their needs, understand how we can help them, right? Especially in this moment, everyone is so worried about Mythos and what's going to come next. And there are many things we can do to help them. I mean, even someone who just owns ICE, but is not using it to the extent it can be used to segment their network. That is a very valid defense against an ICE attack, right? And so for me, it's an education. And so when you ask what I'm worried about, it's I want to make sure customers understand what we can do for them and what we can do because they own the network, because they're already a customer of ours, how they can even create better outcomes also leveraging our security products, and how those are becoming very integrated into that fabric, as you said. I just don't think that message has gotten out there enough yet. As you said, we've been on a journey, but I think we're feeling very, very good where we're at. And frankly, the Mythos moment has given us an opportunity to go talk about that.

Yeah.

Yep.

Yeah. Yeah, we launched the agent security app, which gives you view on everything that's happening in your network effectively, right? So yeah, the three paradigms, right, is, you know, protect agents from the world, protect the world from agents, and detection response at machine speed. And so, in the first example, protecting the agents from the world, you know, we're using these models, we're building apps with these models. These models can be poisoned. These models can be jailbroken. You know, we want to understand, you know, the provenance of these models. We want to understand, you know, every interaction with the model because, you know, these agents might be building, are also reading our emails or interacting with websites. They might be getting malicious content coming back to them and so you have to put protections around them so they are not impacted negatively themselves to keep this all safe, right? And so when we think about protecting the agents from the world, it's that. It's also you can have a compromise in your data center and a workload can be compromised. And that workload, you know, if that workload is compromised, your agent's compromised, right? And that workload might be talking to another workload, right? And so this is kind of going back to things like segmentation become important in the data center. So all of that needs to be understood in the context of where agents can go and how they can be impacted. And so to your point, we've built fantastic capability with the AI Defense now with segmentation with the smart switch. And so we have, you know, very strong solutions there to help protect agents that our customers are building with.