Cisco Leverages OpenAI to Accelerate Detection and Remediation

Cisco combines its network telemetry with OpenAI models to accelerate investigation and remediation. Jeetu Patel highlights advancements such as Daybreak and GPT-6 Astra, as well as priorities tailored for more autonomous agents. OpenAI's privacy guarantees are presented as a prerequisite for deploying these capabilities on critical systems.

Daybreak, GPT-6 Astra, and an Ongoing Defense Network Exploration

Jeetu Patel cites Daybreak and GPT-6 Astra as advancements that enhance security for Cisco and its clients. He claims that Cisco is capable of identifying and correcting vulnerabilities more efficiently while reducing the time required for investigation, response, and remediation. He describes these initiatives as exponential improvements for the security posture of Cisco and its clients. Cisco and OpenAI are exploring, through the Daybreak Defense Network, ways to accelerate the sorting of exposures and apply the right controls within Cisco Cloud Control. Jeetu Patel believes that this work can give defenders the upper hand, stating that OpenAI enables this by providing the ability to operate at machine speed and scale.

Three Priorities Outlined for Securing Autonomous Agents

With the increasing autonomy of agents, Jeetu Patel emphasizes the need to distinguish between malicious interference and an agent inadvertently pursuing a legitimate objective. He considers it essential to combine security telemetry with observability data to simultaneously analyze threats and agent behavior. He defines three major axes: ensuring the protection of agents against malicious attacks, identifying and stopping inadvertent behaviors, and operating with near real-time responsiveness. According to Cisco, these axes guide an evolution towards policies and controls that gradually adjust to the actions of agents.

Bridging the Gap Between Exploitation and Vulnerability Remediation

Jeetu Patel points out the gap between the speed at which attackers exploit vulnerabilities and the time organizations take to remediate them. He sees AI as a means to close this gap by enabling investigations into more threats and responding faster. He asserts that AI grants speed and scale to attackers, and equipping defenses with similar capabilities is essential for maintaining security. The anticipated adoption relies on existing processes for vulnerability research and remediation, with these capabilities able to integrate into scanning workflows without fundamentally changing team organization.

Distributed Controls for Correlating at Machine Scale

Cisco positions its defense on the network and describes a transition from a single perimeter to distributed controls across microservices, containers, and clusters. Jeetu Patel indicates that he can place a mini security stack in front of each microservice, each Kubernetes container, and each cluster, thereby integrating security into the fabric of the network. Application-level controls limit communications to necessary connections, reducing propagation paths and allowing for selective isolation to keep unaffected services operational during investigations. By combining network intelligence with OpenAI models, Cisco claims to correlate signals at machine scale, where two seemingly benign signals can together reveal a pattern useful for secure operations.

Deployment on Critical Systems and Privacy Guarantees

Cisco combines its network telemetry with OpenAI models to build more adaptive defenses on the infrastructure it provides to organizations. The company states that adversaries are using AI to automate attacks at a pace comparable to that of machines, and that the combination of its telemetry and AI reasoning should enable defenders to gain the upper hand against new threats. OpenAI emphasizes a privacy strategy based on not retaining data, applying strict restrictions on customer data, and verifiable isolation. Cisco clarifies that these measures allow for the introduction of advanced intelligence on critical systems without jeopardizing client priorities or the privacy of telemetry.