Cisco Delivers Trusted AI at Scale Through New Splunk Advancements
Cisco rolls out new Splunk AI, observability and security features, plus an expanded NVIDIA and AWS collaboration, to run AI where data resides.
Rhea-AI Summary
Cisco (CSCO) announced new Splunk-based AI capabilities and partnerships to deliver trusted, governed AI at scale across customer environments.
The company introduced Cisco AI POD for Splunk, part of Cisco Secure AI Factory with NVIDIA, bringing Splunk AI to on-premises, private cloud, and air‑gapped deployments using pre‑validated Cisco infrastructure, NVIDIA accelerated computing, and Kubernetes architecture. Customers can self‑host selected open and proprietary models, including Cisco Deep Time Series Model, Google Gemma 4, and OpenAI GPT‑OSS 20B, with NVIDIA Nemotron models expected in coming months.
Cisco unveiled Splunk Agent Observability with new Tokenomics capabilities to monitor AI agent performance, apply runtime guardrails, and track and forecast token spend across agents and coding tools. New security features expand the Splunk Agentic SOC Workforce and Exposure Analytics, and Splunk Enterprise Security Essentials and Premier bring more autonomous, agentic security operations to a wider range of teams. Cisco also disclosed a multi‑year agreement with AWS to co‑develop security solutions aimed at countering AI‑driven attacks.
Positive
- Cisco AI POD for Splunk makes Splunk AI available for on‑premises, private cloud and air‑gapped environments
- Self‑hosted AI models option lets customers run Cisco, Google, OpenAI and upcoming NVIDIA Nemotron models without moving data off‑premises
- Splunk Agent Observability with Tokenomics adds real‑time visibility into AI agent performance and token spend, plus spend forecasting
- New agentic SOC capabilities expand Splunk’s Agentic SOC Workforce and Exposure Analytics for faster, more autonomous security operations
- Multi‑year AWS agreement formalizes joint development of security solutions to address AI‑driven attacks
Negative
- None.
News Explained
Cisco says Cisco AI POD for Splunk is available today, enabling Splunk AI to run in customers’ on-premises, private-cloud, or air-gapped environments, while Agent Launchpad remains scheduled for later this year.
AI-generated analysis. How Rhea-AI works. Not financial advice.
Customers can now run, defend, and observe AI where their machine data already lives
Cisco and NVIDIA extend partnership to bring agentic AI to Splunk on-premises customers
News Summary:
- Splunk AI features come to on-premises customers with Cisco AI POD for Splunk, the newest addition to Cisco Secure AI Factory with NVIDIA.
- New Tokenomics solution in Splunk Agent Observability tracks AI spending and coding agent usage in real time, tying adoption to business value.
- Splunk's latest security innovations give teams a faster, safer path to scaling the agentic security operations center.
- Splunk and AWS formalize a multi-year agreement to co-develop security solutions built to outpace AI-driven attacks.
"One of the biggest roadblocks to enterprise AI today is that it's too hard to deploy," said Jeetu Patel, President and Chief Product Officer, Cisco. "Customers want to know: Can I trust it to do the job? Can I afford it? And, most importantly, can I secure it? By running Splunk AI on the infrastructure customers already trust, they can move faster to put AI to work in their business with confidence and control."
Self-managed Splunk AI, accelerated by NVIDIA
For customers who can't move sensitive data to the cloud, Splunk AI has remained out of reach – until now. Cisco and NVIDIA are expanding their partnership to bring self-managed AI directly to Splunk Enterprise customers, across their own on-premises, private cloud, and air-gapped environments.
- Cisco Secure AI Factory with NVIDIA is the reference architecture that brings the full AI stack together, built from Cisco AI PODs. The newest of these configurations, Cisco AI POD for Splunk, brings Splunk AI to on-premises customers with new AI runtime software, Cisco infrastructure, NVIDIA accelerated computing, and Kubernetes-based architecture – pre-validated and optimized for Splunk AI workloads. Cisco AI POD for Splunk is available today. For customers who have their own infrastructure, partners like bitsIO, Wipro, and World Wide Technology are ready on day one to help customers stand it up.
- Splunk AI Assistant (available now) and Agent Launchpad (coming later this year) run on this layer. Together, they bring ad-hoc agentic investigations and custom agent building for a broad variety of use cases including the agentic SOC to teams that run Splunk in their own data centers.
- Customers can also self-host a selection of open and proprietary generative AI models for their Splunk Enterprise workloads, including the Cisco Deep Time Series Model, Google Gemma 4, and OpenAI GPT-OSS 20B, with NVIDIA Nemotron open models in the coming months. Teams can use the model best suited for the job without sending data outside their environment.
"Enterprises need to bring AI where their data lives, especially when security and sovereignty requirements require critical workloads to stay on-premises," said Justin Boitano, Vice President of Enterprise AI at NVIDIA. "By enabling Splunk AI workloads to run with NVIDIA Nemotron open models on NVIDIA accelerated computing, Cisco and NVIDIA are working together to bring AI agents directly to Splunk and giving organizations a high-performance, full-stack foundation for agentic security operations wherever they run their infrastructure."
Observe agent performance and track token spend in one view
New observability innovations give Cisco customers one full-stack view into how their AI agents are actually performing.
AI agents behave in ways that the people running them can't always predict, running up costs that stay invisible until the invoice lands. Splunk Agent Observability, with its new Tokenomics capabilities, is closing that visibility gap and giving organizations a real-time view into agent performance and AI token spend. This enables teams to see exactly where and why AI costs accumulate before they become a budget problem.
Splunk Agent Observability, announced initially as an on-premises offering, is now available in Splunk Observability Cloud and in Cisco Cloud Control, extending visibility to customers working across the Cisco portfolio. It evaluates agent and model behavior, observes performance across the AI stack, and applies runtime guardrails that block inaccurate or unsafe actions, like hallucinations or leaking sensitive data.
As part of Splunk Agent Observability, the new Tokenomics solution extends that visibility to spend – tracking and attributing token expenditure across AI agents and employees' use of coding agents like Claude Code, Codex, and Cursor. It will also forecast consumption patterns to project where spend is headed before a billing period ends, using the Cisco Deep Time Series Model. These insights help organizations to operationalize a tokenomics framework and tie AI spend to business outcomes.
Cisco is also helping organizations strengthen their infrastructure resilience by minimizing visibility gaps and cost barriers that hinder autonomous troubleshooting. The Observability Studio enables teams to ensure new applications are "born observable," measurable and production-ready from the start. The new Network Intelligence App brings Cisco network topology, device health, and events into Splunk, so network teams can trace an alert straight to the device behind it and the network around it. Also, the new editions for Observability Cloud – Essentials and Premier – simplify how customers buy and expand observability across their business, with cost-effective log analytics to debug application and infrastructure problems.
Trusted autonomy for the Agentic SOC
The AI threat landscape is on track to outpace the human-led defense model. Never has it been more critical for organizations to be able to understand and address potential exposure and vulnerabilities across their entire IT landscape – from the infrastructure to the applications. Stopping these AI-era threats requires an agentic SOC capable of reasoning and defending at machine speed, without compromising the data sovereignty and human governance enterprise leaders demand.
Splunk is advancing the agentic SOC by combining enterprise-wide telemetry with specialized AI agents powered by leading frontier and domain-specific models. New purpose-built agent capabilities expand the Splunk Agentic SOC Workforce and mirror how elite security operations teams work across detection engineering, proactive threat hunting, autonomous investigation, coordinated response, and policy governance. By correlating rich, full-stack machine data across network, cloud, application, and identity environments, these agents deliver deep reasoning and transparent, explainable verdicts that cut alert noise and accelerate mean time to remediate.
Attackers are now using AI to hunt for vulnerabilities at scale, probing infrastructure, applications, and identity systems continuously and indiscriminately. Recent exploitation campaigns have made complete exposure visibility a board-level requirement. New Exposure Analytics enhancements deliver on that with broader asset coverage, historical change tracking, and business-specific risk insights. Connecting exposure context to live security activity across Splunk, Cisco, and an extensive third-party ecosystem, so teams see their entire estate rather than one vendor's slice of it. Agents use that context to pinpoint what matters most and where risk is active.
New capabilities in Splunk Enterprise Security Essentials bring agentic security operations and greater autonomy to far more security teams. Splunk Enterprise Security Premier adds deeper agentic autonomy and the full power of Splunk Enterprise Security.
Building the Agentic Enterprise together: Cisco's Splunk and AWS
The same urgency is driving Splunk's next chapter with AWS. Splunk and AWS are expanding their long-standing relationship into joint product development through a multi-year agreement. The work advances the agentic SOC to match the speed of AI-driven attacks.
Those attacks now move faster than human-led response processes can answer. Matching that speed takes deep security intelligence and the scale to act on it instantly. Splunk brings the data platform and detection depth security teams already run on. AWS brings global cloud scale. Together they will put agentic support in the hands of analysts across detection, investigation, and response.
Security teams won't give up oversight to move faster. What's ahead is agentic action at scale, with the governance and analyst control enterprises require.
To learn more, explore the blogs and resources below.
Read more in our blogs:
- The Agentic Era Demands a New Data Foundation: How Cisco is Delivering It with Splunk
- Cisco Empowers Organizations to Govern AI at Scale with Full-Stack Observability
- Evolving to Autonomous Defense: New Agentic SOC Capabilities
- Bringing the Power of AI to Where Your Data Lives: A New Milestone with Cisco and NVIDIA
- Splunk and AWS: Building the Agentic Enterprise Together
Additional resources:
About Cisco
Cisco (NASDAQ: CSCO) is the worldwide technology leader that is revolutionizing the way organizations connect and protect in the AI era. For more than 40 years, Cisco has securely connected the world. With its industry leading AI-powered solutions and services, Cisco enables its customers, partners and communities to unlock innovation, enhance productivity and strengthen digital resilience. With purpose at its core, Cisco remains committed to creating a more connected and inclusive future for all. Discover more on The Newsroom and follow us on X at @Cisco.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the
About Splunk LLC
Splunk, a Cisco company, helps build a safer and more resilient digital world. Organizations trust Splunk to prevent security, infrastructure and application issues from becoming major incidents, absorb shocks from digital disruptions, and accelerate digital transformation.
Splunk and the Splunk> logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at http://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word 'partner' does not imply a partnership relationship between Cisco or its affiliates and any other company.
View original content to download multimedia:https://www.prnewswire.com/news-releases/cisco-delivers-trusted-ai-at-scale-through-new-splunk-advancements-302878467.html
SOURCE Cisco Systems, Inc.
FAQ
AI-generated questions and answers. How Rhea-AI works. Not financial advice.
What is Cisco AI POD for Splunk and who can use it?
Cisco AI POD for Splunk is a new configuration in Cisco Secure AI Factory with NVIDIA that delivers Splunk AI to self‑managed environments using Cisco infrastructure, NVIDIA accelerated computing, and a Kubernetes‑based architecture. It is available today for Splunk Enterprise customers running on‑premises, in private cloud, or in air‑gapped environments, and partners such as bitsIO, Wipro, and World Wide Technology can help customers deploy it.
Which AI models can customers self‑host for Splunk Enterprise workloads?
Customers can self‑host a selection of open and proprietary generative AI models for Splunk Enterprise workloads, including the Cisco Deep Time Series Model, Google Gemma 4, and OpenAI GPT‑OSS 20B. NVIDIA Nemotron open models are expected to be available in the coming months.
How does Splunk Agent Observability’s Tokenomics capability help manage AI costs?
The Tokenomics capability in Splunk Agent Observability gives organizations a real‑time view of AI token spending by tracking and attributing token usage across AI agents and employee use of coding agents such as Claude Code, Codex, and Cursor. It also forecasts consumption patterns using the Cisco Deep Time Series Model so teams can see where spend is heading before a billing period ends and tie AI spending more directly to business outcomes.
Where is Splunk Agent Observability available?
Splunk Agent Observability, initially announced as an on‑premises offering, is now available in Splunk Observability Cloud and in Cisco Cloud Control, extending observability coverage for customers working across the Cisco portfolio.
What new observability features were introduced alongside the AI capabilities?
Cisco introduced the Observability Studio to help teams ensure new applications are “born observable,” plus a Network Intelligence App that brings Cisco network topology, device health, and events into Splunk so network teams can trace alerts to underlying devices and networks. New Essentials and Premier editions of Splunk Observability Cloud aim to simplify purchasing and expansion with cost‑effective log analytics for debugging applications and infrastructure.
How are Cisco and AWS expanding their relationship around Splunk and security?
Cisco’s Splunk and AWS have entered a multi‑year agreement for joint product development that focuses on advancing the agentic SOC to match the speed of AI‑driven attacks. Splunk contributes its data platform and detection depth, while AWS brings global cloud scale, with the goal of delivering agentic support for analysts across detection, investigation, and response while preserving governance and analyst control.