Cisco is pairing its network telemetry with OpenAI‘s frontier models to give security defenders visibility and response speed that match AI-driven attackers. In an article featuring Cisco president and chief product officer Jeetu Patel, the company argues that as adversaries use AI to automate attacks and build exploits at machine speed, defense must shift from a single security perimeter to controls distributed across microservices, containers, and clusters.

Cisco says it can put a mini security stack in front of every microservice, Kubernetes container, and Kubernetes cluster, fusing security into the fabric of the network. Application-level controls restrict each service to the connections it needs, reducing the paths an attacker can use to spread. Affected systems can be isolated selectively, letting unaffected services keep running while teams investigate and respond. Combining that network intelligence with OpenAI‘s models lets Cisco correlate signals at machine scale; Patel notes that two signals which seem benign in isolation can together reveal a meaningful pattern.

Patel highlights a pressing challenge: the gap between how quickly attackers exploit a vulnerability and how long organizations take to patch it. He sees AI as a way to narrow that gap by giving defenders more capacity to investigate threats and respond faster. In his words, “AI hands attackers speed and scale. Using AI for defense is a prerequisite for staying safe.”

Cisco points to initiatives like Daybreak and GPT-6 Astra as step-function improvements for both its own security posture and its customers’. Patel says Cisco can find and patch vulnerabilities more efficiently while shortening the time needed for investigation, response, and remediation. He also emphasizes that these capabilities can fit into existing scanning workflows, so teams do not have to fundamentally change how they work.

As agents become more autonomous, Cisco is focusing on how security teams can distinguish malicious interference from an agent pursuing a legitimate goal in an unintended way. That requires security telemetry alongside observability data so teams can assess both threats and agent behavior. Patel outlines three priorities: protect agents from malicious attacks, detect and intercept unintended behavior, and operate in near real time, with policies and controls that can adapt as agents act.

On the data side, Cisco says OpenAI‘s enterprise privacy approach—zero data retention, strict customer data boundaries, and verifiable isolation—allowed it to deploy frontier intelligence across mission-critical systems without compromising customer priorities or sensitive telemetry. Through the Daybreak Defense Network, Cisco and OpenAI are exploring how to help security teams triage exposure faster and enforce the right controls in Cisco Cloud Control. Patel’s conclusion is that OpenAI is shifting the advantage to defenders by allowing them to operate at machine speed and scale.