In short: Cisco AI Defense secures the AI applications, models and agents an organisation builds and uses. It discovers AI assets in the cloud, scans the AI supply chain, red teams models with algorithmic testing, and enforces runtime guardrails against prompt injection, harmful output and data leakage, with Secure Access controlling third-party AI apps.
What is Cisco AI Defense?
Generative AI creates risks that traditional security tools were not built for. Models can be tricked by prompt injection, leak personal or confidential data in their answers, produce harmful content, or arrive from public repositories with malicious code inside. AI agents add another layer: they call tools, use MCP servers and take actions, so a manipulated agent can do real damage.
Cisco announced AI Defense in January 2025 to address this, and has since extended it to agentic AI systems and the Model Context Protocol (MCP). It covers the whole AI life cycle, from development through to production, and is updated with attack data from Cisco's AI threat research team and Cisco Talos. It is also one of the enforcement points in Cisco Hybrid Mesh Firewall.
What it does
| Capability | What it covers |
|---|---|
| AI inventory and visibility | Discovers models, agents, MCP servers and connected data sources across cloud environments, including Amazon Bedrock, Google Vertex AI and Azure AI Foundry; maps ingress, egress and east-west AI traffic and flags unprotected assets for scanning and guardrails |
| AI supply chain risk management | Scans model files, repositories, datasets, MCP servers and tools for malicious code, poisoned data and unsafe components, and scores each asset for allow or block decisions |
| AI model and application validation | Algorithmic red teaming that probes a model, application or agent with a large library of attack techniques across text, image and audio, in multiple languages, and produces a vulnerability report and model-specific guardrails |
| AI runtime protection | Inspects prompts and responses in real time for prompt injection, denial of service and malicious URLs; for personal, payment card and health data, source code and model information; and for toxic or harmful content |
| AI Access | Visibility and policy for employee use of third-party AI apps, delivered with Cisco Secure Access, to stop sensitive data reaching shadow AI |
Because enforcement happens at the network level, Cisco says AI Defense does not need agents or code libraries inside each application. Guardrails cover API calls as well as outbound and internal traffic between services and AI applications, and an events dashboard shows each violation with the prompt and response involved.
Securing AI agents and MCP
Agents and MCP are where Cisco has extended AI Defense most recently. Cisco's current datasheet describes:
- Agent and MCP discovery: mapping which agents use which tools and MCP-connected workflows, to surface unsanctioned agent activity
- MCP server and tool scanning before they reach development or production
- MCP runtime enforcement: watching requests and responses between models, agents and tools, and enforcing tool allow and block lists by risk score
- Agent behaviour protection: detecting and blocking unauthorised tool use, privilege escalation, harmful chains of actions, intent hijacking and memory poisoning
Supply chain scanning feeds the runtime side: each model, tool or MCP server gets a risk score, and those scores drive the allow and block decisions applied when an agent tries to use it.
Deployment, standards and integrations
- Data stays put: in VPC and on-premises AI POD deployments, application, model and agent data stays in your environment and only the metadata needed for management goes to Cisco
- Cloud integration: AI Defense integrates with Multicloud Defense to protect AI applications running in your public cloud accounts
- Frameworks: findings and protections map to the NIST AI Risk Management Framework, MITRE ATLAS, the OWASP Top 10 for LLM applications and the OWASP Top 10 for agentic AI, and to Cisco's own AI Safety and Security Framework
- SOC integration: AI Defense connects to security consoles such as Splunk, so analysts using Splunk Enterprise Security can see AI threats with everything else
- Explorer Edition: a self-service way for AI builders to red team an application quickly and get a report for security review, before moving to the full enterprise product
Why it matters for UK organisations
In the UK, personal data that flows through prompts and model outputs is still covered by UK GDPR, so a chatbot that leaks customer details is a data protection incident like any other. The NCSC's guidelines for secure AI system development, published with international partners in November 2023, are organised around four stages (secure design, development, deployment, and operation and maintenance) and call for threat modelling, supply chain security, protection of models and infrastructure, and logging and monitoring. Those map closely to AI Defense's discovery, scanning, validation and runtime controls. Boards are also asking security teams for evidence that AI pilots were tested before launch; red teaming reports give you that evidence.
Who it suits and how we help
AI Defense suits organisations building their own AI applications or agents on cloud AI platforms, and those deploying AI assistants to staff or customers who need guardrails and an audit trail. If your main concern is staff pasting data into public AI tools, start with AI Access through Secure Access; see Secure Access licensing for how it is packaged.
We help you inventory AI use, red team priority applications, set guardrail policy that blocks real threats without breaking the user experience, and connect events to your SOC. AI Defense is one of the Hybrid Mesh Firewall enforcement points but is not in the Cloud Protection Suite packages, so it is quoted separately. Pricing depends on scope, so ask us for a quote. Contact us to discuss your AI security plans.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Cisco AI Defense?
Cisco AI Defense is a security product for enterprise AI. It discovers AI models, applications and agents, scans the AI supply chain, red teams models, and applies runtime guardrails against prompt injection, harmful output and data leakage. AI Access, delivered with Secure Access, controls staff use of third-party AI apps.
When did Cisco launch AI Defense?
Cisco announced AI Defense on 15 January 2025, and said it would be available from March 2025. It has since been extended to cover agentic AI, including AI agents, their tools and MCP servers.
Does Cisco AI Defense protect AI agents?
Yes. It discovers agents and MCP-connected tools, scans MCP servers, enforces tool allow and block lists at runtime based on risk scores, and detects agent misuse such as unauthorised tool calls, privilege escalation and memory poisoning.
What is AI red teaming?
AI red teaming means attacking an AI model or application on purpose to find weaknesses before real attackers do. Cisco AI Defense automates it with algorithmic testing across many attack techniques, and its Explorer Edition lets AI builders run a self-service test first. The result is a vulnerability report plus model-specific guardrails.
Do I need Cisco Secure Access to use AI Defense?
Not for protecting the AI applications you build. Secure Access is used for AI Access, which governs employee use of third-party AI apps and stops sensitive data reaching them.