Cisco

Primary category: network-security-sase. Cisco is the network/security incumbent assembling an AI-security stack mostly by acquisition.

One-liner — The networking and enterprise-security incumbent that, via splunk (SIEM), cisco-ai-defense (the former robust-intelligence), galileo (AI observability/eval) and a pending buy of astrix-security (non-human identity), is stitching together an end-to-end “secure the AI” platform.

What it does — Cisco’s relevance here is twofold. (1) Its network-security/SASE estate (Secure Access, Umbrella, Firewall, Duo, Identity Intelligence) is the TLS-inspecting plumbing many enterprises already run — see network-security-sase. (2) It has bought its way into AI security: model/prompt runtime defense and red-teaming (Cisco AI Defense), AI agent observability and guardrails (Galileo, folding into Splunk Observability), SIEM/SOC (Splunk), and — pending — agentic/non-human identity (Astrix). The pitch is one vendor spanning network, identity, SOC, and AI-model security.

Where it sits in the stack — Spans several layers: network-security-sase (foundation egress/inspection), siem-soc via splunk, ai-runtime-security and ai-red-teaming via cisco-ai-defense, llm-observability/guardrails via galileo, and non-human-identity via astrix-security (pending). Across the portfolio it screens untrusted input (AI Defense prompt-injection defense), protects sensitive data (DLP/inspection), and controls outbound data flows (SASE, AI gateway controls).

Deployment & architecture — Mixed: on-box and cloud-delivered network security (inline proxy / man-in-the-middle TLS inspection), SaaS for Duo/Identity Intelligence/Secure Access, Splunk as SaaS or self-hosted, and API/SDK-delivered AI Defense guardrails. Telemetry from the acquired AI-security products is being funneled into Splunk as the SOC backbone.

Positioning & differentiators — Breadth and incumbency, not best-of-breed in any single AI-security niche. The differentiator is consolidation: a shop already running Cisco networking + Duo + Splunk can add AI Defense and (eventually) Astrix without onboarding new vendors. The tradeoff is integration debt — these are recently acquired, separately-built products still being knit together.

Ownership, funding & M&A

Cisco is a public company (NASDAQ: CSCO), founded 1984, HQ San Jose, CA. It is the acquirer in four AI-security-relevant deals flagged by the seed — all verified:

• splunk — completed 2024-03-18, ~$28B (announced 2023-09-21). Largest acquisition in Cisco history. Confirmed (high).
• robust-intelligence → cisco-ai-defense — intent announced 2024-08-26, closed ~2024-09-24. Robust Intelligence’s tech became Cisco AI Defense / Foundation AI. Confirmed (high).
• galileo — intent announced 2026-04-09; secondary press reports completion 2026-05-22 (Cisco’s own note said expected close Q4 FY2026). Confirmed announced (high); close date medium.
• astrix-security — intent announced 2026-05-04; not yet closed as of 2026-06-28. Terms undisclosed (press cites ~$400M, unconfirmed). Confirmed as intent (high); completion pending.

CTO / hedge-fund lens

Most funds already touch Cisco somewhere (network gear, Duo MFA, or Splunk). That makes Cisco a natural consolidation play: if you run Splunk for SIEM (Day-1) you can evaluate Cisco AI Defense and Astrix as add-ons rather than net-new vendors. But don’t assume the AI-security pieces are mature just because Cisco owns them — they are freshly acquired. Evaluate Cisco AI Defense and Galileo on their own merits against best-of-breed neighbors. SR 11-7 / model-risk relevance is indirect (via AI Defense red-teaming and Galileo eval logs feeding evidence), not a governance platform in itself.

Competitors / alternatives

palo-alto-networks (the closest mirror-image roll-up: Prisma AIRS, Cortex, CyberArk), crowdstrike, zscaler, netskope, microsoft-sentinel (vs Splunk).

Open questions / to verify

• Confirm Galileo deal close with a Cisco primary (intent + secondary close found; Cisco closing PR not yet located).
• Track Astrix close (pending); confirm final terms if disclosed.

Sources

• Cisco Blogs — Intent to Acquire Astrix Security — fetched 2026-06-28 — supports: Astrix intent 2026-05-04, NHI/agentic identity, Splunk/Duo/Identity Intelligence integration; confidence: high
• Cisco Blogs — Intent to Acquire Galileo — fetched 2026-06-28 — supports: Galileo intent 2026-04-09, AI observability/guardrails into Splunk Observability; confidence: high
• Cisco Blogs — Intent to Acquire Robust Intelligence — fetched 2026-06-28 — supports: Robust Intelligence announced 2024-08-26, basis of Cisco AI Defense; confidence: high
• Network World — Cisco completes $28B Splunk acquisition — fetched 2026-06-28 — supports: Splunk close 2024-03-18, $28B; confidence: high

History

• [2026-06-28] Stub created from seed registry.
• [2026-06-28] Researched; confirmed Cisco is public (CSCO) and the acquirer of Splunk (closed 2024-03-18, $28B), Robust Intelligence (closed ~2024-09-24 → Cisco AI Defense), Galileo (announced 2026-04-09, reported closed 2026-05-22) and Astrix Security (intent 2026-05-04, pending). Added siem-soc category. Set ownership=public, confidence high.