Workday Agent Passport, now in Early Access, gives customers a signed, auditable record of what has been verified about an agent, who verified it, and to what standard. Cisco AI Defense, Agent Passport’s launch assessor, provides adversarial testing behind the security stamps on agents Workday develops. Here is what we have learned, and why it matters for every agentic platform.
In June, Workday introduced Agent Passport at Workday DevCon with Cisco as its launch partner. Last week, Workday announced that Agent Passport is in Early Access. Workday is holding its own agents to the bar first, working with Cisco AI Defense to test the agents it builds and ships.
Agents are no longer just features inside applications. They hold credentials, call tools, and write to systems of record. Until recently, the only way to approve one was a security questionnaire and the vendor’s word. That is a static answer about a system that does not hold still.
Workday’s Agent Passport replaces the answer with a record. Its security stamps come from our Cisco AI Defense adversarial testing, including prompt injection resistance and jailbreak resistance, and our results carry standards mappings to the Open Worldwide Application Security Project (OWASP) Top 10 lists, MITRE ATLAS, and the National Institute of Standards and Technology (NIST) frameworks.
How evidence reaches the customer: Workday defines the stamps*, Cisco tests the agent** s Workday develops against public industry standards**, and* Workday issues the stamp the customer uses to decide how an agent is deployed*.*
#
Building agents safely and testing agent for production readiness
Most security teams test an AI system the way they test software: run a scan, read the results, fix what it found. That works for an application that holds still. An agent can pass every prompt in a test bank and still leak data on the fifteenth turn of a conversation, after an attacker has moved the context one step at a time. Real attackers probe, adapt, and escalate, and each turn looks harmless on its own.
A test bank written for every agent finds only what is wrong with every agent. It will not find the support agent that can be talked into refunding the wrong person. That is not jailbreak. That is the agent doing its job, for an attacker.
So, context decides what a test is worth. A healthcare scheduling agent and a financial advisory agent fail in different ways, because they are for different things, reach different tools, and carry different permissions. Adaptive red teaming in Cisco AI Defense starts there. It studies what the agent is for, what it can reach, and which guardrails stand in front of it, derives the outcomes that agent must never produce, then pursues them across many turns, pivoting when one approach is blocked. The question stops being whether the agent fails a known attack and becomes what an attacker who reads your documentation would try.
That is also how resilience scales as agents multiply. Nobody can hand-write a test plan for every agent in an enterprise, and nobody has to, because the goals come from each agent’s own context. Standardized testing against published frameworks provides breadth: wide coverage, comparable results, something an auditor can repeat. Adaptive testing provides depth on the agents that matter most.
Scaling beyond verification with end-to-end agent lifecycle security #
Cisco AI Defense covers the full life of an agent rather than a single gate. We find the AI Assets already in your environment, including the agents and models nobody registered. We check what an agent is built from, so a compromised model or tool server is not your problem later. We simulate adversarial testing of agents before they are deployed, using their actual tools, context, and intended behavior and re-test them as the agent, its dependencies, or its environment changes.
We enforce guardrails to live in production, across the agent’s traffic to its model, its tools, and other agents. And we turn red team findings into the guardrails that block them, so a finding ends in a defense rather than a report. It runs where your data has to live, in our cloud or your own, and either way you consume it: run our platform directly or build it into your own product. That is why these matters beyond one integration. Agents will be bought from marketplaces, vendors, and partners, and this market has not built a credible way to know what you are letting inside. Independent testing feeding a trust layer the customer can check is a pattern every platform with an agent ecosystem will need.
Agents will scale in the enterprise exactly as fast as customers can trust them. Workday and Cisco are putting this into practice with Agent Passport in Early Access. If you are building an agentic platform, we want to be part of your next conversation.
Learn more #
- Cisco AI Defense: [cisco.com/go/ai-defense](http://cisco.com/go/ai-defense)
- Workday Agent Passport: [https://www.workday.com/en-us/ai-platform/agent-passport.html](https://www.workday.com/en-us/ai-platform/agent-passport.html)
- Workday’s Early Access announcement: [https://blog.workday.com/en-us/agent-passport-owner.html](https://blog.workday.com/en-us/agent-passport-owner.html)