As businesses lean on AI for productivity gains and better customer experiences, security teams are struggling to secure this adoption. This challenge is further compounded by frontier AI models like Mythos. Not only are these models accelerating vulnerability discovery—leaving IT teams scrambling to secure aging hardware—they are also empowering enterprising IT engineers to spin up AI-powered agents to speed up operations.
“Yesterday’s insecure Python scripts have evolved into today’s insecure, autonomous IT agents.”
If we peel back the layers, while AI is a significant trend, security teams have weathered the internet era, the BYOD and mobility landscape, the age of cloud and cloud native adoption. And if there is one thing we have learnt, it is that security principles like least privilege access control are foundational to securing any new aspect of the technology landscape. These concepts are well rooted in architectural initiatives like NIST’s Zero Trust and are functional gaps that most organisations still need to close to secure the current AI era. (To see how these concepts translate into actionable architecture, explore my upcoming 4-hour Technical Seminars on Architecting Zero Trust and AI Security Playbook at Cisco Live Melbourne). To demystify this further, let’s understand why security practitioners exist. At the end of the day, security practitioners’ primary mission is to ensure least privileged access to business critical resources to prevent data mis-use or leakage. However insecure code, whether it is in our applications or the underlying infrastructure that runs them, manifests as CVEs that can be exploited, ultimately leading to inadvertent critical exposures.
If all software was bug free, hackers would have very few vulnerabilities to exploit, and security tooling would be way less complex, but as we are learning, from frontier AI models like Mythos, CVEs are on an upward trajectory for now and the time to patch is an unattainable 8 to 9 hours. So while we can aim to patch faster, our true goal should be limiting access to business-critical resources and the underlying code and infrastructure that runs them, thereby preventing unpatched or worse undiscovered CVEs from being exploited. This is where getting Zero Trust right at every layer becomes critical. This isn’t just a Cisco perspective—recent guidance from the CSA, SANS, and OWASP in their joint briefing ‘The AI Vulnerability Storm’ validates this exact approach. Their recommendations for securing the AI era rely heavily on establishing strict asset inventory and preventing lateral movement—which are, at their core, fundamental Zero Trust principles. Zero Trust principles are most commonly applied to the user layer (through the popular ZTNA), however as a concept Zero Trust is very extensible and can be easily applied to limit access to vulnerabilities at the application layer, the agentic and AI layer itself, and even down to every process, memory or file access at the kernel layer!
The Three Core Principles of Zero Trust for AI #
Founded in three core principles, a robust Zero Trust architecture requires us to execute the following phases comprehensively.
Inventory Inventory everything to establish baseline trust levels, after all you can’t protect what you can’t see.
Inventory Priorities
The user landscape: This means having a directory of users, their identities, how those identities are typically used, the applications they access, and what business-as-usual behavior looks like.Application production: For applications in production (and if possible, at the CI/CD pipeline itself), it is important to catalogue application intent and behavior, generating an application Bill of Materials (BoM) to ensure we know what libraries and versions it is composed of.Agentic AI: We can even extend this to agentic AI, establishing a directory of agents and agent identities (which will eventually outnumber our users) alongside AI application BoMs to understand the agents, data sources, LLMs, MCPs, and tooling they are composed of.Infrastructure vulnerabilities: Given infrastructure vulnerabilities are being exposed by AI, it is ideal to maintain a strict inventory of infrastructure, software versions, and a repository of network/cloud configs and infrastructure-as-code (IAC).
Enforce Enforce least privilege access control using the established baseline and inventories.
Enforcement Mechanisms
Zones and macro-segmentation: At the infrastructure layer in workplaces, data centers, and cloud environments, this is achieved through software-defined segmentation using solutions like Cisco ISE, ACI, or Nexus Smartswitches and cloud provider native group based segmentation policy constructs. Ideally this is best powered by a common policy orchestration tool like Cisco Security Cloud Control.Identity and attribute-aware controls: Allow users to access the resources they need based on established baselines by bringing identity controls to the network via Cisco Duo and ISE at every layer. This includes the native software defined infrastructure segmentation capabilities (in workplace, DC, cloud), the edge (campus, cloud, dc) through firewalls like Cisco FTD, and the security services edge (SSE) through Cisco Secure Access, and all the way into the application layer through workload security solutions like Cisco Secure Workload.Microsegmentation: Enforce limits at the workload layer guided by application intent and dependency maps using technologies like Cisco Secure Workload.Safe kernel technologies: eBPF can control not only network communication but also process, memory, and file access, thereby making process levelnanosegmentationa reality.The AI agent layer: Limit agent identities to resources based on intent through Cisco Duo & Cisco Identity IntelligenceThe AI prompt layer: Instrument prompt-leveladaptive guardrailsvia agent, MCP and LLM gateways powered by Cisco AI Defense.
Detect and respond Detect any deviations from baseline and respond. This is where the feedback loop closes and dynamic responses prevent a full-scale SOC incident response escalation.
Response Scenarios
Identity anomalies: If a user’s identity shows up in an unseen location or in multiple locations simultaneously, Cisco Identity Intelligence catches this and directs Cisco Duo to prompt for a step-up authentication.Agent identity drift: If an agent identity drifts into unintended behavior, Cisco Identity controls can detect this and shut down the agent or use MCP gateways in Cisco Secure Access or AI Defense to prevent the undeclared intent.New vulnerabilities: When a new CWE/CVE is released in an application, Cisco Secure Workload groups the vulnerable micro-services into a higher risk category, treating it as quarantined until patched, and then automatically reclassifying it to BAU policy.Kernel-level shields: While eBPF is popularized by Cisco Isovalent, it can easily make use of the nanosegmentation concept to deliver surgical shields that bridge the gap between when a vulnerability is uncovered and when an organization can actually patch.Infrastructure protection: The same eBPF shield concept powers features likeLiveProtectnow being introduced in Cisco products to prevent unpatched vulnerabilities in Cisco infrastructure products from being exploited till they can be safely patched.
Achieving the Architectural Vision #
The above may all sound like pipedream, as most organisations struggle with Zero Trust programs and undelivered microsegmentation projects. However, Zero Trust and segmentation projects are being accelerated by AI powered tooling. Cisco is leading the AI powered Zero Trust platform race, with a common AI powered policy decision point (PDP in ZT verbiage) in Security Cloud Control, driving intent based policy into a mesh of policy enforcement points (PEPs) at every layer – from smart switches to firewalls (both Cisco and 3rd party), Security Services Edge, Workloads, Cloud provider native firewalls, cloud native Kubernetes service mesh, and into kernel level ebpf implementations on workloads and network infrastructure. AI assistance drives administrator declared intent into topology aware rules pushed to above PEPs via common interfaces. Ultimately AI driven platform approach is what makes Zero Trust achievable for the frontier AI era.
As for our most topical AI model – Mythos. While everyone is focussed on AI fueled vulnerability discovery, we now know from above that while patching is essential, its critical to get back on the Zero Trust bandwagon to limit our exposure. There is no silver bullet but to get our basics of least privilege access right.
On the positive side, AI is actually involved in the entire software lifecycle, not just the well-publicised vulnerability discoveries, but actually helping us fix vulnerabilities and even improve overall code quality.
As one of the launch partners for Anthropic’s Project Glasswing, Cisco’s early access to Mythos led to a few innovations. Firstly, our current disclosure model has been revamped to alleviate patching cycles and released as a more predictable risk-based disclosure model. Secondly, frontier AI models like Mythos are only as good as the agentic harness that drives them which led us to create and open-source Foundry security spec. Cisco has also been using AI, prior to Mythos to accelerate code development, but more importantly generate secure code and improve overall code quality, which led to Cisco donating Project CodeGuard to COSAI. In fact Cisco has also launched Antares SLMs which can further aid security practitioners and developers in vulnerability discovery when paired with Foundry security spec and fixing them securely using CodeGuard. There are also AI powered capabilities like Cisco IQ to discover vulnerable infrastructure, that works with Cisco Cloud Control, which is a new unified operations platform to aid in AgenticOps and patching at scale. And as we discussed there are features like LiveProtect to alleviate the gap between vulnerability discovery and patching.
Even with all these innovations, the patching gap is here for the foreseeable future. This is exactly why achieving a Zero Trust Architecture for the frontier AI era has transitioned from a best practice into an absolute operational imperative. Explore the Cisco Live Melbourne session catalog to add my 4-hour Technical Seminars—focusing on Architecting Zero Trust and the AI Security Playbook—to your schedule and start building your resilient architecture today.