How Cisco Duo Agentic Identity Tackles Enterprise AI Risks

Key takeaways

• Traditional identity and access management (IAM) models fail with autonomous AI agents because static credentials and service accounts lack action-level inspection.
• Cisco introduced Duo Agentic Identity to treat autonomous agents as first-class identity objects in Cisco Duo Directory, mapping every agent to an accountable human sponsor.
• Zero Trust principles have been adapted for non-human actors through continuous verification, network-level discovery via Cisco Identity Intelligence, and tool call gating via Model Context Protocol (MCP) gateways.
• Broader ecosystem initiatives include runtime inspection in Cisco AI Defense, AI-aware SASE network policies, the open-source DefenseClaw inventory framework, and AgenticOps workflows.
• IT leaders face an enterprise trust gap, requiring governance frameworks that balance operational latency, policy maintenance overhead, and developer adoption.

Enterprise IT leaders confronting agentic AI security face a structural challenge: autonomous software agents are entering production environments without standard identity lifecycles, clear ownership, or granular access boundaries. To address this governance void, Cisco has introduced Duo Agentic Identity alongside an expanded security architecture that adapts Zero Trust principles to non-human autonomous systems. By classifying agents as first-class directory objects mapped to human sponsors and intercepting tool execution through Model Context Protocol (MCP) gateways, Cisco aims to shift enterprise security from static credential management to real-time, per-action verification across corporate networks.

Architectural Failure: Why Static IAM Cannot Govern Autonomous Systems

Enterprise access control systems were built on an assumption that identities fall into two predictable buckets: human employees who authenticate periodically, and service accounts tied to well-defined software integrations. Human identities undergo formal onboarding, role-based access assignment, and periodic compliance reviews. Machine identities, managed through service accounts and long-lived API keys, execute predictable tasks between fixed endpoints.

Autonomous AI agents break both models. Unlike static software, an agent interprets goals, plans multi-step tasks, queries disparate data stores, calls external APIs, and drafts or sends communications without requiring human intervention for every step. When developers deploy these systems to accelerate development or business operations, the agents frequently inherit broad ambient credentials from their hosting environments. A single inherited token can grant an agent unrestricted read, write, and export access across enterprise systems, creating a major corporate blind spot.

According to Matt Caulfield, Vice President of Product for Identity at Cisco, legacy non-human identity tools cannot manage this operational profile because they were built for predictable, static entities rather than the per-action and per-session governance that autonomous agents demand. This disconnect creates an expanding governance gap as software teams adopt autonomous frameworks faster than security teams can write administrative policy. Addressing this vulnerability requires closing the market solutions addressing the agentic defense gap through architectural controls rather than administrative prohibitions.

Adapting Zero Trust: Visibility, Identity Objects, and Directory Governance

Cisco’s response centers on extending Zero Trust architecture to non-human actors through three operational requirements: never extend implicit trust, never grant more trust than a specific subtask requires, and continuously verify granted trust. Translating these tenets into enterprise infrastructure requires establishing continuous discovery and establishing clear lifecycle accountability.

The first hurdle is shadow AI agents. In many enterprise environments, developers run proof-of-concept agents on local workstations or cloud instances that connect directly to production backends without central registration. Standard identity systems fail to detect these actors because they only log systems that explicitly submit authentication requests. Cisco circumvents this limitation by combining Duo identity telemetry with network-level inspection through Cisco Identity Intelligence. By monitoring network communication patterns across workloads, the platform discovers active agents the moment they transmit traffic, generating a real-time inventory of non-human entities.

Discovery, however, is ineffective without governance. Under Cisco’s Duo Agentic Identity framework, every discovered agent must be onboarded into Cisco Duo Directory as an independent identity object. Rather than functioning as an anonymous proxy for a service account, the agent receives an assigned human sponsor, an explicit operational role, and policy group memberships. Every transaction logged in the environment ties directly back to that human owner, establishing an audit trail from automated action to organizational accountability.

Action-Level Enforcement Through Model Context Protocol Gateways

Overprivileged permissions represent the most severe failure mode in agentic deployments. When an autonomous system receives unrestricted access to an API or database, a prompt injection attack, data corruption event, or reasoning error can trigger destructive actions across downstream infrastructure. Mitigating this risk requires access control to evaluate individual function calls rather than entire operational sessions.

Cisco achieves granular control by placing an authorization gateway directly in the communication path between agents and their external execution tools. Operating with native support for OAuth 2.1 standards and Anthropic’s open Model Context Protocol (MCP) integration, the gateway intercepts every tool request before execution. Rather than asking whether an agent has authorization to connect to a customer relationship database, the gateway’s policy engine assesses whether the agent may take a specific action under current environmental conditions.

Get the Weekly Brief

Curated analysis for tech leaders. Every Thursday.

Subscribe

For example, an agent assisting customer support may have permission to query a specific client record, but the gateway can actively block any bulk export attempt. Similarly, an agent may be permitted to draft outbound email responses or configuration scripts, while policy rules require a human operator to sign off before transmission. By enforcing OAuth-based guardrails with time-limited delegation, the architecture limits the blast radius of compromised or malfunctioning agents.

The Supporting Architecture: AI Defense, SASE, and DefenseClaw

Identity controls form only one layer of an enterprise defense model. Cisco has integrated Duo Agentic Identity into its broader security and networking portfolio to provide multi-tier runtime inspection and workload monitoring.

At the runtime layer, Cisco updated its AI Defense platform with supply chain governance and behavioral defenses. As agents chain multiple model calls and external packages together, AI Defense monitors the agentic supply chain for poisoned dependencies, model tampering, and data leakage. Concurrently, Cisco integrated AI-aware security telemetry into its Secure Access Service Edge (SASE) architecture, enabling corporate network gateways to detect, categorize, and optimize traffic generated by autonomous agent clusters across distributed infrastructure.

To assist security operations teams with the burden of tracking non-human assets, Cisco also launched DefenseClaw, an open-source framework detailed by Network World’s coverage of Cisco AI security. DefenseClaw provides automated inventory tracking and risk posture assessment for AI agents across multi-cloud workloads, establishing visibility before teams deploy commercial governance platforms. These capabilities align with Cisco’s broader computing push, including infrastructure deployed under its rack-scale Secure AI Factory infrastructure.

Operational Realities and the Enterprise Trust Gap

While technical controls provide the scaffolding for safe deployment, enterprise adoption faces practical organizational barriers. Industry reporting from TechTarget highlights an enterprise trust gap, where senior leadership hesitates to grant autonomous systems authority over core operations due to unpredictable failure modes and unclear liability.

Cisco is attempting to bridge this divide through its AgenticOps initiative, which uses automated security workflows and threat response while maintaining continuous human oversight. However, enterprise architects must weigh several trade-offs before implementing inline agent governance:

• Latency Overhead: Routing every intermediate tool invocation through an MCP gateway and policy evaluation engine introduces millisecond latency. In high-frequency workflows or multi-agent swarms executing dozens of serial tool calls, cumulative latency can degrade application performance.
• Policy Administration Complexity: Writing and maintaining fine-grained policies per tool call requires significant administrative effort. Security teams risk creating authorization bottlenecks if policies are overly restrictive, or creating security exposures if policies are broadly drafted to avoid developer friction.
• Ecosystem and Protocol Dependency: While native MCP support ensures vendor neutrality across supported agent frameworks, non-standard enterprise applications and legacy internal APIs may require custom middleware or proxy adapters to interface with Cisco’s gateway.
• False Positives in Action Blocking: Automated evaluation of non-deterministic model behavior can misinterpret benign parameter variations as malicious attempts, interrupting legitimate business automation and requiring administrative overrides.

Bottom line

Deploying autonomous AI agents without rigorous identity management introduces substantial security exposures across enterprise networks. Cisco’s Duo Agentic Identity framework establishes a practical model for governance by combining network-level discovery, directory object accountability, and per-action MCP authorization. Enterprise IT leaders should begin by running automated inventory assessments to locate shadow agents across development clusters, establishing formal human sponsorship for active systems, and piloting action-level policy gating on non-critical workflows before granting agents autonomous write permissions on production databases.

Sources

• How Cisco is confronting the security crisis of agentic AI – ZDNET
• Cisco Redefines Security for the Agentic Era with AI Defense Expansion and AI-Aware SASE
• Cisco goes all in on agentic AI security | Network World
• Secure the AI agent ecosystem with Duo | Cisco Duo
• Cisco agentic AI security push faces enterprise trust gap | TechTarget
• What is agentic AI Security? Framework & implementation | Cisco Duo