Cisco DefenseClaw – Bringing Zero Trust to AI Agents

The Agent Paradox: Everyone's Building, Few Are Shipping

There's a number that tells the whole story. At RSA Conference 2026 in late March, Cisco revealed a sobering stat about enterprise AI adoption: 85% of organizations are actively testing AI agents right now. But only 5% have deployed them at scale. That 80-point gap isn't a technology problem. It's a security problem.

Cisco's response was DefenseClaw – an open-source framework that treats AI agent security the way enterprise security should treat everything else: with zero trust, granular controls, and complete visibility.

The timing matters. As agents move from prototype to production, organizations are hitting a wall. The more autonomous these systems become, the higher the stakes. One misconfigured agent or compromised connection can cascade through entire workflows. Security teams won't approve broad deployment without guarantees they can see what's happening, lock things down fast, and trace every action back to an owner.

DefenseClaw is built for that world.

What DefenseClaw Actually Does

Think of DefenseClaw as the governance layer that turns "we could do this with agents" into "we should deploy agents."

The framework is free, open-source, and installable in about 5 minutes from GitHub (cisco-ai-defense/defenseclaw). It comes with four core scanners that work together:

Skills Scanner examines every capability an agent might use – looking for malicious code, unsafe patterns, or known vulnerabilities embedded in those skills.

MCP Scanner validates Model Context Protocol servers before the agent ever connects to them. This prevents compromise before it starts.

AI BoM (Bill of Materials) automatically catalogs what the agent does, what it touches, and what resources it consumes. Think of it as a manifest of agent capabilities and dependencies.

CodeGuard watches the agent's output in real-time, scanning for malicious code that the agent itself might generate – catching accidental or adversarial outputs before they reach production.

The most visceral feature, though, is permission management. You can block a problematic MCP server in 2 seconds. No restart. No deployment pipeline. Just immediate lockdown while you investigate what went wrong.

That speed matters more than it sounds. When an agent starts behaving unexpectedly, the difference between "we can pause it in seconds" and "we need to restart the whole system" is the difference between containment and catastrophe.

Zero Trust for Agents

Enterprise security has been moving toward Zero Trust for years – the principle that you verify everything, trust nothing by default, and grant the minimum access needed for each operation. Cisco's argument here is straightforward: agents need the same treatment.

That means three things:

Agent identity management: Each agent gets a unique identity, tied to who owns it, what it's allowed to do, and when. It's not "this is an agent" – it's "this is Agent-12, owned by Sarah in Finance, with purchase approval authority between 9am–5pm on weekdays."

Discovery and inventory: Organizations need to know exactly how many agents exist, what they're connected to, and what they're doing. You can't secure what you can't see.

Strict access controls: Every action is gated by policy. Not just "can it access this API" but "can it access this API at this time, for this duration, under these conditions?"

Cisco implements this through Cisco Identity Intelligence and Duo IAM. They register the agent, map it to a human owner, and enforce time-bound permissions. An organization could set a policy like: "The procurement agent can approve purchases up to $50,000, but only between 8am–6pm, Monday through Friday, and only if the vendor is pre-approved."

Principle	Traditional IT	Agent Security
Trust Model	Trust employees, verify at perimeter	Zero trust by default for all agents
Identity	User account tied to person	Agent identity tied to owner and purpose
Permissions	Role-based access	Granular, time-bound, context-aware
Auditability	Session logs	Complete action trace

Testing, Discovery, Red-Teaming

For organizations that want to go deeper, Cisco offers AI Defense Explorer Edition – a self-service platform where you can test your own models and run red-team exercises. You don't need to hire security consultants to find the weak points in your agent logic. You can discover them yourself.

If you need to bake security directly into agent behavior, there's the Agent Runtime SDK. This lets you embed security policies into the agent's workflow itself – adding validation steps, access checks, and audit hooks directly into how the agent reasons and acts.

The combination means you can secure agents in production environments where they run isolated workloads, not connected to other systems.

NVIDIA Partnership: Sandbox Everything

Cisco announced plans to integrate with NVIDIA OpenShell, which will let agents run in true isolation – a sandboxed environment completely separated from production. You can test agent behavior in a confined space before bringing it into your actual infrastructure.

"DefenseClaw is the enterprise governance layer built on top of OpenClaw, the open foundation from the community. It adds the controls, visibility, and management that enterprises actually need."

This layering is smart architecture. Open-source projects provide the foundation and innovation velocity. Enterprise frameworks add the control and accountability that large organizations require.

Splunk Integration: Telemetry and Detection

DefenseClaw feeds all its signals into Splunk for SIEM integration. Every scan result, every permission check, every unusual behavior gets logged in your security monitoring system.

Your security ops team can build dashboards that track agent activity in real-time. They see which agents are requesting what resources, which policy violations are happening, which agents are behaving outside their normal patterns. The telemetry becomes part of your unified security posture.

This is important because it means agents aren't a separate security problem – they're integrated into the broader observability and response infrastructure that's already in place.

Why Now? The 5% Problem

The statistic Cisco highlighted keeps appearing because it's real. Organizations have proven the value of agents – they work, they're useful, they handle things humans shouldn't have to. But deployment at scale requires something agents didn't have before: governance that's actually trustworthy.

Five percent deployment isn't a ceiling because the technology isn't ready. It's a ceiling because the security isn't ready.

The top barriers aren't "can we build agents" – they're "can we see what they're doing," "can we control what they access," and "can we hold someone accountable when something goes wrong."

DefenseClaw tackles all three.

What Changes?

From a practical standpoint, this framework gives security teams three new capabilities:

Visibility: You know exactly what agents exist, what they're connected to, and what they've done. Full inventory. Complete audit trail.

Control: You can enforce policies that are granular enough to matter – not just "this agent can access the database" but "this agent can query the database for records created in the last 30 days, but only when the request comes from an approved user, and only log what it retrieves."

Response: When something goes wrong, you can isolate it in seconds. Block a connection. Revoke permissions. Pause an agent. Without disrupting the rest of your infrastructure.

The downstream effect is that you can actually deploy agents. The approvals come faster. The risk feels manageable. The compliance questions have answers.

Current State	With DefenseClaw
85% testing, 5% production	Faster path from test to production
Manual security review	Automated scanning and governance
No agent-level identity	Each agent has verified identity and owner
Reactive breach response	Real-time policy enforcement

How It Gets Adopted

DefenseClaw being open-source matters. Any organization can download it, install it, and start using it. Five minutes to deployment. No vendor lock-in. No licensing negotiations.

Teams that want more – centralized dashboards, time-bound permissions, integration with identity systems – can layer in Cisco's commercial products. Identity Intelligence. Duo IAM. But the foundation is free and community-driven.

Teams that need custom policies or want to embed security logic directly into their agents can use the Agent Runtime SDK. It's Lego blocks – you can assemble them into whatever compliance structure your organization needs.

The Bigger Picture: Security as the Adoption Gate

Here's what this actually signals: security is no longer a feature of AI agent adoption. It's the gate.

We've passed the point where the question is "can we build agents?" We're now at "can we govern them?" And more importantly, "will our security team approve this?"

DefenseClaw is the answer to that second question. It provides the infrastructure, visibility, and control that makes "yes" defensible.

The real shift is that agents were blocked from enterprise adoption by uncertainty, not by capability. DefenseClaw removes the uncertainty. And when that happens, deployment accelerates.

Further reading: