Cisco Expands AI Agent Security With Astrix and WideField Deals

Cisco is expanding its identity security solutions as more organizations allow AI agents to access business systems, data, and internal tools.

Cisco completed its acquisition of Astrix Security on June 29, 2026, following the initial announcement in May. The company also plans to acquire WideField Security and intends to integrate its technology with Splunk. Both transactions target security challenges related to various non-human identities.

AI agents now perform tasks previously handled by humans, such as querying databases, updating records, calling APIs, and initiating workflows across applications. 

Organizations may know a token or service account was used, but not which agent accessed it, who owns the agent, whether permissions remain appropriate, or how its behavior changed during a session.

Astrix adds non-human identity disco

Astrix is designed to identify non-human identities and monitor their access across organizational systems. Its platform detects service accounts, API keys, OAuth tokens, and AI agents, then verifies ownership, permissions, and typical behavior.

Cisco plans to integrate Astrix with Cisco Identity Intelligence, Secure Access, and Duo Identity and Access Management. This integration will help organizations maintain clearer records of which agent or machine identity is requesting access and whether the request should be approved.

The technology can also spot excessive privileges or unusual activity. Even a valid credential could be used in an attack if it comes from an odd location or accesses something new. 

WideField brings session context to Splunk 

WideField focuses on the investigative aspect of identity security. Cisco plans to integrate WideField’s technology with Splunk to correlate identity, credential, session, and activity data from multiple sources.

This additional context enables security teams to reconstruct incidents more effectively. Rather than viewing isolated alerts, analysts can track activity associated with users, service accounts, machine identities, or AI agents over time.

Agent activity can quickly propagate across systems. If an agent is compromised, it may use multiple credentials, access various applications, and initiate automated actions before detection.

WideField remains an announced acquisition and has not yet been listed by Cisco as completed.

Identity becomes the control point

Cisco’s strategy reflects a broader shift in enterprise security. Network location or device status alone is no longer sufficient, as software agents now operate across cloud services, SaaS applications, developer tools, and internal systems.

Security teams must identify which entity is acting, who is responsible for it, what permissions it holds, and whether its behavior aligns with its assigned role.

This means identity teams, security operations, cloud teams, developers, and those deploying AI agents need to work more closely together. Cisco’s two acquisitions address different aspects of this challenge. Astrix supports identity discovery and governance, while WideField is intended to provide session-level intelligence within Splunk.

As organizations adopt more autonomous agents, the primary security question is shifting. The focus is shifting from the origin of a request to identifying which human, machine, or agent initiated it and whether the action aligns with that agent’s assigned role.