Cisco President and Chief Product Officer Jeetu Patel has drawn a hard line for enterprises: agentic AI systems that take action across networks and data must be governed as non-human identities with strict, zero-trust controls. His comments, made during a Bloomberg podcast on July 25, signal that the networking giant sees AI security not as a feature add-on but as a foundational infrastructure requirement.
Patel’s message arrives as organizations rush to deploy AI copilots, autonomous agents, and retrieval-augmented generation systems that can read, write, and execute tasks. With that autonomy comes a vastly expanded attack surface—one that traditional application security models were never designed to handle.
The Agentic AI Shift: More Than a Chatbot
A year ago, enterprise AI security debates focused on prompt injection, model hallucinations, and sensitive-data leakage. Those concerns haven’t gone away, but they now undersell the risk. Today’s AI agents don’t just answer questions; they invoke tools, query databases, modify configurations, and chain actions together.
Cisco’s security division has been steadily building a runtime protection framework that treats every agent—whether it’s a security copilot, an IT automation bot, or a third-party connector—like a privileged user. Patel’s comments underscore why: an agent that can retrieve documents from SharePoint, generate a PowerShell script, or call an API with a service-account token is no longer a passive tool. It is an actor with an identity, and it must be secured accordingly.
Why AI Agents Demand Identity-First Security
From Cisco’s perspective, the shift is fundamental. “An AI agent may retrieve information from a knowledge base, search a cloud drive, query an internal database, generate a script, change a ticket, trigger a workflow, communicate with another agent, or make recommendations that lead to an automated action,” Patel explained, as reported by StartupHub.ai. That breadth of capability means a compromised or misled agent could exfiltrate data, escalate privileges, or cause operational havoc at machine speed.
The traditional playbook of network segmentation, endpoint detection, and user access reviews doesn’t easily map onto agents. Instead, Cisco is advocating for:
- Distinct, non-human identities for every agent, with no shared credentials.
- Least-privilege access scoped to the minimum required permissions, not the convenience of broad admin roles.
- Runtime monitoring that correlates agent actions with identity, endpoint, and network telemetry so security teams can answer who did what, on whose behalf, and whether it was authorized.
Patel’s team also emphasized that security investment isn’t cannibalizing AI innovation budgets. Enterprises are learning from the cloud era, where security became a prerequisite for scaling, not a brake on it.
What This Means for Windows Administrators and IT Teams
The practical impact for Windows-focused organizations is immediate. AI agents are already touching Active Directory, Entra ID (Azure AD), Windows endpoints, Microsoft 365, and PowerShell automation. Without proper governance, an agent tasked with user provisioning could accidentally grant excessive privileges or fall victim to a malicious prompt embedded in a ticket description.
Windows admins should start by inventorying every AI tool and agent in the environment—not just official deployments, but shadow IT bots built with Copilot Studio, Power Automate, or custom scripts. Map each agent’s identity, permissions, data access, and tool capabilities. Then apply the same rigor you would to a domain admin account: regular audits, time-limited tokens, and approval gates for high-risk actions.
Cisco’s AI Defense expansion, announced earlier this year, aims to give defenders the visibility to track agent behavior alongside traditional security events. For Windows environments, that means agent activity could show up in the same SIEM or XDR console as a suspicious logon or a file integrity alert—correlating human and non-human threats.
How We Got Here: From Assistants to Autonomous Agents
The journey from simple chatbots to autonomous agents has been swift. In 2023, the industry wrestled with prompt injection proofs-of-concept. By 2024, frameworks like AutoGen and LangChain made it trivially easy to connect language models to APIs. Now, in 2025, major platforms like Microsoft 365 Copilot and Salesforce Agentforce embed agentic capabilities directly into productivity tools.
Cisco’s Patel acknowledged that the AI race is no longer a one-player game. He called China “a formidable competitor” that has achieved frontier-class models through creative approaches beyond model distillation. That global pressure pushes U.S. enterprises to adopt AI faster, often skimping on security until an incident forces a rethink.
The core lesson of the past two years, Patel argued, is that security must be designed in from the start. “It is in our national interest and it is in the interest of every US model gets used all over the world whether it be closed source or open source,” he said, framing open-weight models as a strategic advantage—if paired with strong governance.
Practical Steps to Secure AI Agents Now
You don’t need a Cisco budget to start. Here’s a playbook for Windows and IT teams:
- Build an agent inventory. Document every AI model, agent, plugin, and connector. Record owners, permissions, and involved data stores.
- Assign unique service principals. Never reuse a human account for an agent. Use managed identities in Azure, Entra ID service principals, or dedicated accounts with no interactive login.
- Limit permissions to the bare minimum. An agent that restarts a print spooler doesn’t need Domain Admin. Use just-in-time elevation where possible.
- Require human approval for high-risk actions. Policy changes, privileged script execution, or external data transfers should trigger an approval workflow.
- Log everything. Agent activity must land in your existing security information and event management (SIEM) system along with context tokens—model name, prompt snippet, tool invocation, and outcome.
- Test for manipulation. Red-team your agents with malicious documents, poisoned knowledge-base entries, and social-engineering-style prompts. Expect them to behave like a new privileged employee.
Cisco’s own experiments with AI-driven incident report generation, as covered by TechRadar, revealed that even well-intentioned AI can produce plausible but incorrect outputs. That underscores the need for human validation loops on any output that could trigger an action.
How Security Spending Complements AI Investment
Patel pushed back against the false choice between cybersecurity and AI efficiency. “I’m not seeing the reason that people are investing in cyber security taking away from certain other areas such as AI,” he said. Like cloud before it, AI demands a security-first operational model. The organizations that get this right will be able to deploy agents for higher-value workflows—automating vulnerability triage, incident response, and configuration management—without fearing a breach.
Looking Ahead: Cisco’s Roadmap and the Industry Response
Cisco’s AI security portfolio is expanding rapidly. Its AI Defense product now includes runtime guardrails, supply-chain integrity checks, and AI-aware SASE (Secure Access Service Edge). For Windows shops, the promise is a unified control plane where agents are governed alongside human identities.
The open-source versus proprietary model debate will intensify. Patel’s call for a U.S.-led open-source AI strategy reflects a belief that security can be a differentiator, not an afterthought. For IT leaders, the message is clear: the agent era is here, and it demands the same discipline you’d apply to your most privileged users. Start treating AI agents as non-human identities today, and you’ll be ready when they become your most powerful—and most targeted—tools.