BusinessMarkets, money & strategy
Cisco pairs its network telemetry with OpenAI reasoning models for cyber defense
Cisco is combining its network and observability telemetry with OpenAI reasoning models to link signals that look harmless one by one into evidence of attacks. This extends a partnership that already covers Codex-built products, GPT-5.5-Cyber access and OpenAI's Daybreak defender program.
From the OpenAI News article of November 3, 2026 and cited sources: The deployment correlates security telemetry with observability data across microservices, containers and Kubernetes clusters. [1] [2] [9]
SOURCES[1] How Cisco defends at machine speed with OpenAI – OpenAI openai.com[2] Cisco and OpenAI Combine Network and Observability Data –… tokenpost.com[9] Cisco Taps OpenAI Frontier Models – BigGo Finance finance.biggo.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- The deployment correlates security telemetry with observability data across microservices, containers and Kubernetes clusters. [1] [2] [9]
- Original source
- OpenAI News article, company source
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- November 3, 2026 article published
- Covered
- Nov 4 edition
- Evidence
- 11 sources across 10 sites
- 1How Cisco defends at machine speed with OpenAI – OpenAIopenai.com
- 2Cisco and OpenAI Combine Network and Observability Data –…tokenpost.com
- 3Cisco and OpenAI detail machine-speed enterprise cyber…blockchain.news
- 4Announcing Foundry Security Spec – Cisco Blogsblogs.cisco.com
- 5Cisco open sources agentic AI security spec – Network Worldnetworkworld.com
- 6Cisco and OpenAI redefine enterprise engineering with…openai.com
Reach: not measured yet
The deployment correlates security telemetry with observability data across microservices, containers and Kubernetes clusters. The aim is to connect weak signals and tell real attackers apart from legitimate autonomous agents that pursue their goals in unintended ways. [1] [2] [9]
The cyber deployment builds on a deeper relationship. OpenAI says Codex wrote most of Cisco's AI Defense product. Cisco got access to GPT-5.5-Cyber in early 2026 and is one of more than 25 partners in OpenAI's Daybreak program. [6] [8] [10]
Cisco's most concrete public statement of method is Foundry Security Spec. It is an open, model-agnostic blueprint with eight agent roles, about 130 requirements and auditable provenance chains. An evaluation counts as done when it meets a coverage floor and an economic yield threshold. The spec reports no evaluation results. [4] [5]
the announcement describes how the system is set up and how data is handled, but gives no detection, remediation or benchmark figures.
Read the full assessment
Implication: buyers should ask for false-positive rates, time-to-detect and reasoning they can check before treating machine-speed claims as proven.
Executive brief
OpenAI's 3 November 2026 customer story on Cisco gives no numbers on how well the system works. OpenAI says Cisco pairs its network telemetry with OpenAI reasoning models to connect signals that look harmless one by one into evidence of an attack. Secondary coverage says the announcement includes no detection speed, remediation time or benchmark results (TokenPost; Blockchain.News). It follows six months of closer ties between the two companies. Cisco builds with Codex, has access to OpenAI's GPT-5.5-Cyber model and is a partner in Daybreak, OpenAI's cyber-defense program. The question for buyers is whether the reasoning that links these signals can be checked. Speed alone does not answer it.
What changed and event timeline
Cisco open-sources Foundry Security Spec
Omar Santos published a blueprint for agentic security evaluation that works with any model. It defines eight core agent roles and about 130 requirements (;).
Codex builds Cisco AI Defense
OpenAI's case study says Codex wrote most of Cisco's AI Defense product and cut some engineering work from quarters to weeks (; date per).
24: Daybreak expansion names Cisco
OpenAI released GPT-5.5-Cyber more widely to vetted defenders and launched a partner program with more than 25 firms. Cisco is one of them (;).
OpenAI publishes the Cisco cyber story
The story pairs Cisco's network and observability data with OpenAI models to make defenses more adaptive (;).
Capabilities and access
- What it does: It correlates security telemetry with observability data.
- Where it runs: BigGo reports small security stacks deployed across microservices, containers and Kubernetes clusters.
- Model: The reviewed coverage does not confirm which model runs in production. Cisco says it gained access to GPT-5.5-Cyber in early 2026 (Cisco).
Read the full section
- What it does: It correlates security telemetry with observability data. This should help teams tell an attacker apart from a legitimate autonomous agent pursuing its goal in an unintended way (TokenPost).
- Where it runs: BigGo reports small security stacks deployed across microservices, containers and Kubernetes clusters. Cisco Cloud Control and AI Defense are part of it (BigGo).
- Model: The reviewed coverage does not confirm which model runs in production. Cisco says it gained access to GPT-5.5-Cyber in early 2026 (Cisco).
- Data handling: Zero data retention, customer-data boundaries and isolation. These terms apply to this deployment specifically (Blockchain.News).
Technical analysis for researchers and developers
- The reviewed sources do not describe how the deployment is built or evaluated.
- Foundry Security Spec is Cisco's most concrete public artifact on method.
- Orchestrator, Indexer, Cartographer and Detector
Read the full section
- The reviewed sources do not describe how the deployment is built or evaluated.
- Foundry Security Spec is Cisco's most concrete public artifact on method. Its eight core roles are:
- Orchestrator, Indexer, Cartographer and Detector
- Triager, Validator, Coverage-Guide and Reporter
- The spec also sets out a finding lifecycle, 11 "inviolable" principles and auditable provenance chains (Cisco Blogs).
- An evaluation counts as done when it meets both an operator-defined coverage floor and an economic yield threshold (Network World).
- The spec reports no evaluation results and states no license. Each team that adopts it has to build its own benchmarks.
Claims and evidence
- Codex wrote most of AI Defense: This comes from OpenAI's case study, which is vendor material (OpenAI).
- GPT-5.5-Cyber benchmark scores: CyberGym 85.6%, against 83.8% for Mythos and 81.8% for GPT-5.5. SEC-bench Pro 69.8%.
- Daybreak scale: More than 30 million commits scanned and over 70,000 findings fixed by human reviewers. OpenAI reported these figures (EdTech Innovation Hub).
Read the full section
- Codex wrote most of AI Defense: This comes from OpenAI's case study, which is vendor material (OpenAI).
- GPT-5.5-Cyber benchmark scores: CyberGym 85.6%, against 83.8% for Mythos and 81.8% for GPT-5.5. SEC-bench Pro 69.8%. OpenAI reported these numbers itself, and no independent replication appears in the reviewed sources (The Decoder).
- Daybreak scale: More than 30 million commits scanned and over 70,000 findings fixed by human reviewers. OpenAI reported these figures (EdTech Innovation Hub).
- Cisco's "machine speed" defense: Not independently corroborated (BigGo).
- "GPT-6 Astra": BigGo alone mentions this model, and no other reviewed source confirms it.
Context and prior work
- Cisco tests against models from both major labs. It worked with Anthropic on Mythos Preview and also has GPT-5.5-Cyber (Cisco).
- Jeetu Patel argues that attackers will move from finding a flaw to exploiting it in hours or minutes (GovInfoSecurity).
- Foundry builds on Project CodeGuard, which Cisco donated to the Coalition for Secure AI (Cisco Blogs).
Limitations, safety and contested findings
- No outcome data: The November announcement includes no independent testing, measured outcomes or comparison with competitors (Blockchain.News).
- Conflicting dates: Blockchain.News dates the Daybreak Cyber Partner Program to 2 November 2026. Reports from June describe it as launched on 23–24 June (EdTech Innovation Hub).
- Permissive model: GPT-5.5-Cyber is deliberately more permissive than standard models and limited to verified defenders.
Read the full section
- No outcome data: The November announcement includes no independent testing, measured outcomes or comparison with competitors (Blockchain.News).
- Conflicting dates: Blockchain.News dates the Daybreak Cyber Partner Program to 2 November 2026. Reports from June describe it as launched on 23–24 June (EdTech Innovation Hub).
- Permissive model: GPT-5.5-Cyber is deliberately more permissive than standard models and limited to verified defenders. Human approval is still required before any patch is applied (The Decoder).
- Rare severe failures: Cisco reports that Mythos, the comparable frontier model it tested, showed rare but high-severity failures (Cisco).
Business and practitioner implications
- Buyers: Ask for false-positive rates and time-to-detect figures before relying on "machine speed" claims. Confirm in writing that zero retention covers your telemetry.
- Builders: Foundry's role breakdown and "done" criteria can be used now with current models (Network World).
- Strategy: Large security vendors are gaining early access to frontier cyber models, and OpenAI recommends that most teams use GPT-5.5 with Trusted Access instead (The Decoder).
Read the full section
- Buyers: Ask for false-positive rates and time-to-detect figures before relying on "machine speed" claims. Confirm in writing that zero retention covers your telemetry.
- Builders: Foundry's role breakdown and "done" criteria can be used now with current models (Network World).
- Strategy: Large security vendors are gaining early access to frontier cyber models, and OpenAI recommends that most teams use GPT-5.5 with Trusted Access instead (The Decoder).