Cisco Live 2026: The Agentic Era is Here

Cisco Live 2026 in Las Vegas wasn't a product refresh. It was a declaration. Jeetu Patel, President and Chief Product Officer, laid out Cisco's vision for what it calls the AgenticOps era – a world where AI agents don't just assist IT teams, they work alongside them around the clock, at machine speed.

The central thesis is simple, but its engineering implications are enormous: AI agents generate 450% more network traffic than humans performing the same task. That rewrites how infrastructure must be built and managed. Cisco's answer is a vertically integrated platform running from silicon to software – every layer purpose-built for the demands of autonomous, persistent, swarming agents.

At Cisco Live 2024, Patel declared that within two years Cisco would be unrecognizable in a positive way. Cisco Live 2026 marks that two-year milestone. For World Wide Technology customers, these announcements land directly across networking, security, observability, and services – the exact domains where WWT designs, builds, and proves solutions every day. Here's what was announced, what's available now, and what's on the roadmap.

Key takeaways

• Cisco Cloud Control – one control plane for networking, security, observability, compute, and collaboration. In Controlled Availability in the US now; global GA later in 2026.
• AgenticOps – Cisco's new operating model where AI agents sense, diagnose, remediate, validate, and deploy, with humans keeping approval authority through an "autonomy dial."
• AI Canvas – the shared workspace (now in Controlled Availability) where operators and agents troubleshoot together on correlated, Splunk-powered telemetry.
• Agent Digital Twin – tests changes on an emulated network replica before deployment. Alpha July 2026.
• AI SRE in Splunk Observability Cloud – generally available now; automatically identifies root cause, builds a remediation plan, and walks teams through step-by-step resolution to reduce MTTR.
• Splunk Agent Observability powered by Galileo – Cisco's acquisition of Galileo AI lands in Splunk as a native agent observability layer (planned August 2026). Key capabilities: an agent graph giving operators a bird's-eye view of every tool call and LLM call, anomaly signals that surface unknown unknowns agents produce, and Luna SLMs – small language models purpose-built for agent evaluation at materially lower cost than LLM-based evaluation, with broader coverage than sampling and the ability to steer agents to safe responses at machine speed in production.
• Splunk IT Service Intelligence 5.0 – now available: AI-powered service and KPI discovery, Event iQ Detect (alert correlation at up to 100,000 alerts/minute with analyst feedback learning), and Event iQ Diagnose (LLM-generated root cause summaries with confidence-scored next-step guidance). The fastest path from alert noise to actionable service intelligence.

Cisco Cloud Control: A control plane, not just a console

The headline announcement was Cisco Cloud Control, a unified management platform that brings together Meraki, Catalyst, Nexus, Intersight, Security Cloud Control, Splunk, and Webex Hub under one login, one data layer, and one natural-language interface.

But Cloud Control is not "another single pane of glass." Cisco is explicit about this and right to make the distinction. Glass is passive. Cloud Control is designed for active execution, with policy and identity built directly into the control path. It creates a common operational context, so people and agents work from the same inventory, topology, telemetry, and policies. The old model was visibility first, action later. The new model is visibility, reasoning, and action all within one environment.

Historically, Cisco's biggest enterprise customers have lived with product silos that made sense inside an org chart but not in an actual IT environment. Networking had its console, security had its console, observability had its tools, collaboration had its dashboard, and the operator in the middle stitched it together by hand. Cloud Control is Cisco's admission that this model no longer scales, and its most serious attempt yet to turn its sprawling portfolio into an actual platform.

What's inside Cloud Control

• Unified Management: all Cisco products, one interface, one sign-on
• Cross-Domain Troubleshooting: a natural-language prompt traces any issue from endpoint to access point to controller to firewall in minutes, not hours
• Campus-to-DC Fabric: one-click provisioning with firewall insertion via the Unified Cisco Fabric app
• Agent Security: full visibility into every agent's actions, data access, and mesh policies via natural language
• Token Monitoring: real-time tracking of every agent's token consumption – runaway agents can be terminated with a single click
• Marketplace: 52 ecosystem partner apps on Day 1, including AWS, Google Cloud, Microsoft, ServiceNow, Okta, PagerDuty, Slack, Snowflake, Tenable, and Wiz

Cloud Control is available in Controlled Availability in the US today. Cisco delivered every product demonstration at Cisco Live 2026 from inside Cloud Control. Global general availability is targeted for later in 2026.

AI Canvas: Where humans and agents work together

AI Canvas is the primary workspace inside Cisco Cloud Control, and it's where the story becomes operationally real. Rather than keeping it locked inside individual products, Cisco has moved AI Canvas into Controlled Availability as part of Cloud Control, making it accessible across the entire portfolio at once.

The concept is a multiplayer workspace where human operators and AI agents investigate and resolve issues together, using the same live evidence, with context persisting across handoffs, shift changes, and escalations. An operator submits a natural-language prompt, AI Canvas builds a multi-agent investigation plan, gathers evidence across domains, and returns a sourced answer with the operator approving the path forward.

Enterprise IT doesn't need AI window dressing. It needs help with the messy middle of operations – where a single performance issue can simultaneously be a network question, a policy question, an application question, and a security question. AI Canvas is designed for exactly that intersection.

AI Canvas connects directly to the Cisco Data Fabric, powered by Splunk, which ingests signals from network, security, applications, and third-party systems at petabyte scale. The observability isn't just broad; it's correlated. Hours of investigation compress into seconds. Cloud Control Studio – the workspace for building custom agents and apps within AI Canvas, with OpenAI Codex natively integrated – is on the roadmap for later in 2026.

AgenticOps: Autonomy with a human in the loop

AgenticOps is Cisco's operating model for the AI era: an agent-first approach to IT operations combining autonomous action with built-in human oversight. It isn't AIOps with a better name. Traditional AIOps identified anomalies and handed them to humans. AgenticOps closes the loop: agents sense, diagnose, remediate, validate, and deploy, while humans set policy, see confidence scores at each step, and retain approval authority over what matters.

The "autonomy dial" captures this precisely. Operators decide how much autonomy each problem category earns over time. Critical changes require human review. Well-understood, low-risk remediations can run autonomously once trust is earned. The autonomy dial is graduated, not all-or-nothing.

Cisco IT is the proof point. Chris Groves presented on stage as Cisco's "customer zero" for AgenticOps across 10,000+ network devices and 120,000+ GPUs. MTTR dropped from 7 days to 2 days. Planned work increased 25%. If these results translate even partially to your environment, the case for AgenticOps moves from technology interest to operational priority.

AgenticOps five-stage loop

1. Sense – continuous ambient monitoring across the environment
2. Diagnose – Deep Reasoning models apply multi-step root cause analysis across domains
3. Remediate – agent proposes fix with confidence score and risk assessment
4. Validate – Digital Twin tests the change against an emulated replica before deployment
5. Deploy – human approves (or autonomous action runs) based on autonomy dial setting

AgenticOps across the portfolio

• Campus, Branch, and Industrial – rolling out from February 2026: Experience Metrics (converting thousands of device signals into user-experience KPIs), agentic workflow creation, closed-loop remediation
• Data Center (Cisco Nexus One) – Controlled Availability June 2026: intelligent event correlation, prescriptive recommendations for both traditional and AI workloads
• Service Provider (Crosswork AI) – now in beta: resolving complex, multi-vendor issues with greater speed and accuracy
• Security (Cisco Security Cloud Control) – agentic SOC with six purpose-built security agents for autonomous triage and remediation

Agent Digital Twins: Test before you touch

One of the most operationally significant capabilities announced at Cisco Live 2026 was Agent Digital Twin. The concept is operationally significant: before an agent deploys a change to production, it tests that change in an emulated replica of the network built from actual software images, not mathematical approximations.

The Digital Twin runs inside the AgenticOps remediation loop and surfaces directly within Cisco Cloud Control. Operators see the simulated outcome, review the confidence score, and approve or redirect. It's the difference between deploying a fix and betting on it. Digital Twin enters alpha in July 2026.

Agent Observability: Full-stack visibility for AI workloads

As agents proliferate across the enterprise, observability becomes existential. Cisco's approach runs on two engines: the Galileo acquisition (integrated into Splunk as Splunk Agent Observability, planned August 2026), and the Cisco Data Fabric, powered by Splunk.

Four layers of observability

• Infrastructure utilization – GPU load, network performance, uptime across the estate
• Model performance – monitoring foundation model behavior in production
• Application runtime – full agent execution stack visibility
• Agent evals – detect drift and enforce guardrails in real time

The Galileo AI acquisition brings three capabilities that didn't exist natively in Splunk before – and they land as Splunk Agent Observability, planned for August 2026:

• Agent graph – a bird's-eye view of every tool call and LLM call an agent makes. For the first time, operators can see not just what an agent did, but the full sequence of reasoning steps and external calls it made to get there. This is the foundation of explainability at scale.
• Signals – surfaces unknown unknowns: the anomalous behaviors agents produce that no one anticipated and no alert was configured to catch. Rather than relying on pre-defined rules, signals use behavioral analysis to flag patterns that deviate from established baselines, giving teams visibility into emergent agent failure modes before they become incidents.
• Luna SLMs – small language models purpose-built for agent evaluation. Cisco positions Luna as materially lower cost than LLM-based evaluation approaches, with faster evaluation cycles and broader production coverage than statistical sampling. Luna's evaluation runs inline, enabling teams to steer agents toward safe responses at machine speed rather than discovering failures through sampling or post-incident review.

Customer impact: Evaluation coverage at production scale

Organizations deploying AI agents in production face a fundamental tradeoff: comprehensive evaluation is expensive (using frontier LLMs to evaluate every agent output), while sampling is cheap but misses edge cases until something goes wrong. Luna SLMs reframe this tradeoff – purpose-built evaluation models that, according to Cisco, deliver materially lower-cost evaluation with broader coverage than sampling, and fast enough to run inline in production workflows. The practical result is that unsafe or anomalous agent behavior is surfaced earlier, before it appears in an incident report.

That observability layer lands in Splunk natively as Splunk Agent Observability (planned August 2026), giving security and ops teams a single place to watch their agent populations across the estate. The Cisco Data Fabric provides the shared telemetry foundation underneath, unifying network, application, infrastructure, and AI signals so that what used to take hours of manual investigation takes seconds via AI Canvas.

AI SRE: agentic incident response in Observability Cloud

One of the most impactful GA announcements for ITOps and engineering teams is AI SRE in Splunk Observability Cloud. When an incident occurs, AI SRE automatically identifies the probable root cause across application and infrastructure performance, builds a remediation plan, and walks the team through a step-by-step resolution path – significantly reducing mean time to resolve (MTTR).

This isn't alert correlation with a better UI. AI SRE closes the full incident loop: it detects, diagnoses, prescribes, and guides resolution without requiring teams to manually stitch together signals from disconnected tools. For organizations where downtime has direct revenue impact, this changes the calculus on staffing, on-call burden, and incident SLAs. AI SRE in Splunk Observability Cloud is generally available now.

Tokenomics: governing agent spend

The financial risk is no longer abstract. The UNDP CIO made it concrete on stage: at $200 per week per AI agent, a 40,000-employee organization can face $400M–$900M in annual token costs – a budget line that was never planned for. Cloud Control's observability module shows token consumption by agent in real time. Operators set budgets, receive alerts, and terminate runaway agents with one click. Token monitoring is live in today's Controlled Availability release.

Cisco Data Fabric + Splunk Machine Data Lake: rethinking what you actually ingest

Every capability in this section – AI SRE, IT Service Intelligence 5.0, Agent Observability – runs on a common foundation: the Cisco Data Fabric, powered by Splunk. It handles network, security, application, and AI signals at enterprise scale, and it's getting a meaningful architectural addition that changes the economics of how organizations approach Splunk.

The new Splunk Machine Data Lake introduces a low-cost storage tier backed by a knowledge graph metadata layer. The key shift: Splunk can now reason over large data volumes without requiring full ingestion into the Splunk index. That changes the all-or-nothing ingestion decision that has historically driven up platform costs and forced difficult triage about what data is "worth" indexing.

Alongside Machine Data Lake, Federated Search is expanding to Snowflake, Azure Data Lake, Delta Lake, Spark, and Databricks – with GA planned for late June 2026. Federated Search means analysts stay in Splunk and query data where it already lives, without migrating it into the Splunk index or paying for duplicate ingestion. Security and operations teams get the analytical coverage of a unified data layer without the storage overhead.

Why this matters for your observability costs

For organizations running large-scale Splunk environments, Machine Data Lake and Federated Search together address one of the most common friction points: the cost and operational complexity of deciding what to ingest. Teams can now extend analytical reach to enterprise data lakes, cloud storage, and third-party analytics platforms – without migration, without duplicate ingestion, and without leaving the Splunk interface. The result is lower observability cost at the same time as expanded coverage.

Splunk IT Service Intelligence 5.0: from alert noise to actionable service intelligence

While Cisco Live 2026 was announcing the future of agentic operations, Splunk released the present: Splunk IT Service Intelligence 5.0, a major update that lands directly inside the observability stack these platforms depend on. IT Service Intelligence has always been about connecting service health to business impact. Version 5.0 focuses on three things IT teams need every day: faster time to value, less friction in daily operations, and a clearer path from alert noise to action. The stakes are real – Splunk's own research found that Global 2000 companies lose $600 billion annually to downtime.

A better place to begin

Getting started with IT Service Intelligence has historically required deep product knowledge and significant configuration time. IT Service Intelligence 5.0 changes that. A new IT Service Intelligence Home page delivers a "Mission Control" experience: guided installation, real-time operational visibility, and direct links to key workflows in one data-aware view. A new installation wizard takes teams from first login to operational visibility in two clicks. Alert Data Integrations now include AI-driven field discovery and mapping, standardizing incoming alerts automatically and reducing manual normalization across tools. AI-powered Service and KPI Discovery – available in preview – analyzes existing Splunk data, recommends services and KPIs, and creates sandbox configurations for review before publishing.

Event iQ Detect and Diagnose

The most operationally significant capabilities in IT Service Intelligence 5.0 are Event iQ Detect and Event iQ Diagnose – two AI-powered engines that work in sequence to cut noise and surface answers.

Event iQ Detect is an AI-powered alert correlation engine that groups related alerts into episodes using cross-field matching, topology awareness, and fuzzy matching. It operates at up to 100,000 alerts per minute. In version 5.0 it gains analyst feedback-based learning: when operators split an incorrectly grouped episode or merge two that should have been one, that feedback feeds directly back into the model during retraining. Alert grouping improves with use, without manual tuning – clearer episode titles, better summaries, fewer mistakes, all at scale.

Event iQ Diagnose takes over where Detect leaves off. Once episodes are correlated, Diagnose uses a large language model to generate a plain-language summary of what happened, when it started, the key contributing events, likely root cause, and confidence-scored next-step recommendations. It correlates with change data from ServiceNow and Jira, surfacing change context early in the investigation instead of after a long manual search. Level 1 analysts triage faster. Escalations are cleaner. Senior engineers spend time on resolution, not reconstruction.

How IT Service Intelligence 5.0 fits the AgenticOps stack

AI SRE in Splunk Observability Cloud handles application and infrastructure incidents end-to-end. IT Service Intelligence 5.0 handles service-layer intelligence – connecting IT events to business service health at scale. Used together on the Cisco Data Fabric, they cover the observability stack from the infrastructure signal all the way to the business impact dashboard: AI SRE closes incidents autonomously, IT Service Intelligence governs service health and tells the business what it means.

A modernized IT Service Intelligence experience

Beyond the AI capabilities, IT Service Intelligence 5.0 ships practical improvements to daily operations. The Episode Review workflow has been redesigned with a cleaner layout, easier organization, and the ability to split and merge episodes directly in the interface. A new Central Admin Console consolidates Event Analytics settings and advanced controls in one place. A role-based access control revamp enables a shared-service model – teams share visibility across services when needed while keeping access boundaries in place. Service and KPI tagging allows labels like "critical" or "customer-facing" to travel through the alert pipeline, making it easier to filter, route, and prioritize by business impact. Flexible recurring maintenance windows suppress planned-change noise without disabling coverage.

The Marketplace: turning Cloud Control into a platform

Whether Cloud Control becomes a true platform or remains a better Cisco front end comes down to the Marketplace. It's a catalog of apps, agents, and integrations built by Cisco, its customers, and ecosystem partners – already including 52 integrations at launch from names like AWS, Google Cloud, Microsoft, ServiceNow, Okta, PagerDuty, Slack, Snowflake, Tenable, and Wiz.

No enterprise is all Cisco. The Marketplace acknowledges this directly. Agent Builder and App Builder let customers connect third-party tools, build their own agents, and create custom workflows on top of Cisco's control plane rather than waiting on a roadmap. That's the shift from product vendor to platform operator.

Product availability status

Directional planning view. Availability, entitlement, geography, beta access, and roadmap timing should be confirmed with Cisco and Splunk before customer commitments are made.

Generally Available / LiveControlled AvailabilityBeta / AlphaRoadmap

Live & Generally Available  14 capabilities

Controlled Availability  9 capabilities

↳ Cisco Cloud Control – Product Integration Timelines
Source: Cisco Cloud Control Getting Started Docs · cloud.cisco.com

Beta / Alpha  8 capabilities

On the Roadmap  18 capabilities

How to evaluate Cloud Control: three disciplines

Cisco Cloud Control carries genuine transformational potential for Cisco-heavy environments. But vision alone isn't a deployment plan. As you evaluate the platform, three disciplines matter.

1. Test cross-domain complexity reduction

A single set of links to existing products is not the same as a single operating model. Push Cloud Control on real cross-domain scenarios – a problem that spans your network, security policy, an application, and a Splunk alert simultaneously. That's where the platform either proves or loses its value proposition.

2. Rigorously validate the AI governance model

Cisco wisely emphasizes human approval, auditability, and bounded actions. The autonomy dial concept is sound architecture. But validate this in actual workflows before allowing agents to take consequential actions in your environment. Understand how actions are logged, how they're reversed if they go wrong, and how the system handles conflicting agent directives.

3. Take the Marketplace seriously from Day 1

The ability to manage the Cisco domain from a single dashboard is useful. Extending that to a large share of your overall environment through the Marketplace's ecosystem integrations is transformational. Audit which of your existing tools are already available as Day 1 integrations and build a prioritization sequence for bringing them into the platform.

What this means for WWT customers

These announcements don't exist in isolation. For organizations running Cisco infrastructure and Splunk – which describes most enterprise IT environments – Cisco Live 2026 combined with Splunk IT Service Intelligence 5.0 represents a step-change in what's operationally possible for observability and agentic operations teams.

World Wide Technology sits at the exact intersection of these capabilities. Our Observability and AgenticOps practice is purpose-built for Cisco and Splunk architectures. Our network and operations teams are already designing reference architectures that integrate Cloud Control, AgenticOps, AI Canvas, and the Splunk observability stack. For customers already on Splunk, IT Service Intelligence 5.0 and AI SRE represent the fastest path from existing investment to agentic operations outcomes.

Four things to do now

• Evaluate Splunk IT Service Intelligence 5.0 – if you're on Splunk Enterprise or Splunk Cloud Platform, IT Service Intelligence 5.0 is available now. Event iQ Detect and Diagnose work with data you already collect. The new guided installer reduces the time-to-value barrier that previously kept teams on the sideline
• Assess your observability posture – before agents proliferate across your environment, ensure you have the telemetry foundation and service-layer intelligence to see what they're doing, correlate it to business impact, and govern it. AI SRE + IT Service Intelligence together cover this end-to-end
• Connect AI Canvas to your Splunk data – AI Canvas is in Controlled Availability today. Organizations already on the Cisco Data Fabric can activate cross-domain investigation capabilities immediately – hours of manual triage compress to seconds
• Plan your Cloud Control journey – Controlled Availability is live in the US today; the sooner you engage, the sooner you can influence your adoption path and get ahead of the global GA wave later in 2026

WWT has the relationships, lab environments, and technical depth to help you move from announcement to production across Cloud Control, AgenticOps, the Secure AI Factory, and everything in between.

The bottom line

Cisco Live 2026 confirmed what the infrastructure signals have been showing for months: the agentic era isn't approaching, it's here. The question isn't whether to prepare – it's how fast you can move and whether your observability and operations stack is ready to carry the weight.

Cisco's answer is Cloud Control and AgenticOps – a unified platform where humans and agents work from the same telemetry, investigate together in AI Canvas, and deploy changes validated by Digital Twin. Splunk's answer is IT Service Intelligence 5.0 and AI SRE – turning the data that already flows into Splunk into service-level intelligence and autonomous incident response. WWT's answer is the team, the lab environments, and the architecture expertise to bring these platforms together in your specific environment, at your specific pace.

Ready to plan your AgenticOps journey?

Whatever your business need, we deliver scalable, tailored solutions – fast. To make a new world happen.

Contact your WWT account team