Cisco whitepaper: Zero Trust for Agentic AI, three pillars for identity, access, behavior

In two minutes

• The paper argues that AI agents act at machine speed, often with elevated privileges, and that human-centric security models cannot keep up (executive summary, p. 3).
• It places the risk in three dimensions: identity, access and behavior. Each agent is treated as a non-human identity (NHI) (pp. 2-3).
• Pillar 1, Know every agent: continuously discover agents, MCP servers and connected tools, and map each agent to an accountable human owner (pp. 6-7).
• Pillar 2, Authorize every action: least-privilege access that is just in time, just enough and just long enough, plus validation of MCP servers, third-party models and toolchains (pp. 7-8).
• Pillar 3, Adapt to risk in real time: runtime guardrails and semantic inspection of agent requests, responses and tool calls, aimed at prompt injection, memory poisoning and tool misuse (pp. 8, 11).
• It lists key risks per pillar, such as orphaned credentials, over-permissive API keys, rogue agents and agent-to-agent manipulation, with one short example each (pp. 9-12).
• It covers three deployment cases: enterprise-built agents, agents on third-party platforms such as AWS AgentCore or Azure AI Studio, and no-code tools such as ChatGPT or Copilot, which it calls the highest shadow AI risk (pp. 13-14).
• Controls are tied to named Cisco products: Duo, Secure Access, AI Defense and a secure web gateway. The paper gives no data, benchmarks or customer results.

Key numbers

The document gives no figures, survey data or measured results. It is a conceptual framework with illustrative scenarios.

What to do with it

• Build an inventory of AI agents, MCP servers and connected tools, and assign each agent a named human owner, as the Know pillar describes (pp. 6-7).
• Register agents as NHIs with a lifecycle from creation to retirement, and check for orphaned credentials and unused tokens (pp. 9-10).
• Issue agent access that is time-bound and scoped to the task, and replace static roles and long-lived keys (pp. 8, 10).
• Validate MCP servers, third-party models and plugins before agents may use them (pp. 7, 11).
• Add runtime inspection of agent requests, responses and tool calls to cover prompt injection and tool misuse (pp. 8, 11-12).
• Sort agents into the paper's three deployment cases and set discovery and data-handling rules for no-code tools first (pp. 13-14).

Read the full document if

• you need a vendor framework to structure an internal discussion on agent identity, access and runtime control.
• you want the paper's risk lists for NHIs, agent access and runtime behavior (pp. 9-11).
• you are weighing how Cisco positions Duo, Secure Access and AI Defense for agentic AI.

What it relies on

The paper rests on Cisco's own framing and gives no data, sample, method or outside citations. Its examples are hypothetical scenarios, such as a build-automation agent with a cloned API key (p. 10). Cisco sells the products it names as delivering each pillar: Duo, Secure Access, AI Defense and a secure web gateway (pp. 7-8, 15). The "Why Cisco" section states Cisco's own positioning (p. 15). The document carries a 03/2026 mark (p. 16).

Our read

Useful as a compact statement of how one network and security vendor splits the agent problem into identity, access and behavior. The risk lists and deployment cases can seed an internal checklist. It offers no evidence on how often these risks occur or how well the controls work, so treat the product claims as the vendor's own.