Security teams’ detection rules encode years of knowledge, yet holistic insight into what those rules truly cover is often lacking. LUCID applies LLMs to detection logic itself, continuously exposing where defenses align, and where they fall short, against real attacker behavior, and helping teams decide where to invest next.
As artificial intelligence becomes increasingly autonomous and embedded across enterprise environments, securing AI systems has emerged as a defining challenge for the industry. Cisco is addressing this challenge by advancing agentic security systems that combine reasoning, adaptive retrieval, and human oversight to support real world security operations at scale.
Threat hunting is a critical, proactive strategy to uncover hidden threats and drive security improvement, yet security teams are busy, and even the most seasoned hunters face time and resource constraints.
AI can bring transformative value to cybersecurity in several key areas
AI models are highly effective at recognizing patterns in large datasets and can identify anomalies that signify a potential security threat. By using AI-driven models, security teams can detect threats much earlier in the process, preventing them from escalating into significant breaches.
One of the key advantages of AI in cybersecurity is its ability to automate repetitive tasks, like security analysis, incident triage, and response actions. This automation helps security teams operate more efficiently, focusing their energy on tasks that require human expertise.
AI-driven tools can assist in rapid incident response by automating the analysis of security incidents and suggesting next steps. These tools not only provide faster resolution times but also enhance the accuracy of responses, reducing the chance of human error.
AI enables faster, data-driven decision-making when dealing with security incidents. By processing vast amounts of information, AI models can generate valuable insights that inform security strategies, resource allocation, and threat mitigation efforts.
At Cisco Foundation AI, we apply AI across various aspects of cybersecurity to drive innovation and improve outcomes for organizations. Below are some specific use cases where AI is revolutionizing cybersecurity.
Foundation models, trained on massive and diverse security datasets, offer a new approach: dynamic, intelligent systems that adapt in real time to detect and mitigate threats.
AI Supply Chain Risk Management involves securing the path AI models take from development to deployment, ensuring that all elements of the AI lifecycle—whether open-source models or proprietary code—comply with security, licensing, and governance standards.
As the cybersecurity landscape continues to evolve, so too must the tools and techniques used to defend against threats. The rise of generative AI, deep learning, and other advanced technologies presents both challenges and opportunities for security teams.
Our team is committed to staying at the forefront of these developments, building new AI models and tools that address the unique cybersecurity needs of today and tomorrow.
Foundation AI is a pioneering team within Cisco Security, created by leading experts in artificial intelligence and cybersecurity who joined Cisco through the acquisition of Robust Intelligence. Our mission is to push the boundaries of what's possible at the intersection of AI and security.
We develop cutting-edge open source models and tools designed to elevate the future of cybersecurity. In addition, we build innovative solutions to safeguard against emerging threats and vulnerabilities introduced by next-generation AI supply chain. From securing today's digital infrastructure to anticipating tomorrow's AI-driven challenges, Foundation AI is shaping a more secure, intelligent future.