From an “AI assistant that answers” to an AI agent that takes action. Agent applications plan, invoke tools, invoke workflows, collaborate with other agents, and often run code. For enterprises, this expanded functionality also means an expanded attack surface, making trust a core business and engineering asset.
Cisco is an active contributor to the AI security ecosystem. open source toolssecurity framework, and Coalition of Secure AI (CoSAI), Owaspand other industry associations. As organizations move from experimentation to enterprise-scale deployment, moving forward requires understanding the risks and establishing practical, reproducible security guidelines.
This discussion explores not only the vulnerabilities that threaten agent applications, but also specific frameworks and best practices that enterprises can use to build secure and trusted AI agent ecosystems at scale.
The threat of AI in the era of autonomy
Traditional AI applications primarily generate content. The agent application performs the action. This difference changes everything for a company. If agents can access data stores, change operational configurations, approve workflow steps, create pull requests, or trigger CI/CD, the security model covers execution integrity and accountability. Risk management must extend beyond mere model accuracy.
In an agent ecosystem, trust becomes a system-wide asset. This includes identity, permissions, tool interfaces, agent memory, runtime containment, agent-to-agent protocols, monitoring, and incident response. These technical decisions define a company’s risk posture.
The “AI agent ecosystem” spans many architectures, including:
- Single-agent workflow system to coordinate enterprise tools
- Coding agents that impact software quality, security, and delivery speed
- Multi-agent systems (MAS) to coordinate specialized functions
- Interoperable ecosystem across vendors, platforms, and partners
As these systems become more decentralized and interconnected, the enterprise’s trust boundaries will expand accordingly.
Secure AI Coding as Corporate Discipline with Project CodeGuard
Cisco announces project code guard An open-source, model-agnostic framework designed to help organizations build security into AI-assisted software development. CodeGuard allows enterprises to institutionalize security expectations across the entire AI coding workflow before, during, and after code generation.
Project CodeGuard addresses concerns such as encryption, authentication and authorization, dependency risk, cloud and infrastructure-as-code hardening, and data protection.
For organizations expanding AI-assisted development, CodeGuard offers a way to make “safe code by default” a predictable outcome rather than an aspiration. Cisco has also applied Project CodeGuard internally to identify and remediate vulnerabilities across systems and products, demonstrating how these practices can be operationalized at scale.
Model Context Protocol (MCP) security and enterprise risks
MCP connects AI applications and AI agents to enterprise tools and resources. For most Chief Security Information Officers (CISOs), supply chain security, identity, access control, integrity validation, isolation failures, and lifecycle governance are top priorities in MCP deployments.
Cisco’s MCP scanner is an open source tool designed to help organizations visualize MCP integration and reduce risk when AI agents interact with external tools and services. MCP Scanner helps enterprises ensure that AI agents don’t accidentally expose sensitive data or introduce security vulnerabilities by analyzing and validating MCP connections.
Industry cooperation is also important. CoSAI has published guidance to help organizations address identity, access control, integrity verification, and isolation risks in MCP deployments. OWASP has complemented this work with a cheat sheet focused on safely using third-party MCP servers and managing discovery and validation.
Establishing trust controls for agent connections
Practical MCP trust controls include:
- Authentication and authorization of MCP servers and clients with strictly scoped privileges
- Treat tool output as untrusted and force validation before influencing decisions
- Apply secure discovery, provenance checks, and approval workflows
- Separate high-risk tools and operations
- Build auditability into every tool interaction
These controls can help companies move from ad hoc experimentation to operating managed, auditable AI agents.
The MCP community also includes recommendations for secure authentication using OAuth 2.1, highlighting the importance of standards-based identity and access control when AI agents interact with sensitive corporate resources.
OWASP Top 10 Agent Applications as a Governance Baseline
of OWASP Top 10 Agent Applications Provides a practical baseline for your organization’s security plan. It builds trust around minimal agency, auditable behavior, and strong control at the boundaries of identity and tools. These principles align closely with enterprise governance models.
An easy way for leadership teams to apply this list is to treat each category as a governance requirement. If your organization can’t clearly articulate how to prevent, detect, and recover from these risks, your agent ecosystem isn’t ready for the enterprise yet.
AGNTCY: Enabling trust at the ecosystem level
To support an enterprise-ready AI agent ecosystem, organizations require secure discovery, connectivity, and interoperability. AGNTCY is a Cisco proprietary open framework designed to provide infrastructure-level support for agent ecosystems, including discovery, connectivity, and interoperable collaboration.
Some of the key trust questions enterprises should ask of their agent ecosystem layer include:
- How are agents discovered and verified?
- How is an agent’s identity cryptographically established?
- Are interactions authenticated, policy enforced, and replay-resistant?
- Can you track actions end-to-end across agents and partners?
As multi-agent systems expand beyond organizational and vendor boundaries, these questions become central to enterprise trust and accountability.
MAESTRO: Making trust measurable at enterprise scale
of OWASP Multi-Agent System Threat Modeling Guide I will introduce MAESTRO (Multi-Agent Environments, Security, Threats, Risks, and Consequences) As a way to analyze the ecosystem of agents across architectural layers and identify systemic risks.
MAESTRO applies at the enterprise level and helps organizations:
- Model your agent ecosystem across runtime, memory, tools, infrastructure, identity, and observability
- Understand how failures cascade between layers
- Prioritize controls based on business impact and blast radius
- Validate trust assumptions through realistic multi-agent scenarios
Building an AI agent ecosystem that businesses can trust
Trust in an AI agent ecosystem is earned through intentional design and validated through ongoing operations. Organizations that succeed in the emerging “Internet of Agents” will be those that can confidently answer which agents acted with what authority, through which systems, under which policies, and how to prove it.
By embracing these principles and leveraging the tools and frameworks described here, enterprises can build an AI agent ecosystem that is not only powerful, but worthy of long-term trust.
in Cisco AI SummitLearn more about how customers and partners can build secure, resilient, and reliable AI systems designed for enterprise scale.
Join us virtually On February 3, learn how organizations are preparing their infrastructure and security foundations for responsible AI.
