Cisco has announced a new artificial intelligence capability, Instant Attack Verification, designed to automate and accelerate security operations center (SOC) investigations. The new feature, part of Cisco XDR, functions as an AI security analyst, aiming to enhance the scalability, quality, and speed of security operations by a factor of 100.
Instant Attack Verification is engineered to address the challenge of alert overload faced by SOCs, where a high volume of alerts, many of which are false positives, can lead to analyst burnout, inconsistent decisions, slow response times, and increased dwell time for actual threats. The system is intended to augment human expertise rather than replace it, by handling both Tier-1 and Tier-2 analyst functions in an automated workflow.
As a Tier-1 analyst, the AI triages incoming detections, enriching alerts with context, filtering false positives, and prioritizing genuine threats. For Tier-2 functions, it conducts deeper investigations, correlating evidence across various data sources including endpoint, network, cloud, and identity data. It reconstructs incident timelines and attack graphs, determines the scope of a threat, classifies incidents, and recommends immediate containment actions as well as longer-term hardening measures. All findings are documented with a full evidence trail.
The system assigns a triage classification and a confidence score to each incident within Cisco XDR, such as "Decisive True Positive" with high confidence, alongside a reconstructed attack graph. The AI-generated analysis includes a narrative that links entities, indicators, and MITRE techniques, providing analysts with a comprehensive view for verification.
Cisco emphasizes that the success of an agentic SOC analyst relies on trust, which is built through measured accuracy and explainability, resilience against adversaries, and thoughtful human oversight. Key metrics for success include automation rate, which measures the proportion of alerts handled without human intervention, and concordance, which assesses how often the AI's verdict matches that of a human analyst. The company stresses the importance of never allowing the automation rate to outpace concordance. Other operational metrics include time-to-investigate, throughput, and reliability, with a critical focus on minimizing false negatives.
The economic benefits are projected to stem from reduced investigation costs per incident, increased throughput, and decreased dwell time for threats, which in turn lowers expected breach costs. However, these benefits are contingent on two critical safeguards: adversarial safety and human-in-the-loop design. Adversarial safety dictates that all evidence be treated as untrusted data, with isolated tenants and privileges, high-impact actions gated by human approval, and continuous red-teaming. Human-in-the-loop design ensures that autonomy is earned incrementally, consequential actions remain gated, and analyst corrections are fed back into the system for continuous learning.
Instant Attack Verification integrates with the Cisco Data Fabric, an architecture powered by the Splunk Platform that became generally available in August 2026. The Data Fabric is designed to connect data, context, and action across various domains, enabling both human and AI agents to access and act on data securely. The AI capability leverages components of the Data Fabric such as Federated Search for accessing data across S3, Azure, Snowflake, and Databricks, and the Machine Data Lake for durable, low-cost data retention. The Catalog assists agents in discovering relevant data, while AI Canvas serves as a platform for investigations and approvals. The Splunk MCP Server acts as the interoperability layer, allowing Instant Attack Verification to orchestrate the Data Fabric.
Cisco clarifies that the Data Fabric provides the underlying data and interoperability substrate, while Instant Attack Verification is a specialized agent operating on top of it. The two are complementary layers, with the Data Fabric enabling secure data access and agent actions, and Instant Attack Verification focusing on sophisticated security detection and investigation.
