AI is not just changing what runs on enterprise networks. It is changing who—or what—acts on them.
Software is becoming autonomous. Agents authenticate, select models, discover tools, invoke APIs, retrieve data, modify systems and delegate work—often without a human approving each step, and increasingly without a human approving any of them.
Consider a simple request: Fix the failing build. An AI coding agent might access a repository, consult a model, discover an MCP server, download dependencies, modify code and launch tests. One human instruction can become hundreds of machine-initiated interactions.
To the network, these are separate connections. To the user, they are one task. To security, they are a chain of actions taken under delegated authority.
The unit of risk is expanding from the session to the task.
Identity is necessary. Authority is not enough.
For decades, firewalls have asked: Who is communicating, with which application, to what destination, and should we allow the connection?
Those questions remain essential. But they cannot tell the whole story when a legitimate agent can take an illegitimate action.
The identity may be valid. The token may be valid. The destination may be approved. Yet an agent can still overreach—or be redirected by malicious content, a compromised tool or an overly permissive instruction.
Two connections between the same systems may look identical at Layers 3 and 4 while carrying radically different consequences. Reading a repository is not the same as rewriting it. Querying a production database is not the same as exporting its contents.
The policy question must evolve from “Can this actor connect?” to “Is this actor behaving within its role and delegated authority?”
Answering that requires context beyond IP addresses and ports: the agent, its identity and owner, the task it is performing, the model and tools it is using, and the behavior that follows. No single network flow provides all of that context. It must be assembled across identity, applications, endpoints and the network.
The AI traffic shift is inward
It is tempting to think of enterprise AI security as controlling employee access to public LLMs. That is only the first chapter.
For reasons of cost, latency, privacy, intellectual property, sovereignty and regulation, enterprises are deploying private models, smaller language models and inference services closer to their applications and data.
The architecture increasingly looks like:
User → Agent → Internal Model → MCP Server → Application → Data
Agents will communicate with internal tools, repositories, databases, APIs and other agents. Much of this activity may never leave the enterprise.
More enterprise AI does not necessarily mean more traffic leaving the enterprise. It can mean dramatically more traffic moving within it.
That changes where security must operate. Hybrid Mesh Firewall—enforcement distributed across physical, virtual, cloud and network environments—is increasingly important as trust boundaries multiply inside the enterprise.
Attackers are using AI, too
AI is not only changing how enterprises operate. It is beginning to change how adversaries operate.
Some attackers are already using AI to accelerate reconnaissance, find and weaponize vulnerabilities, craft more convincing lures and vary payloads faster than signature updates can follow. The window between vulnerability disclosure and exploitation continues to shrink—from weeks to days, and in some cases hours.
Patching rarely moves that fast. That makes one of the firewall’s oldest roles newly critical: buying time. Virtual patching can shield vulnerable systems before fixes are deployed. Behavioral and ML-based detection can catch attack variants no signature has seen. SnortML in Cisco Secure Firewall, for example, provides coverage for entire vulnerability classes rather than individual exploits. And protections can be pushed across every enforcement point in minutes, not at the next change window.
The network is where intent becomes observable action
Identity tells us who or what is acting. Policy defines what should be allowed. Applications provide their own account of what occurred.
The network offers a different vantage point: independent evidence of communication that actually took place.
Intent describes what should happen. Network telemetry helps establish what did happen.
A firewall cannot read an agent’s mind. It cannot infer every task from encrypted packets, and it cannot observe actions that never traverse the network. But when an agent reaches a tool, accesses a service, moves data or crosses a trust boundary, those communications become observable—and, at the right enforcement point, controllable.
That independent view becomes more valuable as agents operate faster, across more systems, with less human supervision.
It is also what the SOC team needs when something goes wrong. An agent’s own logs are written by the agent under investigation; the network record is not. When an analyst asks, “What did this agent actually touch?”, firewall telemetry provides an independent answer.
The firewall must become agent-aware, risk-aware and distributed
An AI-era firewall needs to recognize more than applications and destinations. It needs context about non-human identities, agents, models, tools and delegated authority, along with visibility into emerging protocols such as MCP, A2A and model APIs.
It must also connect the dots across interactions. A repository read may be routine. A repository read followed by an unexpected production connection and bulk data transfer is a different story. Each flow might be allowed in isolation; the sequence may indicate a policy violation.
That does not mean running heavyweight AI inference on every packet. It means matching inspection to risk.
Lightweight models can help classify encrypted traffic, identify applications and surface anomalous behavior. Cisco Secure Firewall’s Encrypted Visibility Engine already identifies client applications in TLS traffic without decrypting it. Deeper inspection—including decryption and semantic analysis where permitted—can be applied selectively when evidence, confidence and risk justify the cost.
Inspection follows risk. Enforcement follows policy.
The objective is not to inspect everything equally. It is to apply the right intelligence at the right place, fast enough to operate at enterprise scale.
Saying “no” to an agent
How the firewall blocks matters as much as what it blocks.
When a person hits a policy block, they see an error, stop and ask for help. An agent may not. Stopped halfway through fixing that failing build, it may retry repeatedly, search for another path to the same resource or simply quit, leaving the repository half-modified and the pipeline in an inconsistent state.
A silently dropped connection is the worst possible answer to an autonomous actor.
Where the firewall mediates agent protocols such as MCP and model APIs, enforcement should return structured denials: machine-readable responses that tell the agent—and its owner—what was blocked, which policy applied and what should happen next—stop, escalate to a human or request approval. Every denial also becomes evidence for the security team. A clear “no” turns a security block into a controlled outcome, not an unpredictable failure.
Performance is a security requirement—not a footnote
One human request may trigger hundreds of agent-to-agent and machine-to-machine interactions. If security cannot keep pace, customers face a bad choice between protection and performance.
Many networking decisions operate on microsecond budgets. That demands a deliberate division of labor: hardware acceleration for high-speed functions, purpose-built inference for selected classifications, and deeper software analysis where it adds value.
This is where Cisco brings a distinctive combination of capabilities: networking, silicon, hardware platforms and security software, engineered together.
The goal is more security per packet, per watt and per microsecond.
Purpose-built firewalls do not become less relevant as AI grows. Their throughput, high availability, resiliency and deep inspection become more important as autonomous traffic scales, particularly inside the enterprise.
AI should transform firewall operations—not make them unpredictable
The management challenge may be even bigger than the inspection challenge.
Enterprises already struggle with vast rule bases. Now add short-lived workloads, autonomous agents, private models and tools discovered dynamically at runtime. No administrator can encode every relationship as a manually maintained static rule.
Policy management must move toward intent. An administrator should be able to express a business boundary such as:
Development agents may access approved models, tools and repositories, but must not connect directly to production systems.
AI can then help discover dependencies, recommend policies, simulate impact, reveal gaps and detect drift. Automation can handle more low-risk, reversible changes while consequential decisions retain appropriate approvals and rollback.
But the operating principle must remain clear:
AI proposes. Deterministic policy decides.
The goal is not a firewall that unpredictably rewrites its own rules. It is a firewall that becomes radically easier to operate without sacrificing control.
A firewall that learns—and can prove its limits
The next generation of firewalling should operate as a continuous loop:
Observe → Attribute → Assess → Inspect → Enforce → Learn
Unknown applications, classification misses, behavioral anomalies, policy exceptions and analyst feedback should improve future decisions. But inference is not certainty. Decisions need explainable evidence, calibrated confidence and clear provenance.
Just as important is coverage proof: the ability to tell a security team whether a communication path is enforced, partially enforced, observed only, unsupported or unknown.
That honesty matters. Some agent activity stays on the host. Encryption constrains visibility. Not every flow can—or should—be decrypted. A firewall cannot reconstruct every intent from traffic alone.
Trust will come not from claiming to see everything, but from being precise about what we know, how we know it, how confident we are and what remains unseen.
Where AI meets reality
Cloud changed where firewalls live. Zero Trust changed the context of enforcement. Hybrid Mesh Firewall extended protection across distributed infrastructure.
AI changes something more fundamental: who acts, who attacks, how authority is delegated, how fast actions unfold and how much policy humans can manage.
The next evolution of firewalling must understand autonomous actors and task context, make sense of high-volume encrypted communication, apply inspection according to risk and turn complex security operations into clear, enforceable intent.
And it must still excel at the fundamentals: deep inspection, deterministic enforcement, predictable scale and availability under stress.
Because the consequence of an AI agent’s decision is not a prompt or a model response. It is an action against a real application, database, workload or system. When that action crosses the network, security has an opportunity to observe it—and enforce a boundary.
AI will decide more of what to attempt. The firewall must still decide what is allowed.
That is why the firewall is not fading into the background of the AI era.
It is becoming one of the critical places where AI meets reality.
Learn more about Cisco Hybrid Mesh Firewall.
