Advanced persistent threats were once the domain of highly skilled and well-funded attackers. Infrastructure teams could realistically deploy “good enough” security to reduce friction in their day-to-day because nation-state techniques demanded budgets, time, and expertise that most attackers did not have. That assumption no longer holds. AI is making sophisticated attack capabilities cheaper, faster, and available to many more adversaries.

The recent Hugging Face incident made that shift tangible. An autonomous AI agent chained ordinary weaknesses across production infrastructure, used overly broad credentials, and moved at a scale no human operator could sustain. When attackers can operate at machine speed, privileged access paths built around standing credentials and disconnected policy become an increasingly dangerous form of trust.

As that threat model changes, identity can no longer stop at the application boundary. It has to follow the people, machines, and AI agents that act on critical network infrastructure. Cisco’s recent Teleport partnership announcement introduced the idea of Infrastructure Identity: connecting who or what is acting to what it can access, what happened, and what it is allowed to do.

Infrastructure access has an identity problem

Picture an infrastructure administrator pushing a configuration update across hundreds of switches during a maintenance window. When a subset fails, the administrator needs to troubleshoot quickly before the window closes. But the access, and the privilege, required to do that work is often broader and more persistent than the task demands.

Organizations have invested heavily in protecting workforce access to applications with single sign-on, multifactor authentication, and risk-based controls. Yet when a network engineer logs into a router or switch, those identity-based controls often do not follow. Access may still depend on long-lived credentials, shared accounts, or separate policy systems, making it harder to enforce least privilege and see who did what.

Traditional Privileged Access Management (PAM) can reduce some of that risk through vaulting and credential rotation. But when approved paths slow urgent work, teams may create exceptions, making the workaround the norm and leaving usable privileges and credentials in place even after the task is complete. If the secure path is not the fastest and most reliable path, operators will find another way in—sacrificing security for speed.

Infrastructure teams need a fast, reliable path to the devices that keep the business running. Security teams need identity context, least privilege, and accountability by design. Organizations should not have to choose between operational resilience and strong control.

Introducing Cisco Privileged Infrastructure Access

Today, Cisco is introducing Privileged Infrastructure Access, a faster, more secure way to keep the network moving by enabling network administrators and agents to perform critical work through a secure, identity-bound connection. Infrastructure teams get a consistent path to critical network infrastructure. Security teams get policy control, temporary privilege, and a record of what happened. Everyone has what they need to keep infrastructure resilient, available, and secure.

Cisco is changing the model for privileged access, making it an on-demand action: cryptographic identity lets the right person or agent reach the infrastructure needed for the task. Access is mediated by short-lived privileges that expire at the conclusion of the task, with only the least privilege necessary to complete it. If there is no work being done, no privilege exists.

This gives organizations a governed alternative to the exceptions and workarounds they rely on today. It reduces dependence on static credentials, shared secrets, and broad access. And it limits the identity footholds that AI-powered adversaries can exploit. A single, agent-ready workflow reaches devices without separate hops or detours, making the secure path the fastest, most convenient path for network teams to use.

Identity for the actor. Privilege for the task.

Let’s go back to the administrator troubleshooting the switch update. For customers using Cisco ISE and TACACS+, Privileged Infrastructure Access can draw on the policy and device context they already manage to govern access to Cisco routers and switches. From there, they can extend the same access model to other infrastructure, including servers, Kubernetes clusters, and cloud resources. The administrator reaches the devices needed for the task through a temporary, identity-bound session. The session is recorded, and privilege ends when the work is done. That brings Cisco network context into the privileged access path while giving engineers a direct way to keep critical work moving.

That is access delivered just in time, with just enough privilege, and for just enough time. It gives infrastructure administrators the speed they need to troubleshoot and keep services available. And it gives security teams a clear record of who accessed what, under which policy, and what changed during the session.

The same model supports agentic operations. Humans, delegated AI agents, and automation scripts can operate through task-specific access and controls with activity attributed to the actor that performed it. Agents do not inherit broad, unmanaged access simply because they need to move quickly. They receive only the privilege required for the task with accountability built into the workflow.

Keep critical work moving. Keep privilege temporary.

Privileged access should help teams restore service and keep the business connected—not create a permanent foothold for an attacker. Cisco Privileged Infrastructure Access gives people and agents governed, task-specific privilege that expires when the work is done, so infrastructure teams can move quickly without leaving privilege exposed.

To learn more, register for the live broadcast here.