As AI agents take on more work, organizations face a new challenge: how do they give agents the access they need to be useful, without giving up control over what they can do? That challenge only grows as AI infrastructure scales from individual servers to rack-scale systems and shared AI environments. Organizations need to know who an agent can reach, what actions it can take, and where data can flow.

At NVIDIA GTC Berlin, Cisco will spotlight how infrastructure-level security can help address this challenge. Cisco recently announced the expansion of Cisco Secure AI Factory with NVIDIA to rack-scale through a partnership with Supermicro.

This gives customers a path to deploy next-generation AI infrastructure with Cisco networking, security, and observability built into the architecture. It includes NVIDIA Cloud Partner (NCP)-compliant reference architecture for neocloud and sovereign clouds and expanded Enterprise Reference Architectures (ERAs) for the latest Cisco and NVIDIA based AI infrastructure. The NVIDIA’s OpenShell Reference Architecture complements this work, bringing focus on how to build, run, and observe autonomous agents and enforce safe behavior across enterprise and edge systems.

As purpose-built CPUs like NVIDIA Vera enable organizations to run increasingly complex agentic workloads at scale, the need to secure those workloads grows. Customers need confidence that agents can access the tools and data required to do their jobs, without creating new security risks. For IT teams, this means security controls that operate independently of the applications and agents they’re protecting, providing another layer of defense as AI deployments grow.

NVIDIA OpenShell Reference Architecture for Safe AI Agents is a full-stack, industrial-scale, open architecture for building, containing, observing and enforcing safe Al agents-from AI factories to enterprise infrastructure and the edge.

NVIDIA Sentry is a unified security software framework built on NVIDIA DOCA and running on NVIDIA BlueField-4 DPUs to protect AI agents at runtime. This infrastructure-level visibility can complement Cisco AI Defense’s application-level controls and guardrails, showing how security can be addressed across multiple layers of agent deployment.

DefenseClaw focuses on developers: containing agents in workstation sandboxes and making their actions visible and traceable. At the infrastructure layer, our challenge is to track agent workloads as they are deployed and run across distributed networks, then enforce policy near the traffic with BlueField DPUs. Cisco’s programmable platform SDK, now in development, is intended to enable those distributed enforcement services.

That platform is being built for NVIDIA BlueField, with programmable security services and APIs that gives developers a common foundation for building security services close to agent traffic. Our objective is to give enterprises and cloud providers an enforcement point close to the traffic agents generate, so they can apply permissions and govern access, actions, and data movement as AI use grows. For IT teams, this adds an infrastructure-level control point designed to operate independently of individual applications and agent runtimes, complementing application-level protections as agent workloads scale across the network.

Security that scales with AI infrastructure 

For enterprises and AI factory builders, the value of NVIDIA BlueField DPU-based enforcement is the ability to maintain security controls independently of the workloads they’re protecting. By separating DPU management from the workload host, the architecture can help preserve critical protections even when host-side security is compromised, provided the management plane is secured and traffic cannot bypass enforcement. Containment should also prevent agents from using approved services, such as package repositories, as relays to unauthorized destinations.

Deploying this layer alongside each server lets security scale with compute. Cisco is also planning a shared appliance for servers without onboard DPUs, broadening the approach to existing infrastructure.

A foundation for security services 

Delivering consistent security across increasingly complex AI environments requires a common foundation for applying policies, inspecting traffic, and understanding what’s happening across workloads. That’s what we’re working to build.

We have been defining and are developing reusable and resilient DPU-resident services bringing together software packet processing, policy enforcement, and hardware acceleration. Common APIs are intended to reduce integration work for developers and support services from Cisco and compatible controllers.

Vector Packet Processing (VPP) provides the high-performance, modular software data plane running on the DPU cores for these services. Its graph-based architecture lets us extend packet processing with functions for classification, traffic steering, telemetry, filtering, and policy enforcement. NVIDIA DOCA libraries expose BlueField hardware acceleration for suitable operations, combining flexible software processing with accelerated handling where it adds value.

We have stateful Layer 4 inspection, enforcement, and telemetry. These capabilities enable microsegmentation, that allows workloads to communicate over approved paths and helps limit lateral movement. Vendor offerings such as NVIDIA Sentry could provide accelerated TLS termination on the DPU, extending visibility into application requests and enabling Layer 7 services.

Containing agent access and activity 

The same principle applies to agents: grant the authority needed for a task, then keep access within that scope based on a continuous plan-observe-enforce workflow.

• Plan: Define each agent’s authorized scope and provide required credentials through a DPU-resident gateway that substitutes credentials without exposing underlying secrets to the agent.
• Observe: Capture high-fidelity telemetry on access patterns and inspect traffic as it moves between workloads, tools, and data.
• Enforce: Apply allow-or-block policies at the DPU, using observed activity to keep those policies aligned with the agent’s authorized scope.

This approach can help ensure that an agent receives only the access its task requires. For example, a support agent could retrieve billing information and create tickets while policy blocks bulk exports or account deletion. Activity and policy decisions can be recorded to help operators understand what the agent accessed and why.

Scale AI Inferencing Securely 

Building on these Layer 4 capabilities, we envision five security use cases for shared inference infrastructure across neoclouds, GPU-as-a-service providers, and enterprise AI clouds.

For providers of shared inference, the opportunity is to serve more customers on common infrastructure while maintaining tenant boundaries and operational visibility. Here are how DPU-enforced controls could help:

• Share GPU capacity while isolating tenants: A GPU-as-a-service provider can allocate shared capacity across customers while applying tenant- and VPC-aware rules outside workload hosts. Each customer’s workloads can be limited to approved communication paths, strengthening network separation, and helping contain the impact of a compromised workload.
• Limit lateral movement between workloads: A compromised workload can create risk for nearby servers, storage, and control services. Stateful DPU enforcement can allow only approved communication paths between workloads, helping contain a compromise and limit its spread when perimeter controls do not cover internal traffic.
• Protect bare-metal inference environments: Customers running bare-metal inference may require root access, while providers still need independent security controls. DPU-enforced firewall policies, administered separately from workload hosts, can preserve provider control even when host agents are disabled, while reducing security processing on the host CPU.
• Keep policies aligned with Kubernetes workloads: In Kubernetes environments, pods and services change frequently, so static IP-based rules can lose track of workload identity. Trusted Kubernetes identity and policy context can guide DPU enforcement as workloads change, helping keep network controls aligned with the services they are meant to protect.
• Make AI traffic easier to investigate and audit: Operations and compliance teams need to connect network activity to the workloads and tenants that generated it. A flow-evidence service could record timestamps, workload and tenant identifiers, destinations, and whether policy allowed or blocked a connection. This context could help teams investigate incidents, verify policy enforcement, and prepare audit evidence.

An architecture aligned with the ecosystem

Our focus is developing security services on a NVIDIA BlueField DPU-controlled data plane, with policy enforcement close to workload traffic. NVIDIA Sentry’s host-independent monitoring can provide workload runtime context, while its planned L7 inline proxy, long-form inspection capabilities and policy hooks would complement our application-level security services. As integration paths mature, we see opportunities to bring these capabilities together to help enterprises observe agent behavior and enforce policy across layers.

Agent security requires coordinated controls across runtimes, infrastructure, and paths to tools and data. Our NVIDIA BlueField DPU platform and security services remain in development, exploring how policy enforcement, traffic inspection, and telemetry can secure these paths alongside runtime protections and host-independent monitoring. Common interfaces are intended to support integration with security controllers and evolving agent architectures.

Cisco Secure AI Factory with NVIDIA helps you to build and operate AI with speed, simplicity, and security – from enterprise and multisite deployments to rack-scale architectures.

The goal is a practical path to production: start with a defined agent task, understand how it behaves, and expand access deliberately. We are working toward infrastructure that helps enterprises scale AI while keeping agent permissions clear, adjustable, and aligned with delegated authority.

Accelerate innovation with Cisco Secure AI Factory with NVIDIA

Secure, simple, from core to edge. Cisco delivers a full-stack AI Infrastructure with security and observability at every layer

Learn more