Splunk (Cisco) rebuilds platform around agentic AI at .conf26 — Agentic SOC Workforce expansion, AWS security co-development pact, on-prem AI POD

At .conf26 (Sept 15, 2026) Cisco/Splunk announced a broad agentic overhaul: expanded Agentic SOC Workforce (specialized agents for detection engineering, threat hunting, investigation, response, policy), Splunk Agent Observability with new Tokenomics (token-spend tracking + runtime guardrails against hallucination/data-leak actions), a Cisco AI POD for Splunk (on-prem/air-gapped agentic AI via NVIDIA), and a new multi-year AWS agreement to jointly build agentic-security products.

This is a strategic platform repositioning (not an incremental feature) from a top-tier SIEM/SOC vendor, combining agentic SOC automation with runtime AI guardrails and a major cloud co-development commitment — materially expands the addressable agentic-SOC and AI-observability-security market.

Enterprise SOC teams and Splunk/Cisco customers evaluating agentic SOC automation, on-prem/sovereign AI deployment, or AI cost/risk observability should assess now; broad GA rollout expected through late 2026.