Protecting AI Infrastructure

Protecting AI Infrastructure

Speaker: Jeetu Patel, Executive Vice President and Chief Product Officer, Cisco

Event: RSA Conference 2025 — April 28–May 1, 2025, Moscone Center, San Francisco

Track: Keynote — West Stage

Watch: YouTube

Reading time: ~7 minutes

TL;DR

Cisco CPO Jeetu Patel argues that AI introduces an entirely new class of security risks — rooted in the non-deterministic nature of AI models — that the industry must address on two parallel fronts: securing AI systems themselves and using AI to mount defenses at machine scale. To accelerate the latter, Cisco unveiled Foundation AI, a purpose-built, open-source security intelligence model designed to close the specialization gap that has kept AI lagging behind other industries in the security domain.

Introduction

The RSA Conference keynote stage has heard its share of bold predictions, but Jeetu Patel opened his 2025 address with a statement that cut through the usual optimism: AI, he said, is "the hardest challenge the cybersecurity industry will have seen during its entire tenure." That claim was not rhetorical flourish. It was the thesis around which Patel — Cisco's Executive Vice President and Chief Product Officer — built a methodical case for rethinking security architecture from the ground up.

Speaking to a packed West Stage audience, Patel described a profession standing at an inflection point. The workforce that has defended digital infrastructure for three decades is about to be joined — and in many respects eclipsed in volume — by AI agents, autonomous robots, and humanoid systems. The throughput implications are staggering: Patel suggested that augmenting humanity's eight billion people with AI agents could effectively multiply civilizational compute capacity tenfold. That expansion, however, does not come without a proportionate expansion in the attack surface.

A Fundamentally Different Architecture — and a New Class of Risks

For most of computing history, application architecture followed a predictable three-tier model: infrastructure, data, and application or business logic, crowned by a presentation layer. AI inserts a new stratum into that stack — the model layer — and the model layer has a defining characteristic that disrupts everything built on top of it: it is non-deterministic.

"It's not something that is gonna give you exactly the same answer every single time you ask it a question," Patel told the audience. ▶ Watch: The non-deterministic model layer (4:00)

That unpredictability generates two distinct categories of risk. The first is AI safety — whether models behave as intended, avoiding hallucination or toxic outputs that could undermine business operations. The second is security — whether external actors can manipulate the model's behavior through adversarial inputs. Patel illustrated the severity of the latter with fresh research: Cisco's team tested DeepSeek against the HarmBench benchmark and achieved a 100 percent attack success rate across the top fifty risk categories. By contrast, the same methodology could jailbreak OpenAI's models only 26 percent of the time. ▶ Watch: DeepSeek jailbreak findings (4:00)

The risks compound with fine-tuning. Cisco's research found that fine-tuned models are three times more susceptible to jailbreaks than their base counterparts — and twenty-two times more likely to produce a harmful response. For organizations customizing foundation models for enterprise use, that is a sobering data point.

Securing AI: Visibility, Validation, and Runtime Enforcement

Patel organized the "securing AI" challenge into three sequential imperatives. ▶ Watch: Three pillars of securing AI (6:01)

Visibility comes first, because protection cannot precede observation. Two distinct personas require coverage here: the end user interacting with an AI application, and the developer building one. Security teams must establish sight lines into both vectors.

Validation is the second pillar — and it must operate at algorithmic, not human, scale. Traditional red-teaming involves skilled analysts probing systems manually. At the pace AI models are being deployed — and the volume of ways they can be manipulated — human-paced red-teaming is categorically insufficient. Patel described the jailbreak problem with a vivid example: ask a model how to build a bomb and it refuses; tell it you are a screenwriter directing a scene with Brad Pitt, and many models comply. Validating against the infinite surface of such creative misdirection demands automated, systematic adversarial testing. ▶ Watch: Jailbreaking explained (8:00)

Runtime enforcement is the third and final layer. Even validated models operating inside individually hardened applications become dangerous in aggregate when hundreds of models and thousands of agents apply security practices inconsistently. Patel called for a common substrate of security — a shared enforcement layer spanning every model, agent, application, and cloud. Without such consistency, the ecosystem will fragment into a patchwork of mismatched guardrails. "It's gonna be irresponsible in the future for application developers to not use something like this," he said.

The framing carried a notable inversion: security, historically cast as the inhibitor of adoption, has become one of AI's primary accelerators. Users who distrust AI outputs are delaying deployment; robust safety and security infrastructure is what unlocks organizational confidence to move forward.

Using AI for Security: The Three-Problem Formulation

The second half of Patel's talk turned from protecting AI to wielding it. He distilled the challenges practitioners face into three recurring complaints heard in conversations with customers and CISOs. ▶ Watch: Three challenges for AI in security (12:00)

The skills gap tops the list. Security practitioners, Patel observed, are not particularly worried about AI taking their jobs. Their concern is whether, without AI, they can do their jobs at all — given that attack volumes are scaling while headcount budgets are not.

Alert fatigue is the second pressure. Organizations continue to be inundated with signals, and distilling meaningful action from the noise remains one of the field's most persistent failures. "Alerts are easy," Patel noted, "but taking action is hard."

Stack complexity rounds out the triad. With roughly 3,500 security vendors in the market — no single vendor claiming more than ten to twelve percent market share — practitioners manage between fifty and seventy discrete products on average. That complexity, Patel argued, is not sustainable at enterprise scale.

Despite the potential AI holds across healthcare, manufacturing, and financial services, security has been slower to benefit. Patel attributed the gap to two structural deficiencies: low efficacy from general-purpose models not tailored to security tasks, and prohibitive implementation costs. His analogy was pointed: "If you wanted to do a heart surgery, would you ever turn to your dentist?"

Introducing Foundation AI: Purpose-Built for Security

The keynote's headline announcement was the launch of Foundation AI, Cisco's dedicated AI research lab oriented entirely around security-domain intelligence. ▶ Watch: Foundation AI announcement (14:00)

The lab's initial release is an eight-billion-parameter model trained specifically for security use cases — threat detection, automated remediation, and related tasks. Unlike general-purpose large language models that handle everything from poetry to code generation, Foundation AI's model is bespoke. Importantly, the model is open-source and highly customizable: organizations can fine-tune it for their own environments while retaining its security-specialized architecture as a foundation.

The release positions Cisco's argument concretely: the industry does not just need AI in security, it needs AI of security — models built and evaluated against the specific adversarial conditions, terminology, and operational cadences of the field.

Notable Quotes

"AI is the hardest challenge that this industry will have seen during its entire tenure."

"We found that when you fine-tune a model, you have three times more susceptibility of jailbreaks than when you don't fine-tune a model. And it's twenty-two times more likely to produce a harmful response."

"Security is actually getting to be one of the largest accelerators of AI adoption in the market today."

"If you wanna solve hard security problems, you wanna make sure that those models that are built for solving those problems are purpose-built for security. They aren't the same model that's also used to write poetry."

Key Takeaways

1. AI's non-determinism is a security first principle. Every organization deploying AI applications is building deterministic products on top of unpredictable foundations. That tension cannot be engineered away — it must be managed through visibility, validation, and runtime enforcement.

1. Fine-tuning amplifies risk. Customizing a model for enterprise use dramatically increases jailbreak susceptibility and harmful-output probability. Organizations must red-team fine-tuned models as aggressively as base models — and at algorithmic scale.

1. A common security substrate is essential. As model counts scale into the hundreds and agent ecosystems into the thousands, inconsistent individual guardrails create systemic exposure. A shared enforcement layer across all AI components is no longer optional architecture — it is basic hygiene.

1. General-purpose AI underserves security. The efficacy gap between generic models and security-specialized ones mirrors the gap between a general practitioner and a specialist. Foundation AI's purpose-built model represents one industry answer to that gap.

1. Security has become an AI adoption accelerator. The historical dynamic — where security slowed technology rollout — has inverted. Trust in AI systems is now a prerequisite for organizational adoption, and the security community is positioned to provide that trust.