Network World

Cisco is expanding Splunk’s AI capabilities to self-managed environments and adding observability tools designed to help enterprise IT teams monitor AI agents, control token costs, and troubleshoot problems across applications and networks. Announced at Splunk’s .conf26 this week, the updates include Cisco AI POD for Splunk, which brings Splunk AI capabilities to on-premises and air-gapped environments. Cisco also expanded Splunk Agent Observability with Tokenomics and introduced Observability Studio and a Network Intelligence App. The products target challenges enterprises face as they move AI agents into production, where IT teams need to know whether agents are behaving as expected, how much they cost to run, and how they affect infrastructure and applications. Cisco executives said during a press briefing that AI agents are operating across data centers, campuses, and branches, and interacting with enterprise resources and other agents. For example, if an agent deletes thousands of files, IT teams need to determine whether it malfunctioned or was compromised. ## On-premises option: Cisco AI POD for Splunk Aimed at enterprises that need to keep sensitive machine data within their own environments, Cisco AI POD for Splunk “brings Splunk AI to on-premises customers with new AI runtime software, Cisco infrastructure, Nvidia accelerated computing, and Kubernetes-based architecture, pre-validated and optimized for Splunk AI workloads,” according to Cisco. “One of the biggest roadblocks to enterprise AI today is that it’s too hard to deploy,” said Jeetu Patel, Cisco’s president and chief product officer, in a statement. “Customers want to know: Can I trust it to do the job? Can I afford it? And, most importantly, can I secure it? By running Splunk AI on the infrastructure customers already trust, they can move faster to put AI to work in their business with confidence and control.” The on-premises option could be important for enterprises that need tighter control over corporate data, according to Bob Laliberte, principal analyst and founder at Liberte Research Group. “This is great news for organizations that require on-premises solutions due to privacy or sovereignty demands,” Laliberte says. ## Splunk monitors AI agents and token costs Cisco is also expanding Splunk Agent Observability, which monitors the AI stack, including GPUs, vector databases, memory, and orchestration frameworks, while evaluating agent output and behavior. Enterprises can assess agent quality and accuracy and apply runtime guardrails intended to block hallucinations, prompt injection, and other unwanted behavior. “It will be imperative for organizations to be able to observe agent behavior and report when it deviates from prescribed guardrails,” Laliberte says. Agent observability can also help enterprises evaluate agents’ effectiveness, identify where additional training or refinement is needed, and determine when tasks should be handed to humans, he says. Cisco is also targeting AI token consumption with Tokenomics. This capability tracks and attributes AI token spending and employee use of AI coding agents in real time, according to Splunk. It can help organizations understand costs, route workloads to more cost-effective models, and forecast consumption before a billing period ends. “Just like the cloud rush, many organizations have learned that tokenmaxxing is budget-depleting,” Laliberte says, adding that understanding token usage and costs across different models is becoming increasingly important. For network operations teams, Cisco introduced a Network Intelligence App that brings Cisco network topology, device health, and events into Splunk. The integration targets a troubleshooting problem: application, infrastructure, and network teams often use separate tools and have different views of the same incident. The app lets teams access network information alongside other Splunk telemetry and trace an alert to the associated device and surrounding network without leaving Splunk. Splunk Observability Studio moves observability earlier in application development by building OpenTelemetry instrumentation into development workflows rather than adding it after applications are deployed. Cisco says guided workflows can reduce instrumentation from hours to seconds or minutes. Building observability into applications from the beginning rather than bolting it on later should improve efficiency and be considered a best practice for new applications, Laliberte says. “Great to see the progress from last year’s visionary announcements to real capabilities being delivered and improved on over the last 12 months,” he says. Cisco AI POD for Splunk and Splunk AI Assistant are available now. Agent Launchpad, which will let customers build custom agents within Splunk, is expected later this year. Splunk Agent Observability is now available in Splunk Observability Cloud and Cisco Cloud Control.

Networks built for AI and HPC workloads have mostly focused on moving data faster between endpoints. That leaves compute idle while packets travel, a bottleneck vendors have tried to address mainly by adding bandwidth rather than changing what the fabric itself does. Cornelis Networks is taking a different approach. The company raised $205 million to fund its expansion into scale-up networking and introduced Active Compute Fabric, an architecture that puts programmable compute inside the network rather than using it only to connect endpoints. Cornelis emerged from Intel in 2020, when the team behind Intel’s Omni-Path architecture spun out as an independent company. Omni-Path is a proprietary network connectivity protocol that provides a competitive alternative to InfiniBand and Ethernet. In 2025, the company shipped its first generation of standalone products, the CN5000 platform. Cornelis Networks has since continued to develop its own SuperNICs, switches and software built for AI and HPC workloads. “I want Cornelis to be synonymous with game-changing technology that improves AI efficiency and eases some of the burdens that we’re facing in the world today about keeping it funded and responsibly so,” Lisa Spelman, CEO of Cornelis Networks, told Network World. ## The ‘path’ forward for enabling AI Cornelis built its first generation of independent products around Omni-Path exclusively. That architecture requires both Cornelis SuperNICs and switches end to end. The company’s second generation, the 800 gigabit CN6000, adds Ethernet support without giving up the proprietary architecture that differentiates its products. Spelman describes the CN6000 SuperNIC as multimode silicon capable of running either protocol. “You can use it in Ethernet mode, like RoCEv2 Ethernet mode, or you can use it as OmniPath end to end with the OmniPath switch,” she explained. “It’s one piece of silicon, both modes contained in it.” In Ethernet mode, the CN6000 can pair with switches from other vendors, including Broadcom’s Tomahawk line. Traffic sent over Ethernet still passes through an internal encapsulation layer built around Omni-Path. Spelman said that internal architecture preserves congestion management, credit-based flow control, and packet spraying, aimed at low latency and high message rates even when the wire protocol is Ethernet rather than Omni-Path. “We have the Ethernet protocol inside the chip, it’s an encapsulation layer, and it races around the chip like an Omni-Path packet, and then it comes back out and is retranslated back out to Ethernet,” Spelman said. “So, you still get some of the benefits of the Omni-Path native architecture, even though on the wire it’s Ethernet.” ## Putting compute inside the network Active Compute Fabric extends Cornelis Networks’ combination of proprietary performance and open standards into scale-up networking. It adds a new element—compute embedded directly into networking silicon—in an approach that differs from the functions found in a typical smart NIC or DPU. “If you think of a standard NIC, there might be a DPU or a smart NIC that does offload of network overhead,” Spelman said. “We’re taking it a step further and putting real compute, think RISC-V cores, into both the NIC and the switch that are capable of AI acceleration.” Cornelis does not design its own RISC-V cores. The company licenses the IP from a third-party RISC-V supplier and integrates it alongside its own ASIC designs. That approach is consistent with a fabless model, in which Cornelis builds only the components that differentiate its products. The compute embedded in the fabric targets functions such as KV cache acceleration and mixture of experts (MoE) routing. Spelman said that work can run inside the network rather than occupying GPU cycles, with inference as the clearest opportunity for those capabilities. “Inference acceleration is absolutely a sweet spot for us,” Spelman said. She said Cornelis continues to serve training workloads as well, with demand extending beyond hyperscalers and frontier labs to enterprise, government, and academic customers building out their own AI infrastructure. “The biggest thing we’re trying to solve is we’re giving you your GPUs back,” she said. “You’ve bought all these GPUs, and they’re being used at about a 50% rate, some people at 42, some at 48, some at 54. At that utilization, with a better, higher performing active network that has compute in the network, you can drive that GPU utilization up five points, 10 points, and really push your capabilities.” The scale-up push extends Cornelis beyond its scale-out heritage and into rack-scale interconnects. Spelman said that area is aimed squarely at accelerators outside Nvidia’s NVLink ecosystem. Active Compute Fabric for scale-up relies on open standards including UALink and ESUN rather than a proprietary link. “Our heritage has been in scale-out, but we see a huge opportunity in scale-up for all of the compute that doesn’t want to be on the NVLink ecosystem, isn’t looking to get so tied to Nvidia, wants options but needs that incredibly high performance and industry standards,” Spelman said.

Arm is expanding its push into AI data center infrastructure, introducing its most configurable Neoverse Compute Subsystem to date while highlighting growing industry adoption of its Arm AGI CPU for agentic AI workloads. The new Neoverse CSS N4 is designed to give customers a faster path from processor design to production silicon, while the Arm AGI CPU provides a production-ready processor aimed at workloads that require highly responsive CPU performance, according to the company. The announcement reflects Arm’s larger effort to position its architecture as a foundation for the next phase of AI infrastructure, where workloads move beyond conventional model inference and into autonomous agentic systems. The Neoverse CSS N4 is its most configurable Compute Subsystem yet, allowing customers to build customized silicon for applications ranging from AI compute platforms to data-processing units, networking and other specialized infrastructure. CSS N4 can incorporate up to 128 processor cores on a die and supports LPDDR6 memory and PCIe Gen 7 connectivity. Arm claims the platform can deliver up to twice the performance, 1.25 times the performance per watt, and 1.75 times the memory bandwidth of the previous generation Neoverse CSS N3. Arm has become increasingly aggressive in pursuing the data center business lately. In March, the company introduced the Arm AGI CPU, its first Arm-designed data center processor. The chip is based on Neoverse V3 cores and was developed in partnership with Meta. Arm claimed that the processor could provide more than twice the performance per rack of comparable x86 systems, although that figure is based on Arm’s internal estimates and depends on system configuration and workloads. The AGI CPU contains up to 136 Neoverse V3 cores and has a 300 watt TDP. Arm’s reference design uses two processors in a 1U, two-node configuration, providing 272 cores per blade. A fully populated air-cooled rack can reach 8,160 cores, according to Arm, while a liquid-cooled configuration can exceed 45,000 cores per rack. Arm said the AGI CPU is gaining support from companies across the AI and cloud ecosystem, including OpenAI, Meta, Cloudflare, Oracle, SAP, Lenovo, Supermicro, and Verda. The company also noted the broader adoption of Arm-based processors for agentic AI. Google Cloud is running agent sandboxes on its Arm-based Axion infrastructure, Microsoft Azure is using its Cobalt 200 processor for sandbox tool execution, and Nvidia’s Vera platform is also designed around agentic workloads.

Broadcom is raising the stakes when it comes to preventing its VMware customers from moving to another platform. The company has stopped users from downloading its Virtual Disk Development Kit (VDDK). While this may not look like significant news VDDK is, in fact, a vital part of tools used to migrate away from VMware. For example, it is used by Microsoft Azure Migrate, Red Hat’s Migration Toolkit, Nutanix Move, and VMware-to-KVM migration products — in other words, many of the applications that will assist disgruntled customers from navigating away from VMware. The kit is still available to larger Broadcom software partners, but can no longer be downloaded by anyone for free. Broadcom made the move, reported by the VirtualizationHowTo website, with little warning, no deprecation announcement, no alternative link, nor any explanation. The original download link for VDDK now leads to a 404 page, as do many of the support pages for it. Redditors complained about the missing pages, with one sharing links to copies of VDDK hosted by the Internet Archive. Those files have since been removed from the archive, and the download page has also been excluded from the Wayback Machine, the Internet Archive’s index of past web pages. Such exclusions can occur at the site owner’s request, or if the uploads are found to breach the Internet Archive’s policies. Since purchasing VMware, Broadcom has been making things more difficult for users, with higher prices, unfavorable support terms and unnecessary product bundling. It has boosted its financial returns on the product but customers are seeing fewer benefits. Making it harder to obtain the tools necessary to walk away from VMware may not be sufficient to stem the tide.

Network infrastructure owners often tell me that the biggest obstacle to network cyber resilience is the complexity of multi-vendor network environments. They aren’t just referring to the number of vendors in their environment, but also to the variety of device types (firewalls, routers, switches and access points), models and software versions. Well-resourced organizations with vendor-specific expertise on their NetOps team can usually manage three to five vendors at most. Beyond that, the talent, skill and training required to handle greater complexity are often beyond their reach. While it’s difficult to assemble a team with depth and breadth of expertise, it’s even more challenging for that team to have the capacity to proactively manage risks across complex networks. Do the math and it becomes obvious that the numbers work against us. For a large healthcare provider with over 20,000 devices from five main vendors, comprised of approximately 200 different device types, models and versions, there are tens of thousands of permutations — conservatively. Adding another point to the discussion, large organizations that have been around for years often have multiple generations of some products. Rather than retire a three-year-old firewall, they move it internally where it can still add value, and NetOps teams keep it operational and secure for as long as possible. The complexity of managing these environments is growing exponentially and overwhelming teams. ## The need for speed is real, and AI can be that accelerator AI adoption for network management has been slowed by interoperability gaps across vendors and a heavy reliance on tribal knowledge held by senior engineers. Understandably, teams hesitate to trust automated or AI‑driven decisions that can impact networking infrastructure, but that’s not where AI shines. Instead, teams should focus on the data that underlies the decisions and standard operating procedures (SOPs) that strengthen network cyber resilience. Using AI for knowledge gathering and repetitive tasks gives humans more time for productive work, where detailed operation and organizational knowledge is crucial. AI provides consistency, accuracy, scalability, attention and cost-efficiency for structured tasks, while humans apply their expertise for oversight and decision-making. Gartner predicts AI agents will be implemented in 60% of all IT operations tools by 2028. Let’s explore the core value AI offers NetOps teams responsible for managing multi-vendor networks. ## Focus on what matters most to your organization A few common examples include vulnerability prioritization, compliance monitoring and live device checks. - Scouring multiple trusted sources for news on the latest common vulnerabilities and exposures (CVEs) for different devices takes hours, if not days, of manual data gathering and analysis. The emergence of AI-driven vulnerability discovery capabilities such as Mythos underscores the need to compress the timeline from data aggregation to remediation. AI can aggregate and normalize data, add context to prioritize in your environment and deliver actionable insights in minutes, so you can focus on the vulnerabilities that matter. - If you prioritize vulnerabilities, compliance becomes your first line of defense. It protects you against CVEs by strengthening your security posture. In fact, 87% of CEOs say that cybersecurity and privacy regulations effectively reduce organizational risk. AI can monitor configurations for alignment with your compliance regime (including regulatory requirements, industry standards like CIS benchmarks or your organization’s best practices) and immediately alert on exceptions, suggest actions and send detailed reports. - Increasingly, NetOps teams need the ability to perform live checks to verify device status or to rapidly respond to a list of security team requests triggered by an audit. AI can check all your devices for the latest backups, current configurations or alignment with compliance policies, and notify you of the status. It can even send real-time notifications whenever a device changes. ## Apply that logic across other vendor devices to proactively check status Now that you have the status for one group of devices, the questions that typically follow include: - Are my other vendors and products impacted by the same CVE? - Do my other devices align with my compliance checks, and do they match the golden configuration I have set for this vendor and product? - Can you tell me if any of my devices have drifted from their expected configuration? AI can collect relevant data from other network devices you’re interested in and display the status. You quickly find out whether devices from other vendors are affected by the same CVE, have passed or failed a compliance check, and whether a configuration needs updating. ## Get recommendations for remediation The next step is to use the data to determine how to remediate. AI can compile information on available remediations from trusted sources and recommend actions. Often there are several options: a patch, a workaround, an upgrade or a configuration change. As an expert, you should ask AI to explain the reasoning behind the recommended device change, so you can verify the remediation or request an alternative. AI can also compile a list of commands from device manufacturers’ web pages and technical documentation, providing the steps to remediate a vulnerability or bring devices back into compliance. ## Chain automated tasks to reinforce SOPs and accelerate action Regardless of the type of change required, AI can help accelerate the process with a human in the loop to validate or adjust each step as needed before deciding to automate. You can chain actions together using AI to support automated tasks aligned with SOPs and ensure auditability. Actions typically include: completing a backup in case recovery is needed, performing the task to make the change, running a compliance check and testing to confirm the change took effect. A multi-step, trust-but-verify approach gives teams a head start and the confidence they need to apply a change across a wider fleet of network devices. Network complexity will continue to grow, but it doesn’t have to hinder network cyber resilience. Using AI to bridge vendor fragmentation and reinforce standard operating procedures gives NetOps teams the capacity and confidence to proactively mitigate risk across multi-vendor networks — at scale.