The loudest part of Cisco’s 2026 story has been networking. A raised fiscal 2026 target of $9 billion in hyperscaler AI infrastructure orders, five new hyperscaler design wins in a single quarter, Acacia optics on track to grow more than 200% for the fiscal year. Hard to argue with any of it. But the more durable bet may be sitting one layer above the network, in security and observability software that almost no one outside enterprise IT is watching closely.

In eight weeks this spring, Cisco made two acquisitions that together form something its competitors will struggle to assemble quickly. On April 9, 2026, Cisco announced its intent to acquire Galileo Technologies, an AI agent observability platform built to evaluate AI quality, detect failures before they reach users, and continuously improve AI behavior in production. Then, on May 4, 2026, Cisco announced its intent to acquire Astrix Security, with the deal widely reported to be valued at roughly $400 million, though Cisco did not disclose financial terms.

Those are not two unrelated bets. They are two sides of the same problem.

Enterprises are seeing an explosion of AI agents already reshaping the digital enterprise. Soon, every person in an organization will be supported by a network of AI agents working continuously at machine speed, accessing data, making decisions, and taking action. These agents represent an entirely new class of coworker: capable of incredible productivity, but also capable of unintended harm or malicious behavior if left unsecured. This is the new attack surface, and it is growing faster than most organizations realize.

Galileo addresses the observability side of that problem. It builds on Splunk Observability Cloud’s AI Agent Monitoring capabilities and targets observability across the agent development lifecycle. Astrix handles the identity side, focused on securing non-human identities such as service accounts, API keys, and OAuth tokens that applications and AI agents rely on to access corporate systems and perform tasks. The platform is positioned to help inventory that access, manage lifecycle risk, and detect threats such as compromised credentials and out-of-scope actions.

What makes the combination worth paying attention to is integration. Standalone non-human identity vendors can discover agents and flag anomalies, but they cannot correlate an out-of-scope agent action against network traffic patterns and endpoint telemetry simultaneously. Cisco can. That is the compounding advantage built on top of the $28 billion Splunk acquisition that closed on March 18, 2024.

The financial picture supports the thesis. Fiscal Q3 2026 was a strong quarter for Cisco, with revenue and earnings per share both growing double digits and coming in above the high end of guidance ranges. Record revenue of $15.8 billion in fiscal Q3 2026 was up 12% year-over-year. Fiscal Q3 product orders were up 35% year over year, and the strength was broad based. Security revenue was flat in fiscal Q3 2026, reflecting declines in prior generation products and the transition in Splunk from on-premise deals to cloud subscriptions, but management pointed to momentum in new and refreshed security products.

The risk is execution. The $28 billion Splunk acquisition must generate meaningful cross-sell growth and platform revenue. If enterprise adoption is slower than expected or integration costs increase, the acquisition could weigh on earnings longer than anticipated. Weaving Galileo and Astrix into Splunk, Duo, and Cisco Identity Intelligence on an aggressive timeline, while also managing a restructuring plan with roughly $1 billion in estimated pre-tax charges, leaves limited room for slippage.

But the market Cisco is positioning to own is real and growing fast. One widely cited estimate put the global non-human identity access management market at about $11.1 billion in 2025, growing to about $12.4 billion in 2026. Every enterprise deploying AI agents needs this layer. Cisco has made sure it controls the stack from network to credential to behavior. That is not a minor product update. It is a platform argument.