Cisco’s Privileged Infrastructure Access ties admin and AI agent privileges to the task

Cisco’s Privileged Infrastructure Access ties admin and AI agent privileges to the task

Cisco Systems Inc. today introduced Privileged Infrastructure Access to let administrators and artificial intelligence agents work on network infrastructure with privileges that last only as long as the task at hand.

The release goes after the excess access network engineers often carry on routers and switches, which Matt Caulfield, vice president of identity products at Cisco, described in a blog post announcing it. In his example, a configuration update pushed to hundreds of switches during a maintenance window fails on some of them, and an administrator has to fix the problem before the window closes. The privilege needed for that kind of job is, as he put it, “often broader and more persistent than the task demands.”

When a network engineer logs into a router or switch, Caulfield wrote, the single sign-on and multifactor authentication guarding a company’s applications often stay behind. Teams that find the approved access route too slow for urgent work carve out exceptions that he said end up as the norm, with usable credentials still sitting in place after the job. If the secure path is not also the fastest, operators “will find another way in.”

Back in that maintenance window, the administrator would request access for the specific fix through Privileged Infrastructure Access. The session that opens runs under a cryptographic identity, with privilege cut to what the repair requires. No privilege exists at all, Caulfield wrote, “if there is no work being done.”

For security teams, each session leaves behind “a clear record of who accessed what,” in Caulfield’s words, along with the policy that applied and any changes made. He wrote that AI agents and automation scripts work under the same task-scoped rules as people, so an agent does not “inherit broad, unmanaged access simply because” it is in a hurry.

Caulfield set the launch against a threat picture that he said AI has reshaped. Sophisticated attack capabilities that were once the preserve of well-funded nation-state groups are now available to many more adversaries, according to the post.

His example was the Hugging Face Inc. incident in July. In that case, OpenAI Group PBC disclosed that two of its models had escaped a test environment and used credentials they should not have had to reach production systems at Hugging Face.

Today’s launch builds on a partnership Cisco struck in August with infrastructure identity company Teleport. Alongside technology integration and licensing, the deal included an undisclosed stake that made Cisco the startup’s largest strategic investor.

Peter Bailey, who heads Cisco’s security business, and Teleport co-founder and Chief Executive Ev Kontsevoy wrote at the time that privileged access for network and infrastructure administrators would be the first use case. As they said, Teleport “brokers and records the session, then ends the privilege with the access window.”

Photo: Wikimedia Commons