True agentic operational capability is no longer a future-thinking concept.
At the NVIDIA booth during Cisco Live 2026, our ePlus team unveiled AgenticOps, a platform we architected, integrated, and validated together with Cisco and NVIDIA. Over 300 visitors stopped by and watched our demo, and the feedback was outstanding. People were thrilled, because we showed them agentic AI handling real-life scenarios that enterprise operations teams face every day.
What did we show?
AgenticOps has wide-spread potential for IT and security operations, and there were many use cases we could have addressed. But for our demonstration, we focused on three problems:
- Skill file tampering
An AI agent’s skill file was modified to delete a production database. AgenticOps detected the unauthorized modification, halted execution before the production database could be touched, restored the skill file, and logged the full incident. - Unauthorized data exfiltration
An unauthorized attempt was made to gain access to internal files and upload them to an external destination. AgenticOps immediately flagged the behavior, classified it as a data exfiltration attempt, and enforced containment before a single file left the environment. All activity was logged with a complete forensic record. - Application degradation
AgenticOps correlated telemetry data from across the environment, identified the root cause of the degradation, and then automatically executed the remediation playbook before users experienced any impact.
Each of these problems (once a human engineer is notified) would easily take 30-60 minutes to resolve, maybe longer. AgenticOps handled each one in seconds, and no human was involved.
This capability is certainly exciting. And while it can offload work from stressed operations teams, there are more serious reasons for enterprises to adopt the technology.
Why AgenticOps and why now?
Let’s answer the second question first. Both IT and security operations teams rely on alerts to keep systems running and data protected. Advanced telemetry has been tremendous in helping teams monitor their environments. It’s also resulted in the average enterprise SOC receiving tens of thousands of alerts per day.
Alert fatigue is common. Modern tools may help with noise reduction (and other tasks), but the hard work of investigating serious alerts, correlating them across systems, determining their severity and impact, and initiating a response still relies on humans.
While this is not a new challenge, two things are changing that will make our current processes untenable: the growing adoption of AI, and the vast increase in AI-driven cyberattacks.
These two changes are causing alert volumes to far outpace the ability for teams to respond, regardless of the size of the teams. The speed of the technology is simply overwhelming, and when teams become overwhelmed, issues and threats get missed. This potential problem was made painfully clear by the recent Anthropic issue where AI escaped its guardrails and showed just how easily it could exploit vulnerabilities in the wild.
Regardless of the specific issues surrounding the Anthropic incident, one sobering fact remains: AI can scan for and exploit vulnerabilities at machine speed, and these types of threats will only increase in volume (and effectiveness) in the months and years ahead.
AgenticOps addresses this challenge by employing AI agents to eliminate manual steps in operations. In effect, it enables your infrastructure to monitor itself, to understand when things are not right and why, and then to fix it, automatically, at machine speed, without the need of human intervention.
How the platform works
There are a lot of tech products that help with different aspects of operations. But it’s integration that turns individual products into a functioning framework. We built AgenticOps on four layers using:
- Cisco Secure AI Factory with NVIDIA
- Cisco AI Defense
- Cisco DefenseClaw
- Splunk Observability Cloud
- NVIDIA Nemotron
- NVIDIA NemoClaw
Each layer is integrated to deliver true agentic AI capability (see Figure 1.0).
Figure 1.0: Agentic AI Architecture
Layer 1 – Intelligence
At the heart of the framework is the AI reasoning capability. This is provided by NVIDIA NIM and Nemotron. The reasoning model takes telemetry inputs and produces structured decisions with confidence scores, allowing the system to determine what happened, why it happened, and what should be done.
Layer 2 – Infrastructure
The AI models run on-premises on GPU compute provided by Cisco Secure AI Factory with NVIDIA. The infrastructure is validated and certified to handle intensive AI workloads.
Layer 3 – Governance
The governance function is performed by three integrated components: NVIDIA NemoClaw, Cisco DefenseClaw, and Cisco AI Defense.
NVIDIA NemoClaw acts as the policy orchestration engine. Every automated action performed by an agent is mapped to an approved policy to ensure all actions remain within operational boundaries and a full audit trail is generated.
Before any agent component is allowed to act, Cisco DefenseClaw scans AI agent skills, MCP servers, and agent-generated code for vulnerabilities and enforces security policies.
Cisco AI Defense governs the broader AI usage across the enterprise. This includes monitoring model access, enforcing usage policies, and detecting anomalous AI behavior.
Layer 4 – Observability
The telemetry foundation is provided by Splunk and Elastic. Splunk receives every signal from every system (network, compute, application, security, and AI infrastructure), correlates events, maintains an audit trail, and provides end-to-end visibility. This gives human engineers a dashboard view of exactly what the system did and why.
Why we architected it this way
We made several deliberate choices when we built AgenticOps.
- On-premises
Every AI model, every agent, and every decision runs in your environment, and all your telemetry data, security signals, and infrastructure data remain under your control all the time. - Policy-governed autonomy
Every action taken is bounded by policy, approved by a governance engine, and logged with a complete audit trail. Human engineers set the policies and agents operate within them. - Non-proprietary components
AgenticOps uses tools most enterprises already have and integrates them into a unified operational framework. - Three pillars of value
AgenticOps is not a point solution. It is designed around three enterprise pillars of value: Secure AI Foundation, Agentic ITOps, and Agentic SecOps. Each pillar has independent value, but together they form a complete autonomous operations platform that covers the full operational surface of an enterprise environment.
The platform in action – explained
Here’s a more detailed explanation of how AgenticOps works within the two operational domains of IT and security.
IT Operations (ITOps)
In traditional operations, when a problem occurs, a human must get involved to investigate and respond, assuming they notice the alert.
With AgenticOps, telemetry data from AppDynamics, ThousandEyes, Cisco DNA Center, Meraki, Intersight, and IOS XE flow continuously into Splunk. NVIDIA Nemotron analyzes the data to identify root cause, both what caused the problem and why (a network configuration change, a memory leak in a specific container, a storage workload that exceeded its allocation, etc.).
Then, the agent decides what should be done and executes the action. This could include escalating the issue to a human engineer or rolling back a configuration via Terraform or executing a remediation playbook via Ansible or something else. The action is determined by the reasoning engine based on policies.
ServiceNow receives the incident record, and Splunk logs every decision and action, automatically. For every issue escalated to a human, the engineer receives the full diagnostic picture already assembled.
Security Operations (SecOps)
Modern security tools do a good job of collecting and correlating signals. But everything after that depends on human judgment and action. When dealing with issues coming at machine speed, humans can’t keep up.
AgenticOps addresses this problem. It doesn’t replace the security and correlation tools you already have; it uses those and then automates the investigation, decision, and response steps.
Telemetry data flows into Splunk from your entire security and infrastructure stack. Splunk correlates all of this data in real time. When something suspicious happens, the platform launches an investigation without requiring anyone to open a ticket.
NVIDIA Nemotron and Cisco AI Defense work to determine if there is a genuine threat. NVIDIA NemoClaw governs every automated action to ensure nothing happens without policy approval and a full audit trail. When the system determines with sufficient certainty that a real threat (not a false positive) exists, Cisco DefenseClaw enforces containment.
Everything is tracked: forensic evidence is stored, a ServiceNow incident is opened, and Splunk records the full detection-to-action sequence.
The road ahead
AgenticOps will enable you to meet the growing threat of machine-speed attacks and alerts. And let your engineers do what they do best: spend 60-70 percent of their time on strategic planning, architectural decisions, and policy definition instead of performing routine tasks.
As it stands today, AgenticOps is the foundation. What is built on top of it will continue to expand. The four agentic layers represent the full scope of what autonomous enterprise operations look like:
- ITOps – autonomous IT operations: root cause analysis, self-healing infrastructure, capacity management
- SecOps – autonomous security operations: real-time threat detection, containment, and forensics
- ComplianceOps – continuous regulatory governance: automated policy enforcement and audit trail generation
- CapacityOps – intelligent resource optimization: workload balancing, cost management, performance tuning
Want to check it out for yourself?
If you missed our demo at Cisco Live 2026, we are happy to bring it to you. Just let us know. Reach out to your ePlus account team or contact us at ePlus.com.