Cisco is expanding Splunk AI to on-premises, private cloud, and air-gapped environments through a new architecture developed with NVIDIA, according to an announcement made at Splunk .conf in Denver. The move addresses security, sovereignty, and data-location requirements that prevent many Splunk Enterprise customers from using public cloud deployments. The new offering, called the Cisco AI POD for Splunk, is part of a broader set of updates that also includes new AI observability and token-tracking capabilities, along with an expanded AWS partnership focused on agentic security operations.
The Cisco AI POD for Splunk is a configuration within the Cisco Secure AI Factory with NVIDIA, a reference architecture built around Cisco AI PODs. It combines Cisco infrastructure, NVIDIA accelerated computing, new AI runtime software, and a Kubernetes-based architecture that has been pre-validated and optimized for Splunk AI workloads. The platform makes Splunk AI Assistant available immediately, while Agent Launchpad is expected later this year. Customers can self-host a selection of open and proprietary generative AI models for Splunk Enterprise workloads, including Cisco's Deep Time Series Model, Google Gemma 4, and OpenAI GPT-OSS 20B, with NVIDIA Nemotron open models expected in the coming months. Cisco also added a new Tokenomics solution that provides real-time tracking and attribution of AI token expenditure across agents and employees using coding agents such as Claude Code, Codex, and Cursor, with the capability using Cisco's Deep Time Series Model to forecast consumption patterns and project spending before the end of a billing period.
"Enterprises need to bring AI where their data lives, especially when security and sovereignty requirements require critical workloads to stay on-premises," said Justin Boitano, vice president of enterprise AI at NVIDIA. According to Cisco, the new Splunk Agent Observability platform evaluates agent and model behavior and monitors performance across the AI stack, and can also apply runtime guardrails intended to prevent inaccurate or unsafe actions, including hallucinations and exposure of sensitive data. Cisco said Accenture, bitsIO, Wipro, and World Wide Technology are among the partners available to help customers deploy the architecture on their own infrastructure. The report notes that the collaboration between Splunk and AWS is intended to advance agentic SOC capabilities while maintaining analyst oversight and governance, with the jointly developed approach emphasizing adjustable autonomy that allows security teams to calibrate AI-driven automation from recommendations through execution.
The architecture could be especially relevant for customers in regulated or security-sensitive environments where keeping data and AI workloads on-premises is a requirement rather than a preference, according to the announcement. For solution providers, the opportunity extends beyond the initial hardware and platform implementation into integration, model hosting, security controls, and ongoing management of Splunk AI workloads. The Splunk and AWS multi-year agreement focuses on joint product development for agentic security operations, bringing together Splunk's data platform and security detection capabilities with AWS cloud scale, with the companies focusing on agentic support across detection, investigation, and response. "By integrating AWS infrastructure with Splunk's Agentic SOC, we are moving beyond simple integration to create a brand-new defensive paradigm," said Rudra Mitra, VP of security services at AWS. For channel partners supporting customers across Splunk and AWS environments, the deeper integration could eventually create additional opportunities around deploying, integrating, and managing agentic security capabilities. The partner involvement provides Cisco and Splunk with a services layer for the new architecture, particularly for customers who need help designing, deploying, and operating AI infrastructure in private environments. Organizations that have resisted public cloud AI deployments due to compliance constraints may now find themselves weighing the operational complexity of self-hosted infrastructure against the control it affords. Partners who can navigate both the technical implementation and the governance nuances stand to capture recurring revenue streams that outlast the initial deployment cycle.