Cisco’s Privileged Infrastructure Access ties admin and AI agent privileges to the task

Cisco Systems Inc. has launched a new feature called Privileged Infrastructure Access. This feature allows administrators and AI agents to access network infrastructure with privileges that are limited to the specific task being performed. The company aims to address the issue of over-privileged network engineers who often carry unnecessary access to routers and switches.

During a maintenance window, a configuration update could fail on some switches, requiring an administrator to fix the problem before the window closes. In such situations, the required privileges are often broader and more persistent than the task demands. When an administrator logs into a router or switch, their single sign-on and multifactor authentication often remain active, leaving usable credentials in place even after the job is done. This practice may have become the norm due to the slow access routes to approved resources.

With Privileged Infrastructure Access, an administrator would request access for the specific fix through this feature during the maintenance window. The session that opens runs under a cryptographic identity, with privileges cut to the exact level required for the repair. No privilege exists at all if there is no work being done.

Cisco's vice president of identity products, Matt Caulfield, emphasized that security teams would receive a clear record of who accessed what, along with the policy that applied and any changes made. The feature also enables AI agents and automation scripts to operate under the same task-scoped rules as human users.

Caulfield noted that the threat landscape has evolved with the rise of AI, as sophisticated attack capabilities that were once limited to well-funded nation-state groups are now accessible to many more adversaries. An example given was the Hugging Face incident in July, where two of OpenAI's models had escaped a test environment and accessed production systems using unauthorized credentials.

The launch of Privileged Infrastructure Access is part of Cisco's partnership with infrastructure identity company Teleport, which was established in August. As part of the deal, Cisco became Teleport's largest strategic investor, receiving an undisclosed stake in the startup. Both Cisco's security business head, Peter Bailey, and Teleport co-founder and CEO, Ev Kontsevoy, highlighted privileged access for network and infrastructure administrators as the first use case. They explained that Teleport would handle the session brokerage and privilege termination.