Ant Ducker of Cisco showed how Cisco builds segmentation and advanced threat prevention for a hyper-distributed application. He demonstrated AI policy discovery, which uses graph-based machine learning to generate candidate micro-segmentation policy. He then explained how Encrypted Visibility Engine, Snort 3, and Snort ML work together in Cisco Secure Firewall to stop known and zero-day threats. Ducker, a security technologist at Cisco, presented during Cisco Security’s appearance at Security Field Day 16.

Ducker said AI policy discovery feeds telemetry from agents, enforcement points, and NetFlow into a graph-based neural network that maps relationships between workloads and clusters. Administrators label the application into scopes and inventories, set a time window, and tune the model, for example to avoid recommending ephemeral port ranges. The resulting visualized policy exposed insecure protocols inside the Kubernetes namespace and let him prune unwanted flows. A flow from an agentic workload to its local MCP server was bound to both port and process, so a rogue process could not reach the server. Encrypted Visibility Engine uses a naive Bayes model to fingerprint TLS flows on the fly and sort them into malicious, benign, or uncertain buckets. Only the uncertain traffic goes to selective decryption.

Ducker argued that signature-based IPS cannot keep up with novel threats generated by AI. Snort ML instead uses a convolutional neural network to recognize malicious byte patterns across SQL injection, command injection, cross-site scripting, and code injection. He said Talos has seen Snort ML detect a novel PHP command injection exploit out of the box, with no model changes. His demo showed Encrypted Visibility Engine blocking TrickBot command and control traffic with high confidence. He acknowledged a compute trade-off but argued the value lies in far less decryption and in protection against undisclosed threats. He urged teams to fit IPS controls to their workloads rather than enabling every rule in block mode, with Snort ML backing up Snort 3 and Talos TruffleHunter rules.

Presented by Ant Ducker, Global Security Technologist. Recorded live at Security Field Day 16 in San Jose, CA on October 28, 2026. Watch the entire presentation at https://techfieldday.com/appearance/cisco-security-presents-at-security-field-day-16/ or visit https://techfieldday.com/event/xfd16/ or https://Cisco.com/ for more information.