Sami told me he's missing the sell side, so I asked him to join and ask some questions. No, I'm kidding.
I couldn't let Tom and Peter have all the fun, I was like.
I'm joking. Thank you very much for joining us. I'm happy, I'm so glad and grateful for Cisco for joining us because they had their own event, and they join us to the third day. Peter Bailey is SVP and GM of Cisco Security, and I'm happy to actually speak with you now because, as you articulated on the last conference call, we are going to see better growth. The purpose of the call is really to understand Cisco Security business, to understand what drove the slow growth before.
Yeah.
What is driving the acceleration of growth in the future, to understand the portfolio, the target markets, et cetera. I'm going to start with an easy question just because maybe there are some people that don't understand the story. The easy question, just to start the discussion is, what's in your portfolio? Meaning, can you articulate the portfolio and the portfolio strategy? Where are you going? What you're going after?
Sure.
Yeah.
I'm about a year in.
Okay
have had the chance to really get my arms around the portfolio and make some changes. There's two big chunks of Cisco Security business. It's sort of what we think about as our NetSec, which includes Zero Trust and identity, and there's some network detection and response things there. Then obviously the Splunk business. If I really dig in on the first one and then the second one, we have reorganized our business around three pillars. They are hybrid mesh firewall, if you understand that Gartner terminology, which is basically firewalling as a mesh across physical, virtual, maybe even workload levels.
Zero Trust, which is Zero Trust access, and then we had identity as our third pillar, but more and more identities is really a foundational element because we see identity as being critical for how we're going to secure agentic environments going forward because everything needs an identity, whether it's a machine, an agent, a human, what have you. There's some cats and dogs parts of the business, which is more the legacy stuff.
Oh.
We had some emails, media, things like that. Those first three are areas of tremendous focus of ours, and we're in as R&D in our focus around those three pillars. When we get to performance, we're seeing performance based upon that focus. Of course, you have the Splunk business, and there's really obviously the existing business, but really the opportunity then to dramatically expand what Splunk is doing in terms of being more of a broader data fabric to get signal, not just from SecOps, but also from machine data and telemetry from workloads, because that visibility across all the infrastructure is one, critical if you're going to, again, secure AI, which is traversing everywhere. Two, is also the way we're going to be able to start training AI so you can start beginning to automate the visibility and management of that infrastructure.
We did research, I don't know, maybe two years ago, maybe three years ago. We looked into your security portfolio. Back then we estimated, of course we don't have exact data, but based on market share data, we estimated that over 70% or 70% of your revenues came from appliances. No?
Where are we today? I'm not looking for the number. I'm looking for how did the portfolio evolve from on-prem appliance-
Yeah.
To be cloud service and software, et cetera.
Yeah. Listen, we are really focused on, and this is going to be kind of an avoidance to your question, but I will answer your question.
Yeah.
We're hyper-focused on customer outcomes across some certain areas, and that includes the delivery of hardware and software, in some cases, just software. Cisco also needs to be a multi-cloud business. It can't just be on-prem. We have to be thinking about private, but our customers have assets in the cloud as well. As we extend our capabilities beyond just a physical device, it has to be software that is traversing multi-cloud, and so that is a key area of focus of ours. We don't sit around and, I think, about our business in terms of hardware versus software because these are highly integrated solutions.
We obviously are seeing more and more uptake on pure software. Zero Trust obviously is a completely a SaaS solution and sitting across network infrastructure. That business is absolutely growing as a consequence of where we're reaching out to.
Yeah.
Where we're serving customers.
I've been talking to Jeetu for, I don't know, so many years about the strategy, and the strategy was always articulated well, but the execution numbers got to negative levels. We got to -4% and -2%. Why did margins get to negative territory in a solid environment? Security is good. How does it change? What drives a change to the growth trajectory?
Listen, I think if you go back in time with Cisco, 10 years ago, I think the business was very strong in firewall and these areas, and somewhere in the middle of the last 10 years.
Yeah.
That changed. Right? In the last three years since Tom Gillis, who I report to, and before that Jeetu, started refocusing the business, we started seeing this narrowing of focus on excellence and execution around the areas I described, and I've probably added a bit more focus to that since I've been here. Listen, I think we've got a very strong portfolio today.
Yeah.
I don't know if that was true three or four or five years ago.
Yeah.
We have continued to really focus our execution across those pillars I mentioned. Those three pillars are 86% of our business today on the SBG side. I think that execution, and then the second piece of this obviously is that the more and more we are infusing security into the network architecture, into how we design networks.
Yeah.
We design the data center, there's obviously a much easier selling motion there for our go- to- market, and you're seeing that play out right now.
On the last call, the company noted that you expect security to accelerate. What drives it? What drives acceleration?
I think, listen, first of all, the market right now is obviously very, very strong.
Yeah.
I think, with the advent of agentic, the number of security problems are growing dramatically, and they're very extreme. With all the money going into the ground to support AI infrastructure build-outs, if we can't secure these use cases, it's going to impact the ROI on those investments. There's tremendous pressure. If I go talk to a large customer, the CISO is under tremendous pressure to figure out how to make AI use cases secure for their environment because the board and the CEO is pushing so hard on that. In general, we're seeing an additional ramp-up of security. Our positioning within a securing AI, I think is very strong. That is obviously helping to drive.
Yeah.
The growth of our business.
Got it. Maybe a question to Sami, because I have you here. Sami, I always ask you about the mix, and meaning how is mix impacting legacy versus new. There was also issue that the recurring revenue, the ratable revenues are going up, but it takes time to ramp it. Where are we in the cycle? When do you expect all the good things that happened in the last three years to translate into growth acceleration?
To start, Peter is talking about the market is typically strong. What we have in the security business is really the two buckets. We have the Cisco core, we have the Splunk category. The reality is we have still a couple more quarters of difficult compares, mainly hitting these tough comps that really are affecting us on the Splunk side. By the time we get to fiscal 2Q27, these mixed compares become a lot more normalized. You will not be dealing with these very difficult compares side by side. In the Cisco Security Core, though, you're already starting to see some improvements, and that's starting to drive some better performance. Part of that was seen in Q3, and then, like we've discussed in our live call, that we do expect that to continue to Q4.
This kind of gets us to a much better position. Kind of exiting FY 2026 and starting FY 2027, the mix and mix compares will start improving. The ratable composition will also increase. You have all these factors that have taken a lot of time, but we're finally getting to a place that we're feeling very comfortable. This really gets us into the first half of FY 2027, where we're going to be feeling much better.
Got it.
about how things look.
If I might add to that, just one more comment is, even a year ago, I think Cisco was not so much in the mix in the security conversations, we are very much in the mix today. Talking to our customers, the CISO and the CIO are much more in the same room these days because security needs to be considered in thinking about these AI roll-outs. Those conversations are very robust for us on the security-
Yeah.
Side as well, and that's really encouraging.
Actually, I wanted to ask you about it. If I asked your competitors, any security company, where is Cisco in the market, they would tell you, "Oh, we're taking share from Cisco.
Sure.
How or where are we now when it comes to your position? I don't even know how to articulate the question, but I think that you just said it. I want to basically go deeper into it. Where are we today in the completeness of your portfolio and the vision of your portfolio and the execution, your ability to execute when it comes to positioning you back the way you used to be 10 years ago as the leading cybersecurity company?
A couple of things. I think when we talk about relevance in positioning, we also have to look at the market we're in right now.
Yeah.
The next 6- 12 months are going to be dominated by Mythos, vulnerability management, vulnerability patching.
Yeah.
Shielding, it's going to be about securing AI, right? In the context of that, infrastructure is the front lines of the Mythos concerns. Cisco's we've just announced Live Protect. We have some very effective solutions for how to protect infrastructure, and that we're rolling out. Secondarily, we've got technology like Isovalent or eBPF agent capabilities that is very, very effective at shielding and protecting applications. You're going to see us continue to push forward on that. Then relative to AI security, whether it's infrastructure, whether it's a workload, whether it's Zero Trust Access that now has agentic controls where we can authenticate an agent, authorize an agent, monitor its behavior, and be able to enforce policy on an agent, that is a very critical capability that our customers are asking us about.
What I would sort of say is the market is changing. The good news is that we've saw some of this change coming, and we've been able to reposition ourselves for this part of the market.
Right.
I think the market looking backwards of these silos of firewall or EDR or NDR, what have you, there's going to be consolidation here because what really needs to happen is we need much more broader set of sensors that can be everywhere, by the way the network is everywhere. We have visibility everywhere. We need sensors everywhere. We need enforcement everywhere. We need to have the intelligence to be able to understand what's going on in the network to be able to secure AI because it traverses trust boundaries. It traverses a single control, and these silos start to fall apart. We are very well positioned to take advantage of that.
Got it. This week you had Cisco Live. What was your key message on cybersecurity at Cisco Live?
I think, again, Mythos has been dominating the headlines.
Yeah.
Again, I think that's going to be something we're operationalizing with our customers over the next 6- 12 months. As the concerns which are merited, by the way, around advanced threat actors using these types of models.
Yeah.
Number one. Live Protect was associated with that. I think that was a really exciting announce for our customers because this means we can actively start defending their infrastructure going forward. Obviously the agentic security things that we're doing. We've really made some significant advances around how we can identify and help secure agentic activity on the network, and we're manifesting that through whether it's traditional firewall capabilities that have the ability to sense Zero Trust access. We also launched an agentic app that sits across all the platform. The third one is platform.
Yeah.
Cloud Control, which is all of Cisco coming together through a platform experience. Very, very valid for security as well, because in the background, we can start integrating data planes. When you integrate data planes, it's much easier to do analysis across many different use cases. That integration is how we can create really integrated use cases from a customer experience perspective that leads to, frankly, just better outcomes and better user experience.
Why are you positioned well for this? Meaning, why you and not someone else? What do you have in your portfolio? It could be the legacy portfolio, could be switches and routers, could be in security portfolio. What do you have in your portfolio that makes you in a better position to benefit from all these changes because of AI?
Yeah. I think it's a few different things. First of all, we are leveraging the network, leveraging our position there, leveraging data center infrastructure. One of the demos you might have seen is that we're actually putting little baby firewalls in the Nexus switches, right? The Smart Switches, right? That allows us to start having a much more distributed security presence, right? The key message is security needs to be more distributed. We have visibility everywhere, we have sensors everywhere, and because we own the infrastructure in many cases, we can put that in place.
I don't know if anyone else can say that, right?
Yeah.
We can really take advantage of ownership of the infrastructure. We can still connect that back to if I need to. Again, remember data's going to increase 10x, 100x, depending on who you ask here in the future. Are we going to create a firewall that's got 10x the capacity or 100x ? No. We're going to be a lot smarter about how we route traffic.
We're going to be sensing traffic. We're going to be identifying a small percentage of it, maybe to route back through a firewall to do deeper inspection. It's going to be much more about distributed security where things are happening at the edge.
Right.
If you look at the investments we've made, if you look at how we position our portfolio, that is a very big differentiator for us. When you add in firewall, Zero Trust, identity to this picture, you get to see a much broader portfolio that can come together and work together.
Got it. Splunk. Take us through the Splunk journey, meaning what's happening in the company. Splunk security, just security. What's happening there? Sami spoke about the transition.
Yeah.
What is this transition, and how long does it take to go through it, and what's the risk in the transition?
Yeah. We're going through a phase, a journey as an industry to automate the SOC.
Yeah.
Right. Splunk is aggressively investing to do the same work, right. The fact that we have as much data as we have puts us in maybe a better position to train models faster, get agents more proficient faster, reduce false positives in the kind of work that they do. I would say that that is a tremendous focus for that business over the next year to two years to continue to automate that.
The second piece is really expanding the set of use cases we can support across things like AI observability, the Galileo acquisition. We need to have visibility everywhere so that we can drive security outcomes on top of that. Being able to incorporate data, plug and play across just the Cisco infrastructure, obviously that's basically done at this point, but across all other sorts of infrastructure so that we can have that broad view and therefore be able to create these security outcomes for customers.
Okay. Yeah.
It's a little bit of the same playbook we've had historically there, but with a much broader view. Then we're putting automation on top of that. Listen, if we look out five or six years, agents are going to be driving these things, right? We're not going to have as much human-led workflows here. It's going to be agentic by nature, and you're going to then be looking at dashboards that are going to show your NIST compliance and other kind of audit, compliance. That is the vision we see. That's the journey we're on, and we're roaring towards that.
Right. Maybe a question for Sami. Sami, we spoke a lot about it in the past. Take us through the numbers again, not from a numbers perspective, but just conceptually, why are we seeing this deceleration and then acceleration? What happens behind the scenes that creates this kind of volatility in growth rates?
I think the biggest driver is how customers want to consume Splunk. When Splunk was a standalone company, they were able to manage the business 50% term software, 50% cloud, and they really ran it down the middle because the company had a different mandate than what Cisco altogether has. Since we've given the customers the freedom to really decide how they want to consume the product they've opted more into the ratable scheme.
Yeah.
I think you've seen that accelerate, right? Especially in FY 2026. At some point, the mixes will become more favorable, and that gets us into the first half of FY 2027. Let's see if I can add any additional elements here. The other thing is, exactly what Peter said. There are a lot of changes happening. I also just want to connect one other thing is Cisco has the switching, we have the telemetry, domain knowledge. We have the security offerings on top of that. We've made all these very proactive investments to get ahead of it. Then an additional thing that I think people are forgetting is we also have our own silicon.
Yeah.
This just gives us significantly more vertically integrated programmability into the stack. If you think of networks running hotter with agentic flows, hotter just means more demanding networks with lower latency requirements. If you own every element of the stack, you're going to be able to put out some very compelling products.
Got it. Yeah. Is AI playing to your strength of having control over the stack, or is AI irrelevant for it, or how is AI playing, or how do you benefit from AI given that you have full control of the stack?
There's two things to look at this. From the customer lens, they are assessing various tools, and they're going to have very significant requirements to mobilize and tool AI technologies.
Yeah.
Cisco can be the main vehicle to allow that to happen. On the flip side, internally, we are using a significant amount of AI tooling to develop our own products and also help us accelerate key parts of the company. Cloud Control as well, and Jeetu's also talked about developing products almost completely using AI software, right?
Yeah.
AI tools. There are kind of two parts to this, and both parts kind of gets us to this very compelling delivery and matching what we can offer versus what customers actually need right now to adopt these technologies. There's a bit of a two-sided focus here, and then I think silicon and the stack really plays into that.
Got it. Peter, the question, last year I spoke about Hypershield, I spoke about XDR, SASE.
Sure.
Spoke about new products.
Sure.
Give us an update on your new portfolio, meaning the take rate and what you've seen with Hypershield and SASE and everything else. Yeah.
Yeah. Hypershield is part of that hybrid mesh firewall kind of category, right?
Yeah.
Think about it as our next-generation workload security and distributed security. What I would say is that the Nexus Smart Switch and what we demoed here at Cisco Live represents one of the big outcomes of that effort.
Think about are you going to buy a data center switch that is classic switch or one that also has firewall capability built into it using that technology.
Yeah.
Okay? The second piece of that is when we look at all the vulnerabilities that primarily Linux-based applications have, that is sort of the thing that everyone's focused on right now because of Mythos, being able to use that agent technology to be able to shield those applications, that is also something that we are doing. Hypershield is finally kind of coming into its own.
Yeah.
The execution there was slower than we had hoped, but it's the right idea for the right moment. It's a distributed strategy for doing enforcement, whether it's policy enforcement or segmentation. That is, as we think about the future, we think that's going to be a ramping aspect of that mesh portfolio. The mesh, it's physical firewalls, it's cloud firewalls. It's things like Hypershield. The thing we've also done is we've created a single policy plane for all of this. A lot of times customers struggle to operationalize all these things because everything requires a policy or a rule, and historically, this has been a rules and policy-based business that is very complex to manage.
Through agentic ops and through integration of a single policy plane, we've also dramatically simplified how customers can operationalize this, because at the end of the day, you're going to need thousands of these sensors out there, and this distributed network of sensors, that's really tough to manage as just a human writing policies. A unified policy plane and then being able to start automating the writing of those policies and managing those policies and run that journey too.
Who is the customer or what kind of deployments do you address with the Smart Switch? Meaning who needs a switch together with a firewall?
As you're building out data centers and you're looking to protect workloads, segment the data center, it is the perfect solution for that.
Got it. That is basically enterprise data centers?
Yes.
That's it.
Yes, sir.
Okay. What about legacy firewalls? It's a big part of your business. Although you lost some share in the last few years, you're one of the big players in the space. What are the trends with legacy firewalls?
Listen-
What are the trends also in terms of your portfolio? How did the portfolio evolve?
Yeah, sure. We just refreshed the whole line.
Yeah.
I would say there's nothing legacy out there anymore, but we've literally refreshed the whole line.
Yeah.
Listen, these are very advanced products that high throughput, doing deep packet inspection. We've built incredible ML models that can do on-the-fly detection of threats and what have you. These are very sophisticated solutions that are designed to operate in line, right.
That is still a very core requirement, and I think you saw this last quarter, we actually saw very strong growth in that business.
Yeah.
I think that's a very viable part of the business going forward. I think it's an and answer or question and answer is that it's not enough, right? That's where we have to start to think about these more distributed means to actually be able to do security more at the edges of the network.
Yeah.
In the data center, protecting workloads, and those things can all work together. I want to make the point that it is not a siloed product for us.
Got it.
This is part of this mesh strategy, all these things working together, policy. We can write policy once and enforce it.
Yeah
Across all these services.
Got it. Agentic AI security. Companies start to make acquisitions in general in the space. Companies start to make acquisitions in the space. You made acquisitions in the space. Articulate your position and your vision to secure agentic AI.
Yeah, sure. To secure agentic is really first and foremost about identity, believe it or not.
Yeah.
Right? You need to basically always understand exactly what the agent is, what it should be doing, what it's connecting to, and what have you. Our strategy is to take identity and make it a horizontal across our platform and our infrastructure so that our customers know everything an agent might be connecting to, and not just a simple identity, but actually rich metadata about that identity. You actually understand, okay, this is a workload that's running very sensitive information and we know that sits behind a certain network and what have you, so that once you do introduce agents in, I'll get to the agentic piece in a second, we have great visibility about what's happening on the network.
For agents, we have introduced so far, through Zero Trust, also through just our identity stack, the ability to discover, authenticate, authorize, and now start managing the behavior of those agents on the network. Right? That agentic strategy, which by the way, can be enforced by what we see at the workload level, it's enforced by how we authenticate and bring them through identity onto the network, and then the ability to have visibility and firewalls to see agentic traffic, to see MCP calls, to see tool access. We've introduced DefenseClaw on the endpoint that also is looking at what's happening on the endpoint. All of these things, again, working together to be able to see an agentic activity across the network. An agentic app we just introduced that brings signal from all of these products. It cross-cuts everything.
Yeah.
It's not a siloed product. It cross-cuts firewalls, secure access, Zero Trust access, identity, to present a view of what is happening with agents on the network. Again, I think, one, that's very unique, and two, because we own the network, we also can see things others cannot, and we can bring in all this signal to give that perspective, and that's going to be absolutely required for securing agentic going forward.
Yeah. Is this an opportunity that is here and now, or is this an opportunity that is in the future?
This is an opportunity right now.
Yeah.
AI Defense is an example, a product we built for builders to safely build applications. That's a product that's a little over a year old and has a huge pipeline and backlog, and that is a right now conversation. The ability to use Zero Trust access to control and monitor what agents are doing on the network, that's a right now conversation. Every one of our customers, remember what we talked about at the beginning, the CISOs are under incredible pressure to adopt these technologies, but also to secure them.
Yeah.
This is very much a right now conversation.
Got it. You previously noted it used to be Good. A bug is coming to me. A few quarters ago, you spoke about pressure on cybersecurity from federal government, and it's a big part of your segment. Give us an update, if you can, please, on the federal segment or federal part of cybersecurity?
Well, I think the thing everyone's seen is the orders coming down from the federal government to update infrastructure.
Yeah.
Make sure it's quantum ready, and to really get rid of all the LDOS, last day of support type infrastructure.
Yeah.
Upgrade that. That is sort of probably the headline to the answer to your question. With that, we are bringing everything we have to bear to help support the government in making those changes, as well as having lots of discussions around what else do we need to do, for example, to help protect and kind of MITRE those type scenarios.
Right.
A lot of discussion with the government, and other vendors too, around how we're collectively going to help solve some of these problems. I think that, again, is going to be a big topic here in the next 6+ months.
Right. I forgot to ask you something about AI when we spoke about AI. What you're doing in AI, is it synergistic to what you currently have, or is it just a standalone opportunity that is now growing?
If you remember the description, hopefully, it landed, of the agentic app.
Yeah.
Imagine you've got this view into what are agents doing on the network, what it's connected to, what tools it's using. Maybe it's associated with a user. All of that is signal that's coming from the products and infrastructure that Cisco's deploying.
Yeah.
Right? Whether it's secure access or Zero Trust Access Platform, whether it's identity, whether it's coming from a firewall, whether it's signal we're getting from a workload where something's interacting with a workload, looking at the process flows, that is all signal we're bringing up to give you the agentic view. The thing I want to sort of reinforce is you need great breadth and depth to secure agents.
Yeah.
If you're just an identity player, you can't see what happens past a trust boundary.
Yeah.
Right? You have to have great depth and breadth. Because we are at the network layer all the way up to L7 in the stack, we have incredible ability to operate at all layers in the stack to give this comprehensive picture to our customers about what agents are doing on the network.
Okay.
Agents are going to go everywhere. They're going to do things we don't want them to do. We have to be able to enforce everywhere, have visibility, and enforce everywhere. That is really the ecosystem that we are building.
Right. Maybe last question is not about products and portfolio, it's maybe about your go to market and your ability to deliver, to execute on your strategy.
Sure.
What do you think about your own strength and weaknesses when it comes to go to market for cybersecurity, not Cisco's in general?
Yeah.
Yeah.
Listen, we have, I think, my personal opinion, the world's best go to market. It's an incredible sales force. Our DNA is the network and infrastructure, right? A smart person running a site security business in Cisco would do whatever they can to attach their train.
Yeah.
What's happening on the network side of the business. When we're talking about fusing security into the network, that is really a security story that goes with a network sale and infrastructure sale as well. I think that is landing for us. Really how we think about it is once we are in with a customer with some security offerings, that might be outcomes that are tied to the network, as an example, or might be outcomes tied to Splunk, which is broadly deployed. We have this vast portfolio we can upsell and cross-sell that is integrated with, whether it's the network or with Splunk, to help solve these new use cases we're talking about.
Yeah.
Because security typically is about what's the house on fire thing I need to solve today? What's the new attack surface, right? Everything we talked about today is that new attack surface, and we can tie that back to the infrastructure, leverage the infrastructure and the network to deliver those outcomes. That allows our go to market to actually have a very integrated sale process going from what would be kind of your network sellers into our security sales force. Putting those two pieces together is obviously really important for us.
Got it. Peter, thank you so much.
Yeah.
We ran out of time. Thank you.
Great. Thanks.
Thanks, great.
Thank you. Appreciate it. Okay, great.
Hey, this was great.
Thanks a lot. Thank you.
I'm going to take a picture with both of you. I didn't do it with anyone