Multi-turn attacks broke AI models 88% of the time — single-turn testing missed it, Cisco AI security lead warns at VB Transform 2026

Cisco’s study found attackers that adapt across multi-turn conversations broke through up to an 88.3% success rate (vs. much lower single-turn resilience), highlighting that single-turn red-teaming can miss real agent failure modes. In a VentureBeat survey of 107 enterprises, 54% report an agent security incident or near-miss, and only 32% use scoped, managed identities while just 30% sandbox highest-risk agents—suggesting widespread control gaps. The article also points to consolidation around identity/isolation—Cisco’s planned $400M Astrix bid, CrowdStrike’s $740M SGNL purchase, and Palo Alto’s $25B CyberArk close—implying incremental budget allocation toward agent security tooling. Overall, the takeaway is to test with attacker-like multi-turn, continuous pressure and tighten least-privilege/isolated execution to prevent trust collapse after real-world drift.

Analysis

The investable takeaway is not that AI security is a new market; it is that the budget is migrating from model demos to control-plane infrastructure. That favors platform vendors with identity, policy, logging, and runtime enforcement already wired in — PANW most clearly, CRWD next, and to a lesser extent Cisco’s security stack — because buyers will default to vendors that can bundle controls into existing procurement motions rather than add another point solution.

Second-order, the article is a warning for pure software operators that are racing to ship agents before their governance layer is mature. BOX and INTU can still benefit operationally, but the trust-reset problem means enterprise deployment curves may be slower than product teams assume; expect a 1-3 quarter lag between “agent feature launch” and meaningful revenue contribution. Cisco’s acquisition is more of a capability fill-in than a monetization catalyst, so the market should treat it as defensive architecture, not a near-term growth driver.

The contrarian miss is that “AI security” spend may be absorbed inside broader cloud and identity budgets rather than create a standalone expansion wave. If hyperscalers and incumbent platforms keep 82%+ of the control layer, smaller specialists may see crowded-as-a-service economics despite rising headlines. Falsifier: if next two earnings cycles show clear attach-rate lift, higher security ARR, or explicit AI-governance budget expansion, the market should re-rate the category higher; if not, this is mostly a consolidation story, not an alpha story.

Key Decisions for Investors

• Long PANW vs short CSCO for the next 1-3 months: PANW has the cleaner monetization path from identity/isolation spend, while CSCO’s security narrative is still mostly capability-building. Risk/reward favors a relative-value expression over outright longs because both can benefit from the theme, but PANW should capture more wallet share.
• Buy PANW on pullbacks into the next earnings window and look for follow-through if management quantifies AI-security attach or CyberArk integration progress. Base case is 8-12% upside over 3-6 months; thesis breaks if integration commentary shows no incremental demand or margin dilution.
• Hold CRWD as a secondary beneficiary, but size modestly until the market proves that AI-agent security is incremental to endpoint/XDR budgets rather than cannibalizing them. Best entry is on a post-rally consolidation; downside protection comes if the company can show policy/runtime controls are being sold as add-ons.
• Avoid chasing BOX on this print; treat it as a watch item for evidence that agent governance is translating into net-new product revenue. If next quarter shows no monetization of its internal agentic posture, the stock risks being a showcase name rather than a category winner.
• Use GOOGL as a lower-beta proxy only if you want exposure to provider-native controls winning share; otherwise, prefer PANW/CRWD where the security line items are more directly tied to the problem set. Falsify the thesis if hyperscaler-native controls are not mentioned as a budget priority in customer commentary by the next two quarters.