Cisco Cloud Control Unifies Identity: Network Becomes the New Identity Plane
Summary
Key Takeaways
Cisco announced Identity in Cisco Cloud Control, unifying Duo, Cisco Identity Intelligence (CII), Cisco Identity Services Engine (ISE), and third-party sources (e.g., Okta, Entra, Jamf, GitHub Copilot, Snowflake Cortex). Key features: unified identity visibility for human and non-human identities; enhanced Trust Score incorporating ISE network context; operational dashboard for monitoring distributed ISE PAN and CII health; AI Canvas with identity context for guided investigation; AI agent visibility. Cisco claims this eliminates tool-switching latency and enables a closed loop from identity signal to network enforcement (e.g., Duo step-up auth, ISE network restriction, session revocation). Alpha in June 2026, GA in H2 2026.
Why It Matters
Cisco's move is a control plane shift: identity decision-making moves from standalone IAM (Okta, Azure AD) to Cisco's network infrastructure (ISE + Cloud Control). This aims to contain Okta and Azure AD by making network the enforcement anchor. Vendor lock-in: policies become deeply tied to ISE PAN and Duo, making migration costly. Hidden limitations: ISE PAN centralized architecture introduces tail latency and single-point-of-failure in large distributed networks; Trust Score relies on Cisco internal signals, limiting third-party IAM integration depth; AI agent visibility is narrow, missing custom workflows and open-source frameworks like LangChain.
PRO Decision
【Vendors (Okta, Azure AD, Palo Alto Networks)】 Attack Cisco’s ISE PAN centralized bottleneck—highlight tail latency and single-point-of-failure in large-scale networks. Undermine Trust Score by showing limited third-party IAM integration depth. Offer network-decoupled identity analytics (e.g., Okta Identity Engine + multi-vendor network policy) to break Cisco’s lock-in. 【Enterprises (CIOs/Architects)】 Conduct zero-trust audit: demand ISE PAN scaling benchmarks (max nodes, latency distribution); verify if Cloud Control unified view truly supports heterogeneous networks (Arista, Juniper) or is Cisco-optimized; request AI agent visibility data source completeness and update cadence. Avoid network-identity lock-in by preserving cross-platform policy portability. 【Investors】 Recognize this as defensive move against IAM erosion, not innovation. Short-term may boost Cisco network stickiness, but long-term faces counter-attack from Okta, Azure AD and white-box networking (Arista + open-source identity). Monitor ISE and Duo standalone revenue growth—if below expectations, customer resistance is real.
Get 3-5 key AI infrastructure signals weekly →
💬 Comments (0)