Cisco buys Galileo
Cisco is acquiring Galileo and folding its AI‑agent observability into Cisco’s Splunk portfolio, signalling that agent tracing is moving into mainstream enterprise telemetry rather than specialist tooling. That means platform teams can expect agent execution paths, tool calls and protection events to appear alongside logs and metrics in standard incident workflows. The news suggests observability will increasingly be treated as a platform primitive that must tie into orchestration and remediation systems. (networkworld.com)
Cisco is buying Galileo, a startup that watches artificial intelligence agents while they work, and Cisco says the technology will be added to Splunk after the deal closes. Cisco announced the plan on April 9, 2026, and did not disclose a price. (blogs.cisco.com) An artificial intelligence agent is software that does jobs in steps, like searching a database, calling a tool, writing a reply, and handing work to another model. The hard part is that those steps can fail silently, so companies need a record of what the agent saw, decided, and did. (splunk.com) That record is called observability, which is the same basic idea engineers already use for apps and servers. Splunk’s existing tools collect logs, metrics, and traces, and its recent updates already added monitoring for artificial intelligence agent performance, quality, cost, and security risk. (splunk.com) Galileo built its business around that newer layer. Its platform says it can evaluate, monitor, and protect generative artificial intelligence applications and agents at enterprise scale, with checks that turn offline testing into production guardrails. (galileo.ai) Cisco’s own description of Galileo is unusually specific about the problems it wants solved. Cisco says Galileo helps teams evaluate output quality, catch failures before users see them, and monitor multi-agent systems across the full agent development lifecycle, from prompt tuning to production. (blogs.cisco.com) Galileo also spent the last two years building tools for one of the messiest failure modes in generative artificial intelligence: hallucinations. In June 2024, the company introduced Luna, a family of evaluation models for tasks like hallucination detection, prompt injection checks, and personally identifiable information detection. (galileo.ai) This was not a cold acquisition. Cisco, Galileo, and LangChain were already working together on AGNTCY, an open project launched in 2025 to build shared plumbing for multi-agent systems, including discovery, identity, messaging, and observability. (outshift.cisco.com) (linuxfoundation.org) Cisco has been moving Splunk in this direction since it bought Splunk in a $28 billion deal that closed in March 2024. By September 2025, Cisco was already pitching “agentic” Splunk observability that uses artificial intelligence agents to troubleshoot incidents and recommend fixes. (cisco.com) (newsroom.cisco.com) The Galileo deal fills in the other side of that picture. Cisco does not just want artificial intelligence agents helping run observability software; it also wants observability software watching artificial intelligence agents, with the same kind of dashboards and incident workflows companies already use for networks and apps. (blogs.cisco.com) (networkworld.com) Cisco has been making the same bet in security. At RSA Conference 2026, Cisco expanded products like Duo Agentic Identity and Artificial Intelligence Defense to discover agents, control what they can access, and add protection at the application layer. (networkworld.com) Put together, the message is that artificial intelligence agents are being treated less like experimental chatbots and more like employees with badges, audit logs, and supervisors. When Cisco folds Galileo into Splunk, the path an agent took through a task may start showing up beside the error rate of an application and the traffic on a network switch. (blogs.cisco.com) (splunk.com)
