AI‑agent observability push

Cisco just made a bet that the next thing companies will have to monitor is not only servers and apps, but software workers that make decisions on their own. On April 9, 2026, Cisco said it plans to acquire Galileo Technologies and fold it into Splunk Observability Cloud for AI agent monitoring. (blogs.cisco.com) (networkworld.com) An AI agent is a program that does multi-step work like a junior employee: it picks a tool, calls an application programming interface, hands work to another model, and keeps going until it finishes the task. OpenAI’s own Agents software development kit describes agents as applications that plan, call tools, collaborate, and keep state across steps. (developers.openai.com) Old monitoring tools were built for things like response time, error rate, and crashed processes. Cisco said AI teams now need visibility into hallucinations, bias, security risk, cost, and usage across the full agent development lifecycle, not just ordinary app metrics. (blogs.cisco.com) That is the gap Galileo was built to fill. Cisco said Galileo already gives teams tools to evaluate output quality, catch failures before users see them, and add guardrails for multi-agent systems in production. (blogs.cisco.com) (networkworld.com) Splunk is the part of Cisco that many companies already use as a giant event diary for machines. Cisco said Galileo will strengthen Splunk’s observability portfolio and expand its existing AI Agent Monitoring inside Splunk Observability Cloud with real-time visibility and protection. (blogs.cisco.com) (splunk.com) Cisco did not stop at buying visibility. On March 30, 2026, Cisco’s AI Defense team also open-sourced DefenseClaw, a governance tool for OpenClaw deployments that scans skills, plugins, and Model Context Protocol servers before they run. (blogs.cisco.com) (github.com) DefenseClaw also watches the runtime, which means the moment an agent starts acting. Cisco said it inspects prompts, completions, and tool calls in real time for prompt injection, data exfiltration, and command-and-control patterns, and it can switch from monitor mode to blocking mode. (blogs.cisco.com) The key detail is where those security decisions go after they happen. Cisco said every scan result, block decision, tool call, and alert streams out as structured events, and the DefenseClaw project includes OpenTelemetry integration for Splunk Observability plus local Splunk setup docs. (blogs.cisco.com) (github.com) That turns an agent from a black box into something closer to a badge-wearing employee whose actions are logged at the door, at the desk, and at the file cabinet. Microsoft is pushing a similar direction with an Application Insights agents view that shows agent runs, token usage, and tool calls through OpenTelemetry conventions. (techcommunity.microsoft.com 1) (techcommunity.microsoft.com 2) Cisco has been building the identity side of this too. Network World reported that Cisco’s Duo Agentic Identity package is meant to discover, identify, and monitor AI agents so they only reach the resources they need. (networkworld.com) Put those pieces together and the direction is plain: companies are starting to treat non-human identities the way they already treat laptops, employees, and cloud services. The logs that used to answer “which server failed” are being rebuilt to answer “which agent decided this, which tool it used, and whether policy allowed it.” (networkworld.com) (splunk.com)