Cisco Systems, Inc. (CSCO) June 4, 2026 Conference Transcript

So thank you very much for joining us. I'm happy. I'm so glad and grateful for Cisco for joining us because they have their own event and they join us kind of to the third day. Peter Bailey is SVP and GM of Cisco Security, and I'm happy to actually speak with you now because as you articulated on the last conference call, we are going to see better growth. So, the purpose of the call is really to understand Cisco security business, to understand what drove the slow growth before and what is driving the acceleration of growth in the future, to understand the portfolio, the target markets, et cetera. And I'm going to start with an easy question, just because maybe there are some people that don't understand the story. And the easy question, just to start the discussion, is what's in your portfolio? Meaning, can you articulate the portfolio and the portfolio strategy? Where are you going? What are you going after? Sure.

So I'm about a year in, so I've kind of had the chance to kind of really get my arms around the portfolio and make some changes. And so there's two big chunks of Cisco security business. It's sort of what we think about as our net sec, which includes zero trust and identity, and there's some network detection response things there, and then obviously the Splunk business. And so if I kind of really dig in on the first one and then the second one, we have reorganized our business around sort of three pillars. They are hybrid mesh firewall, if you understand that Garton terminology, which is basically firewalling as a mesh across physical, virtual, and even workload levels. Zero trust, which is zero trust access. And then we had identity as sort of our third pillar, but more and more identities is really a foundational element because we see identity as being critical. For how we're going to secure agentic environments going forward, because everything needs an identity, whether it's a machine, an agent, a human, what have you. And so identities. And then there's sort of some cats and dogs parts of the business, which is more of the legacy stuff. You know, we had some emails, media, things like that. But those first three are areas of tremendous focus of ours. And we run as R&D and our focus around around those three pillars. And when we get to kind of performance. We're seeing performance based upon that focus. And then, of course, you have the Splunk business. And, you know, there's really, obviously, the existing business, but really the opportunity then to dramatically expand what Splunk is doing in terms of being more of a broader data fabric to get signal, not just from SecTech, but also from machine data and telemetry from workloads, because that visibility across all the infrastructure is, one, critical if you're going to, again, secure AI, which is traversing everywhere. And two is also the way we're going to be able to start training AI so you can start beginning to automate the visibility and management of that infrastructure.

We did research. I don't know, maybe two years ago, maybe three years ago, and we looked into your security portfolio, and back then, we estimated, of course, we don't have exact data, but based on market share data, we estimated that over 70% or 70% of your revenues came from appliances. Where are we today? And I'm not looking for the number. I'm looking for how did the portfolio evolve from on-prem appliance to be cloud service and software, et cetera? Yes.

So, listen, we are really focused on, and this is going to be kind of an avoidance of your question, but I will answer your question. We're hyper-focused on customer outcomes across some certain areas, and that includes the delivery of hardware and software, in some cases just software. Cisco also needs to be a multi-cloud business. It can't just be on-prem. We have to be thinking about private, but our customers have assets in the cloud as well. And so, as we extend our capabilities beyond just a physical device, it has to be software that is traversing multi-cloud, and so that is a key area of focus of ours. And so, we don't sit around and, I think, think about our business in terms of hardware versus software because these are highly integrated solutions, but we obviously are seeing more and more uptake on pure software. Zero Trust, obviously, is a completely SaaS solution and sitting across network infrastructure. And so that business is absolutely growing as a consequence of where we're reaching out to and where we're serving customers.

So I've been talking to G2 for, I don't know, so many years about the strategy, and the strategy was always articulated well. But the execution numbers got to negative levels. We got to minus 4 and minus 2%. And why did margins get to negative territory in a solid environment? Security is good. And how does it change? What drives a change to the growth trajectory?

So, listen, I think if you go back in time with Cisco, you know, 10 years ago, I think the business was very strong and firewall in these areas. And somewhere in the middle of the last 10 years, that changed, right? And in the last three years, since Tom Gillis, who I report to, and before that, G2, started refocusing the business, we started seeing this narrowing of focus on excellence and execution around the areas I described. And I've probably added a bit more focus to that since I've been here. But listen, I think we've got a very, very strong portfolio today. I don't know if that was true three or four or five years ago. We have continued to, you know, really focus our execution across those pillars. I mentioned those three pillars are 86% of our business today on the SBG side. And so I think that execution, and then the second piece of this, obviously, is that the more and more we are infusing security into the network architecture, into how we design networks and how we design the data center, there's obviously a much easier selling motion there, you know, for our go-to-market. And you're seeing that play out right now.

So on the last call, you noted, the company noted that you expect security to accelerate. What drives it? What drives acceleration?

So I think, listen, first of all, the market right now is obviously very, very strong. I think, you know, with the advent of sort of agentic, the number of security problems are growing dramatically and they're very extreme. And with all the money going into the ground to support AI infrastructure build-outs, if we can't secure these use cases, it's going to impact the ROI and those investments. And so there's tremendous pressure. If I go talk to a large customer, the CISO is under tremendous pressure to figure out how to make AI use cases secure for their environment because the board and the CEO is pushing so hard on that. And so in general, we're seeing an additional ramp-up of security. Our positioning within sort of a securing AI, I think is very strong. That is obviously helping the growth of our business. Got it.

And maybe a question to Sammy, because I have you here. Sammy, I always ask you about the mix, and meaning how is mix impacting legacy versus new? And there was also an issue that the recurring revenue, the rateable revenues are going up, but it takes time to ramp it. Where are we in the cycle? Meaning, where are we in the cycle? When do you expect all the good things that happened in the last three years to translate into growth acceleration? Yeah.

To start, Peter is talking about the market is typically strong, and then what we have in the security business is really the two buckets. We have the Cisco core, then we have the Splunk category. The reality is we have still a couple more quarters of difficult compares, mainly hitting these tough comps that really are affecting us on the Splunk side. But by the time we get to fiscal two Q27, these mixed compares become a lot more normalized. So you will not be dealing with these very difficult compares side by side. And the Cisco security core, though, you're already starting to see some improvements, and that's starting to drive some better performance. Part of that was seen in Q3. And then, you know, like we've discussed in our live call that we do expect that to continue to Q4. And this kind of gets us to a much better position, but kind of exiting FY2, FY26 and starting FY27, the mix and mix compares will start improving. The routable composition will also increase. So, you know, you have all these factors that have taken a lot of time, but we're finally getting to a place that we're feeling very comfortable. This really gets us into the first half of FY27 where, you know, we're going to be feeling much better about how things look.

And if I might add to that, just one more comment is, When I arrived, even a year ago, I think Cisco was not so much in the mix in the security conversations. And we are very much in the mix today. And so, you know, talking to our customers, you know, the CISO and the CIO are much more in the same room these days because security needs to be considered in thinking about these AI rollouts. And those conversations are very robust for us on the security side as well. And that's really encouraging.

So actually, that's, I wanted to ask you about it. If I asked your competitors, you know, any security company, where is Cisco in the market, they would tell you, oh, we're taking share from Cisco. How or where are we now when it comes to your position? And I don't even know how to articulate the question, but I think that you just said it. I want to basically go deeper into it. Where are we today in the completeness of your portfolio and the vision of your portfolio and the execution, your ability to execute when it comes to positioning you back the way you used to be 10 years ago as the leading cybersecurity company?

So a couple of things. I think when we talk about relevance in positioning, we also have to look at the market we're in right now. And so the next six to 12 months are going to be dominated by mythos, vulnerability management, vulnerability packing and shielding. And it's going to be about securing AI, right? And so in the context of that, you know, infrastructure is the front lines of the mythos concerns. And Cisco's is, we've just announced LiveProtect. We have some very effective solutions for how to protect infrastructure and that we're rolling out. Secondarily, we've got technology like Isovalent or EVPF agent capabilities that is very, very effective at shielding and protecting applications. And you're going to see us continue to push forward on that. And then relative to AI security, you know, whether it's infrastructure, whether it's a workload, whether it's zero trust access that now has agentic controls where we can, you know, authenticate an agent, authorize an agent, you know, monitor its behavior and be able to enforce policy on an agent. That is a very critical capability that our customers are asking us about. And so what I would sort of say is the market is changing. The good news is that we've saw some of this change coming, and we've been able to reposition ourselves for this part of the market. And I think the market looking backwards at these silos at Firewall or EDR or NDR or what have you, there's going to be consolidation here because what really needs to happen is we need a much more broader set of sensors that can be everywhere. By the way, the network is everywhere. We have visibility everywhere. We need sensors everywhere. We need enforcement everywhere. And we need to have the intelligence to understand what's going on in the network to be able to secure AI, because it traverses trust boundaries, it traverses a single control, and these silos start to fall apart. And so we are very well positioned to take advantage of that. Got it. And this week you had Cisco Live.

What was your key message on cybersecurity and Cisco Live?

You know, I think, again, Mythos has been dominating the headline. And again, I think that's going to be something we're operationalizing with our customers over the next six to 12 months, as the concerns, which are merited, by the way, around advanced threat actors using these types of models is number one. Live Protect was associated with that. I think that was, you know, a really exciting announce for our customers, because this means we can actively start defending their infrastructure going forward. And then obviously the agentic security things that we're doing. So we've really made some significant advances around how we can identify and help secure agentic activity on the network. And we're manifesting that through whether it's traditional firewall capabilities that have the ability to sense zero trust access. We also launched an agentic app that sits across all the platform. And then the third one is platform. Cloud control, which is all of Cisco coming together through a platform experience, very, very valid for security as well, because in the background, we can start integrating data planes. When you integrate data planes, it's much easier to do analysis across many different use cases. And that integration is how we can create really integrated use cases from a customer experience perspective that leads to, frankly, just better outcomes and better user experience. And why are you...

Uh, positioned well for this, meaning why you and not someone else? What do you have in your portfolio? And it could be the legacy portfolio, could be switches and routers, could be in security portfolio. But what do you have in your portfolio that makes you in a better position to benefit from all these changes because of AI?

Yeah, so I think it's a few different things. But first of all, you know, we are leveraging the network, leveraging our position there, leveraging data center infrastructure. One of the demos you might have seen is that we're actually putting little baby firewalls in the Nexus switches, right? The smart switches, right? And that allows us to start having a much more distributed security presence, right? And so the key message is security needs to be more distributed. So we have visibility everywhere, we have sensors everywhere, and because we own the infrastructure in many cases, we can put that in place. And I don't know if anyone else can say that, right? And so we can really take advantage of ownership of the infrastructure. And then we can still connect that back to, you know, if I need to, you know, and again, remember, data is going to increase 10x, 100x, you know, depending on who you ask here in the future. Are we going to create a firewall that's got 10 times the capacity or 100 times? No, no. We're a lot smarter about how we route traffic. We're going to be sensing traffic. We're going to be identifying a small percentage of it, maybe to route back through a firewall to do deeper inspection. But it's going to be much more about distributed security where things are happening at the edge. And if you look at the investments we've made, if you look at how we position our portfolio, that is a very big differentiator for us. And then when you add in firewall, zero trust, identity to this picture, you get to see a much broader portfolio that can come together and work together.

Splunk, take us through the Splunk journey, meaning what's happening in a company, Splunk security, just security. What's happening there? Sammy spoke about the transition. So what is this transition? And how long does it take to go through it? And what's the risk in the transition? Yeah.

So we're going through a phase journey as an industry to automate the SOC, right? And Splunk is aggressively investing to do the same work, right? And, you know, the fact that we have as much data as we have puts us in maybe a better position to train models faster, get agents more proficient faster, reduce false positives in the kind of work that they do. And so I would say that that is, you know, a tremendous focus for that business over the next year to two years to get it to automate that. And then the second piece is really expanding the set of use cases we can support across things like AI observability, the Galileo acquisition. We need to have visibility everywhere so that we can drive security outcomes on top of that. So being able to incorporate data, plug and play across just the Cisco infrastructure, obviously that's basically done at this point, but across all other sorts of infrastructure so that we can have that broad view and therefore be able to create these security outcomes for customers. And so it's a little bit of the same playbook we've had historically there, but with a much broader view. And then we're putting automation on top of that. And, you know, listen, if we look out five or six years, agents are going to be driving these things, right? We're not going to have kind of, you know, as much human-led workflows here. It's going to be agentic by nature. And you're going to then be looking at dashboards that are going to show your NIST compliance and other kind of audit compliance. And that is, you know, the vision we see. That's the journey we're on and we're running towards that.

Right. And maybe a question for Sammy. Sammy, we spoke a lot about it in the past. Take us through the numbers, again, not from a numbers perspective, just conceptually. Why are we seeing this deceleration and then acceleration? What happens behind the scenes that creates this kind of volatility and growth rates?

I think the biggest driver is how customers want to consume Splunk. So, when Splunk was a standalone company, they were able to manage the business 50% term software, 50% cloud, and they really ran it down the middle because the company had a different mandate than what Cisco altogether has. Since we've given the customers the freedom to really decide how they want to consume the product, they've opted more into the routable scheme.

Yeah.

And I think you've seen that accelerate, especially in FY26. And at some point, the mixes will become more favorable, and that gets us into the first half of FY27. Let's see if I can add any additional elements here. The other thing is, I mean, like exactly what Peter said, right? Like there are a lot of changes happening. And I also just want to connect one other thing is Cisco has the switching. We have the telemetry, you know, domain knowledge. We have the security offerings on top of that. We've made all these very proactive investments to get ahead of it. And then an additional thing that I think people are forgetting is we also have our own silicon.

Yeah.

This just gives us significantly more vertically integrated programmability into the stack. And if you think of like networks running hotter with agentic flows, hotter just means more demanding networks with lower latency requirements. If you own every element of the stack, you're going to be able to put out some very compelling products. Yeah.

And is AI Is AI playing to your strength of having control over the stack? Or is AI irrelevant for it? Or is it, you know, how is AI playing? Or how do you benefit from AI given that you have full control of the stack?

There's two things to look at this. From the customer lens, they are assessing various tools, and they're going to have very significant requirements to mobilize and tool AI technologies. Cisco can be the main vehicle to allow that to happen. Then on the flip side, internally, we are using a significant amount of AI tooling to develop our own products and also help us accelerate key parts of the company. So cloud control as well. And G2 has also talked about developing products almost completely using AI software, right? Like AI tools. So there are kind of two parts to this, and both parts kind of get us to this very compelling delivery and matching what we can offer versus what customers actually need right now to adopt these technologies. So there's a bit of a two-sided focus here, and then I think Silicon and the stack really plays into that.

Peter, the question. So last year, I spoke about Hypershields. I spoke about XDR, SASE. You spoke about new products. Give us an update on your new portfolio, meaning the take rate and what you've seen with Hypershields and SASE and everything else. Yeah.

So, hybrid shield is part of that hybrid mesh firewall kind of category, right? And so, think about it as our next generation workload security and distributed security. And so, what I would say is that the Nexus smart switch and what we demoed here at Cisco Live represents one of the big outcomes of that effort. And so, think about, you know, are you going to buy a data center switch that is classic switch or one that also has firewall capability built into it using that technology? Okay, and then the second piece of that is when we look at all the vulnerabilities that primarily Linux-based applications have that is sort of the thing that everyone's focused on right now because of Mythos, being able to use that agent technology to be able to shield those applications, that is also something that we are doing. And so HyperShield is finally kind of coming into its own. The execution there was slower than we had hoped, but it's the right idea for the right moment. It's a distributed strategy for doing, you know, enforcement, whether it's policy enforcement or segmentation. And so that is, as we kind of think about sort of the future, we think that's going to be kind of a ramping aspect of that mesh portfolio. But the mesh, it's physical firewalls, it's cloud firewalls, right? It's things like hybrid or like HyperShield. The thing we've also done is we've created a single policy plane for all of this, and so a lot of times customers struggle to operationalize all these things because everything requires a policy or a rule, and historically, this has been sort of a rules and policy-based business that is very complex to manage, and so through agentic ops and through integration of a single policy plane, we've also dramatically simplified how customers can operationalize this, because at the end of the day, you're going to need thousands of these sensors out there, and this distributed network of sensors That's really tough to manage is just a human writing policies. And so a unified policy plane, and then being able to start automating the writing of those policies and managing those policies and run that journey too.

Who is the customer, or what kind of deployments do you address with a smart switch? Meaning, who needs a switch together with a firewall?

I mean, as you're building out data centers, and you're looking to protect workloads, segment the data center, I mean, it is the perfect solution for that. Got it.

And that is basically enterprise data centers? Yes, yes, yes, yes, sorry. What about legacy firewalls? I mean, it's a big part of your business. Although you lost some share in the last few years, you're one of the big players in the space. What are the trends with legacy firewalls? And what are the trends also in terms of your portfolio? How did the portfolio evolve?

Yeah, sure, sure. So, we just refreshed the whole line. So, I would say, like, there's nothing legacy out there anymore, but we've literally refreshed the whole line. And listen, these are very, very advanced products that, you know, high throughput, doing deep packet inspection. We've built incredible ML models that can do on-the-fly detection of threats and what have you. And so, these are very, very sophisticated solutions that, you know, are designed to operate in line, right? And so that is still a very poor requirement. And I think you saw this last quarter, we actually saw very, very strong growth in that business. And so I think that's a very viable part of the business going forward. But I think it's an and. It's an answer or question and answer is that it's not enough, right? And that's where we have to start thinking about these more distributed means to actually be able to do security more at the edges of the network, in the data center, protecting workloads, and those things can all work together. So I want to make the point that it is not a siloed product for us. This is part of this mesh strategy. All these things working together, you know, policy, we can write policy once and enforce it across all these surfaces.

Agentic AI security. So companies start to make acquisitions in general, in the space, companies start to make acquisitions in the space, you made acquisitions in the space. Articulate your position and your vision to secure Agentic AI.

Yeah, sure.

So To secure agentic is really first and foremost about identity, believe it or not, right?

You need to basically always understand exactly what the agent is, what it should be doing, what it's connecting to, and what have you. And so our strategy is to take identity and make it a horizontal across our platform and our infrastructure so that our customers know everything an agent might be connecting to and not just, you know, a simple identity, but actually rich metadata about that identity so you actually understand, okay, this is a workload that's That's running very sensitive information. And, you know, we know that sits behind a certain network and what have you. So that once you do introduce agents, and I'll get to the agentic piece in a second, we have great visibility about what's happening on the network. So for agents, we have introduced so far through Zero Trust, also through just our identity stack, the ability to discover, authenticate, authorize, and now start managing the behavior of those agents on the network, right? And so that agentic strategy, which, by the way, can be enforced by what we see at the workload level. It's enforced by how we authenticate and bring them through identity onto the network. And then the ability to have visibility in firewalls to see agentic traffic, to see MCP calls, to see tool access. We've introduced defense claw on the endpoint that also is looking at what's happening on the endpoint. All of these things, again, working together to be able to see agentic activity across the network. And then an agentic app we just introduced that brings signal from all of these products. So it crosscuts everything. It's not a siloed product. It crosscuts firewalls, secure access, ear trust access, identity to present a view of what is happening with agents on the network. And again, I think, one, that's very unique. Two, because we own the network, we also can see things others cannot. And we can bring in all this signal to give that perspective. And that's going to be absolutely required for securing agentic going forward.

Is this an opportunity that is here and now, or is this an opportunity that is in the future?

This is an opportunity right now. We are in many different customers. So AI Defense is an example, a product we built for builders to safely build applications. That's a product that's a little over a year old and has a huge... Pipeline and backlog, and that is a right now conversation. The ability to use zero trust access to control and monitor what agents are doing on the network, that's a right now conversation. And so every one of our customers, you know, remember what we talked about at the beginning, the CISOs are under incredible pressure to adopt these technologies, but also to secure them. And so this is very much a right now conversation.

You previously noted, it used to be, good, bug is coming to me. You previously, a few quarters ago, you spoke about pressure on cybersecurity from federal government, and it's a big part of your segment. So give us an update on, if you can, please, on the federal segment or federal part of cybersecurity.

Well, I think the thing everyone's seen is the orders coming down from the federal government to update infrastructure and make sure it's quantum ready and, you know, to really get rid of all the LDOS, you know, last day of support type infrastructure and upgrade that. And so, you know, that is sort of the probably the headline to the answer to your question. And so with that, you know, we are bringing everything we have to bear to help support the government in making those changes as well as having lots of discussions around what else do we need to do, for example, to help protect and And kind of mythos type scenarios, a lot of, you know, a lot of discussion with the government and other vendors, too, around how we're collectively going to help solve some of these problems. And I think that, again, is going to be a big topic here the next six plus months.

I forgot to ask you something about AI when we spoke about AI. Is it, is your, what you're doing in AI, is it synergistic to what you currently have? Or is it just a standalone opportunity that is now growing?

So if you remember the description, hopefully it landed of the agentic app. So imagine you've got this view into what an agency on the network, what it's connected to, what tools it's using, you know, maybe it's associated with a user. All of that is signal that's coming from the products and infrastructure that Cisco is deploying, right? And so whether it's secure access or a zero-trust access platform, whether it's identity, whether it's coming from a firewall, whether it's signal we're getting from a workload or something's interacting with a workload, looking at the process flows, that is all signal we're bringing up to give you the agentic view. And the thing I want to sort of reinforce is you need great breadth and depth to secure agents. If you're just an identity player, you can't see what happens past a trust boundary, right? You know, so you have to have great depth and breadth. And because we are at the network layer all the way up to, you know, L7 in the stack, we have incredible ability to operate at all layers in the stack to give this comprehensive picture to our customers about what agents are doing on the network. And agents are going to go everywhere. They're going to do things we don't want them to do. We have to be able to enforce everywhere, have visibility and enforce everywhere. And that is really the ecosystem that we are building.

So, maybe last question. It's not about products and portfolio. It's maybe about your go-to-market and your ability to deliver, to execute on your strategy. Where are you in terms, what do you think about your own strengths and weaknesses when it comes to go-to-market for cybersecurity, not Cisco's in general?

Yeah. So, listen, we have, I think, my personal opinion, the world's best go-to-market. It's an incredible sales force. Our DNA is the network and infrastructure, right? And so, a smart person running a site security business in Cisco would do whatever they can to attach their train to what's happening on the network side of the business. And so, when we're talking about fusing security into the network, that is really a security story that goes with the network sale and infrastructure sale as well. And I think that is landing for us. But really how we think about it is once we're in with a customer with some security offerings that might be outcomes that are tied to the network, as an example, or might be outcomes tied to Splunk, which is broadly deployed, we have this vast portfolio we can upsell and cross-sell that is integrated with whether it's the network or with Splunk to help solve these new use cases we're talking about. Because security typically is about what's the house on fire thing I need to solve today? What's the new attack surface, right? And everything we talked about today is that new attack surface. And we can tie that back to the infrastructure, leverage the infrastructure and the network to deliver those outcomes. And so that allows our go-to-market to actually have a very integrated sale process going from what would be kind of your network sellers into our security sales force. And so putting those two pieces together is obviously really important for us.

So, Peter, thank you so much. Yeah, we ran out of time. Thank you.

Great. Thank you. Thank you. Appreciate it.