The Enterprise Just Hired Its First AI Workforce — Now It Has to Manage It

Splunk .conf 26 Roundup!

Every big tech conference claims a turning point. Most don’t have one. Splunk’s .conf26 in Denver this week past, might be the exception, and not because of a flashy new dashboard. Cisco and Splunk spent the week making a quieter, more consequential argument: AI agents have stopped being features and started being employees. And once you treat something like an employee, you have to start asking employee questions. Can you trust it? What does it cost? Who’s watching it when things go wrong? 

We’ll run some future blogs on digesting this, but here is the first pass, of what’s hot off the press and some initial industry comments.  

That thread runs through everything announced this week. Splunk’s own framing piece, from platform chief Mangesh Pimpalkhare, puts it bluntly: “The agentic era is no longer a promise on the horizon. It’s running in production, at scale, in the environments you depend on every day.” It’s worth following whether or not Splunk is your platform of choice, because the questions it raises aren’t Splunk questions. They’re 2027 budget questions. 

Splunk: Digital resilience in the agentic era 

Start with the keynotes 

Both broadcast keynotes are available on demand: the Welcome Keynote (1:41:25, Jeetu Patel and Kamal Hathi) and the Product Keynote (1:59:56). If you only have time for one clip, find Jeetu’s numbers. AI agents overtook humans in token consumption back in February 2026, and seven months later they’re burning five times as much. Roughly 60% of global AI compute now goes to inference rather than training. Then comes the line that carried the whole event: “agents are like teenagers — intelligent, fearless, and notorious for poor judgment.” 

It’s a good line because it’s true, and because it does real work. It reframes every announcement that followed from “look what AI can do” to “here’s how we keep it supervised.” 

Zeus Kerravala’s keynote analysis for SiliconANGLE reached the same conclusion from a different direction, and his title says it: trust becomes the product. His five takeaways are worth having to hand. Agents are workforce, not tooling. Observability and security are merging (we’ve been saying this for a while), because non-deterministic systems fail in ways that look exactly like breaches. Tokenomics turns AI from a science project into a P&L line. Data economics have to change first. And agents earn trust the way employees do, on a trust-but-verify basis. Splunk’s Vikram Chatterjee supplied the quieter line of the week: “not everything needs a model in the loop.” 

Watch the replays 

SiliconANGLE: Trust becomes the product — five takeaways from the keynotes 

Agentic security operations grow up 

The headline product news is an expanded Agentic SOC Workforce: purpose-built agents across four lanes (Detection and Security Engineering, Threat Hunting, Investigation and Response, and Governance and Policy), now rolled into Enterprise Security Essentials and Premier. This isn’t a chatbot bolted onto a SIEM. It’s agents doing discrete SOC jobs end to end, with humans supervising rather than executing. 

Read it plainly and it’s Splunk admitting the SOC hiring problem isn’t solvable by hiring. But the interesting agent is the least glamorous one. The Governance and Policy agent exists specifically to keep autonomy “grounded in SOPs, approvals, and auditability,” which tells you exactly where the buyer objection sits. It was never “can it detect threats.” It’s “can I audit what it did.” 

The customer stories made that concrete. Asurion described a “trust ladder,” where agents earn expanded autonomy incrementally as they prove reliable, rather than being handed the keys on day one. Constellation Energy brought the number everyone will quote: identity-incident mean time to resolution fell from roughly 20 minutes to 39 seconds once they trusted automation to act rather than merely alert. That isn’t an efficiency gain. That’s a different category of response. 

Read more: Evolving to Autonomous Defense 

The money question: what does an agent actually cost? 

This is the part that should worry, or at least interest, every budget owner. Agents are expensive, and the expense is invisible until the invoice lands. 

Splunk’s answer is Agent Observability, now generally available and built on the Galileo acquisition. The standout feature is “Tokenomics”: a single view where finance and engineering can see which agents, users, and models are driving cost, and whether that spend is producing anything. Under the hood, small “Luna” models grade 100% of agent traffic cheaply, rather than paying a frontier model to judge a sample. 

The real insight is the question shift, from “how much are we spending” to “which agents are wasting it.” Verizon’s contribution was the sharpest of the week: the cheapest agent isn’t always the most efficient one. A slow, chatty, imprecise agent can cost more in tokens than a pricier one that gets it right in fewer calls. Eighteen months ago nobody was asking for a FinOps layer for AI agents. By this time next year, after the first surprise bill, everyone will be. 

Read more: Agent Observability 

Small models, not frontier models 

The Luna graders are part of a wider bet. Mike Vizard at DevOps.com reports that Splunk is preparing its second open-source LLM, this one trained specifically to reason across log data, headed for Hugging Face under an open licence. It complements the metrics-focused Cisco Time Series Model 1.0, and the logic is simple: general-purpose models are poor at raw numbers and worse at log volume, so build small ones that aren’t. Raja Mukhopadhyay, Splunk’s VP of observability cloud, says the log model will “make it possible for DevOps teams to observe AI applications and agents at scale.” 

Pimpalkhare framed the strategy for SiliconANGLE without hedging: “We are not reinventing frontier models. Our goal is to complement those frontier models and develop the next level of domain-specific models.” Alongside it comes a new Universal Collector, built on OpenTelemetry to gather logs, metrics and traces through a single pipeline, with beta expected in 2027. The pitch is one collector feeding DevOps, IT operations and security at once, which is the plumbing that Kerravala’s “observability and security are merging” point depends on. 

DevOps.com: Splunk preps second open-source LLM for telemetry data 

Splunk dismantles its own pricing model 

Two big moves landed in one post. First, Federated Search now reaches AWS CloudWatch Lake and Databricks under the Cisco Data Fabric banner, with SiliconANGLE’s deeper dive adding Snowflake and cloud object stores to the list, so you can analyse data where it lives instead of paying to ingest and duplicate it. Second, and more significant, Activity-Based Pricing launches this Fall: a dual-meter model weighting search and ingest equally, instead of penalising ingest volume. 

Pimpalkhare’s line on why is refreshingly direct: “If you start duplicating data movement and all the processing needed, that is what drives up costs.” The stated goal, per Kerravala, is “capacity up 10x, bill flat”, and there’s an early proof point in the Autodesk story Network World picked up, with 28% lower ingest costs and a 78% saving from moving a single search workload. 

It’s hard to overstate what this changes. Ingest-based pricing made Splunk expensive (our clients top bugbear) and shaped a decade of “what do we even bother logging” decisions. If agents are about to query constantly in the background, ingest-weighted pricing becomes a tax on curiosity, and Splunk knows it. Worth watching closely whether this lowers bills or simply moves where the meter sits. Either way, the model that built the company is being retired on purpose.  We will get our Splunk contacts to reveal more watch this space.  

Read more: The Agentic Era Demands a New Data Foundation 

SiliconANGLE: Splunk rebuilds its platform around agents 

Sovereignty gets a product line 

For regulated industries and anyone with data-residency constraints, the Cisco AI POD for Splunk is now generally available. It’s Splunk’s first on-premises accelerated-computing offering with NVIDIA: pre-validated, air-gap capable, Kubernetes-native, and running Splunk AI Assistant and Agent Launchpad locally. Model choice includes Gemma and GPT-OSS 20B today, with Nemotron coming. 

It’s a direct answer to the question every bank, government agency, and healthcare provider has been asking: how do we get the benefits of agentic AI without sending sensitive data through someone else’s cloud model. It’s also a tell. If Splunk needed to build a whole on-prem SKU to get regulated customers to adopt agentic AI at all, that tells you how large the sovereignty objection really is right now. Expect this to matter most for public sector and financial services, but it signals a broader shift: AI capability is being decoupled from “must live in the cloud.” 

Read more: Cisco AI POD for Splunk 

AWS and Splunk call it a category 

The expanded AWS partnership was positioned as “beyond a single integration”: adjustable autonomy (from recommend through to execute), policy-driven governance, and deep analyst oversight built into Splunk’s Agentic SOC on AWS infrastructure. It was light on specifics and heavy on positioning, which is itself the point. Two large vendors jointly telling the market that agentic security is a co-owned category matters more as a competitive signal than as anything you can buy today. 

Read more: Splunk and AWS 

Agent Launchpad: the most useful thing announced 

Quietly, this may be the most practically valuable announcement of the batch. Agent Launchpad is a no-code agent builder inside Splunk itself. Agents trigger directly from alerts and searches, inherit existing RBAC, and keep a full run-history audit trail. It removes the dependency on a data scientist: the analyst who already knows the runbook builds the agent. 

One alpha customer, a SOC analyst at an ISP, reports their custom triage agent matches human severity classification around 80% of the time. That figure is honest in a way most vendor case studies aren’t. It doesn’t claim replacement. It claims triage support, and it tells you exactly where the human still belongs. 

Read more: Introducing Splunk Agent Launchpad 

Rounding things out, Exposure Analytics picked up enhancements that shift the emphasis toward proactive risk prioritisation rather than reactive alert triage, consistent with the week’s wider theme of moving work upstream, before incidents happen. 

And for the network team 

Easy to miss among the agent headlines, but Network World’s write-up makes the case that infrastructure teams got real news too. A new Network Intelligence App for Splunk Observability pulls Cisco network topology, device health and event data into the same view as application telemetry, so an alert can be traced to the affected device without switching platforms or waiting for two teams to compare notes. ThousandEyes Network Insights adds synthetic testing across both the networks you control and the internet transit you don’t. 

The motivation is agents again. Cisco’s Jeff Schultz noted that infrastructure is “now being strained at levels that it never was before” as distributed agents pile on traffic, and Kamal Hathi’s framing was that all of it “runs on a common set of data that can provide end-to-end visibility across network and application domains.” Agent Observability itself now stretches down to GPUs, vector databases and orchestration frameworks. If you run the platform, the agents are your workload now too. 

Network World: What .conf26 means to network engineers 

What it means for buyers 

Strip away the branding and .conf26’s message is this: agentic AI in security operations is no longer a pilot-project conversation. It’s a procurement and governance conversation. The vendors in this space are now competing on trust, cost visibility, and deployment flexibility, not just detection accuracy. 

Every announcement above is really answering the same question: how do you let an agent act without losing the ability to say why it acted, what it cost, and whether you’d have approved it. Capability was never the gap. Governance was. 

If you’re evaluating any AI-driven security tooling this year, the questions worth asking aren’t “how smart is the agent.” They’re “how do we govern its autonomy, what does it cost us at scale, and where does our data actually have to sit.” Splunk isn’t the only vendor being forced to answer them. It’s just the one asking them loudest, in Denver, in front of everyone. 

CRN’s channel read of the week draws the same five threads (the AI POD with NVIDIA, the Agentic SOC expansion, the AWS alliance, the platform overhaul, and the partner opportunity that sits underneath them) and lands on a point worth underlining. Every one of these announcements creates work that customers won’t do alone: sizing on-prem AI infrastructure, building and governing agents, rewiring data pipelines for federated search, and re-modelling costs under a new pricing meter. For partners, the agentic era looks less like a threat to managed services and more like a reason for them. 

CRN: 5 key takeaways from Splunk .conf26