Compare
Astrix (now part of Cisco) discovers and governs the non-human identities AI agents use.
Cyphrex is the decide-and-prove layer — every action checked, every decision recorded in a trail you can verify.
Astrix secures the credentials and admits the agent identity. Cyphrex proves the act: who approved, what was touched, and what stayed blocked.
Astrix
Astrix discovers and governs the API keys, service accounts, and OAuth tokens AI agents use, from provisioning to decommissioning, and detects compromised credentials and out-of-scope actions. Astrix is part of Cisco (acquisition completed June 29, 2026). Capabilities are integrating into Cisco Identity Intelligence, Secure Access, Duo, and Splunk.
Discover → lifecycle → detect.
Cyphrex
A decide-and-prove layer for teams who will instrument an agent or route its MCP traffic, and who need each decision kept as tamper-evident evidence.
Enforce the action → tamper-evident evidence.
| Capability | Astrix (Cisco) | Cyphrex |
|---|---|---|
| NHI + AI agent discovery (keys, service accounts, OAuth) | Strong fit | Per-agent identity you register |
| Agentic access & lifecycle (provision → decommission) | Strong fit | Not an NHI lifecycle suite |
| Threat detection on credential abuse / out-of-scope actions | Strong fit | Policy violations + alerts; not ITDR/SOC |
| Secrets management across vaults & cloud | Strong fit | Not Cyphrex’s job |
| Runtime policy on instrumented agent / MCP actions | Adjacent (identity & access) | check() + MCP gateway |
| Tamper-evident, independently verifiable decision record | Identity / activity visibility in Cisco security stack | Ed25519-signed packages + public /verify |
| Who approved / what touched / what stayed blocked | Who/what identity acted | Compliance receipt for auditors, insurers, legal |
Astrix and Cisco answer which non-human identity the agent is, and whether that credential is healthy. Cyphrex answers what that actor was allowed to do on each step, and proves it.
Every Cyphrex evidence package is signed with Ed25519 and bound with SHA-256. On /verify, someone can check it without a Cyphrex login.
Evidence artifacts map toward SOC 2 / EU AI Act / HIPAA / SR 26-2 style reporting — not certification; details on Trust.
Cyphrex signs what flows through the SDK check() or the MCP gateway. It does not invent coverage for a path it never saw. Cyphrex is not your auditor.
Often a complement. Astrix secures the credentials and admits the agent identity. Cyphrex proves what that actor was allowed to do on each step. Cyphrex does not replace Astrix or Cisco identity security.
Standalone new-license sales ended June 30, 2026. Existing customers continue. New licenses are through Cisco, and Astrix capabilities are integrating into Cisco Identity Intelligence, Secure Access, Duo, and Splunk.
Yes. A Cyphrex package is Ed25519-signed and SHA-256-bound. On /verify, someone can check the decision without a Cyphrex login.