Cisco Talos Intelligence Group

AI incident response requires a fundamental shift in how we architect our data — long before the 6:00 a.m. incident call comes in. Read Yuri's blog here: cs.co/6012B6nPUg

Mark your calendar! Next Thursday, Talos researchers will be waiting on r/cybersecurity to answer your most pressing questions.

When a cyber attack strikes, there’s a team ready to fight alongside you during your darkest professional hours. Yuri Kramarz shares the story of Talos Incident Response — experts who bring technical expertise and compassion to the front lines of a crisis: cs.co/6015B6nuwB

While a garlic and wooden stakes keep the vampires at bay in movies, they won’t save your network once an attacker has been "invited in." Hazel shares why identity is the new frontier of cyber horror in this week’s Threat Source: cs.co/6010B6psIq

The wait is almost over! We’ll be releasing our 2025 Year in Review report on Monday morning. From top targeted vulnerabilities of the year to ransomware trends, get ready for some in-depth threat analysis.

The new Exfiltration Framework provides a cross-platform, behavior-based approach to detecting data theft by focusing on how attackers abuse legitimate, trusted utilities rather than relying on static indicators: cs.co/6012B6p3ea

The next Tool Talk is here. Introducing DispatchLogger, an open-source tool that provides deep, semantic-level visibility into late-bound COM object interactions to help analysts better detect and understand script-based malware: cs.co/6013B6rqGH

If you think AI guardrails are enough to stop prompt injection, you’re already behind the curve. Discover why the real battle for AI security is moving from the model to the infrastructure: cs.co/6010B6u5Cu

Get ready: The 2025 Year in Review comes out next Monday.

ICYMI: Talos updated our blog on the developing situation in the Middle East with our assessment of the cyber attack on Stryker and the elevated threat landscape: cs.co/6019B6uK5R

In this week’s edition, Joe reflects on his mother’s strength throughout his childhood, International Women’s Day, and the importance of inclusivity in cybersecurity: cs.co/6017B6yZzx

Join us on the latest episode of Talos Takes as David Bianco breaks down the PEAK Threat Hunting Framework and shares how to streamline the preparation phase with a new AI-assisted tool: cs.co/6017B6HAzN

What's the secret to a strong SME-technical writer partnership? In the nerdiest episode yet, Kri Dontje discusses this collaboration and the surprising intersection of weaving and binary code: cs.co/6016B6GH1j

Cisco Talos updated our blog on the situation in the Middle East with additional IOCs, guidance, recommendations, and timelines: cs.co/6011B6yKkb

Agentic AI may be a force multiplier for your business, but are your security guardrails strong enough to keep that autonomy from becoming a liability? Read more in our latest blog: cs.co/6017B6GGkt

Join Hazel for a wide-ranging conversation with Matt Olney, covering everything from AI and 1999-era security tricks to vtubers and desserts: cs.co/6018B6GPfO

Coming soon...

Shakespeare, stubborn scripts, and shifting cyber trends — William’s got laughs and lessons waiting for you in this week’s newsletter: cs.co/6014hqmJ0

Talos is tracking active exploitation of CVE-2026-20127 affecting Cisco Catalyst SD-WAN Controllers. Customers are strongly advised to review our latest threat advisory (cs.co/9001hs79z) and follow published guidance (cs.co/9001hs7aL) to protect your environment.

Cisco Talos is disclosing the "Dohdoor" backdoor, which is stealthily targeting education and health care networks using DNS-over-HTTPS, evading traditional security tools, and hiding behind trusted cloud infrastructure: cs.co/6010hqSsA