Cisco

Having worked across nearly every layer of cybersecurity – from analyst to CISO for two different organizations – I have seen firsthand how difficult security investigations used to be. I still remember trying to manually stitch together security incidents that were scattered across multiple tools and platforms. An alert might originate in one system. Endpoint activity might appear in another. Network telemetry lived somewhere else entirely. Threat intelligence came from yet another source. Correlating all of that information was tedious and often frustrating. Mapping activity against the MITRE ATT&CK framework could take hours—or days—and it frequently felt impossible to do in a timeframe that would allow defenders to catch an attacker while they were still actively operating inside the environment. More often than not, we were reconstructing events after the fact. A SIEM helped us piece together what happened, identify what had been compromised, and understand what had been lost. But investigations were largely retrospective exercises. Things have changed a lot since those days. Every year, Cisco Live provides a unique opportunity to see security technologies operating in a real-world environment at scale. Thousands of attendees, countless devices, hundreds of applications, and an enormous amount of network traffic creates the perfect proving ground for modern Security Operations Centers (SOCs). Having spent time in the Cisco Live Americas 2026 SOC, one thing became abundantly clear: The way SOCs operate today is fundamentally different from even a few years ago. The change isn’t simply that we have better tools. The change is that AI has become embedded throughout the investigative workflow, enabling analysts to operate at machine speed while focusing their attention on higher-value decision making. In many ways, 2026 feels like the beginning of a new era for security operations. Not Long Ago, Correlation Was Manual Only a few years ago, SOC analysts spent a significant portion of their day manually correlating information across disconnected tools: An alert would arrive from one system. The analyst would open another console to investigate. Then another. Then perhaps a packet capture tool. Then a threat intelligence platform. Then an endpoint security product. Then a ticketing system. The analyst became the integration layer. The process worked, but it was slow. More importantly, it did not scale. Attackers were already operating at machine speed. Defenders were still operating at human speed. Today, that gap is closing rapidly. At Cisco Live 2026, many investigations flowed naturally between XDR, Splunk Enterprise Security, Secure Firewall, Secure Malware Analytics, Endace, Wireshark, and AI-assisted analysis capabilities. Instead of spending time gathering information, analysts could spend more time understanding what the information actually meant. That distinction is important. The future SOC is not about replacing analysts. It is about removing friction. A Conversation That Captured the Shift Two comments from one of our SOC team members perfectly captured the transformation happening across the industry. At the RSA Conference in March: “I just started vibe coding and it’s amazing. I just vibe coded this last night.” Then, only a few months later at Cisco Live: “Why would anyone NOT use AI in their work?” Those comments weren’t made by software developers. They were made by security practitioners. That alone says something remarkable. AI is no longer viewed as a specialized capability reserved for data scientists or engineers. It is becoming a normal part of everyday work. Just as analysts eventually stopped debating whether they should use search engines or automation scripts, we’re quickly approaching a point where AI becomes simply another tool in the workflow. The question is no longer whether AI belongs in the SOC. The question is how effectively we can integrate it. The Rise of Analyst-Driven Automation One of the most interesting developments I observed this year wasn’t in a security product. It was in how analysts themselves are starting to build. Historically, if a SOC analyst wanted a custom integration, workflow enhancement, dashboard improvement, or automation, they often needed to submit a request to an engineering team and wait days, weeks, or sometimes months for implementation. That model is rapidly changing. Tools like Codex and other AI coding assistants are lowering the barrier to software development so dramatically that security analysts can increasingly build solutions themselves. Need to automate a repetitive enrichment task? Need to connect two systems that weren’t previously integrated? Need a custom workflow that improves investigation efficiency? Many of these ideas can now be prototyped in hours instead of weeks. The phrase “vibe coding” may sound casual, but the implications are profound. For the first time, many security practitioners can translate ideas directly into working code with AI acting as a development partner. The result is a new generation of analyst-builders who can improve SOC operations without waiting for someone else to do it. Just as spreadsheets empowered business users decades ago, AI-assisted coding is beginning to empower security analysts today. The organizations that embrace this shift will innovate faster than those that don’t. The Rise of the Agentic SOC One of the themes Cisco has been discussing recently is the emergence of the Agentic Workforce. Security operations may be one of the clearest examples of this concept in action. Modern SOC workflows increasingly resemble teams of specialists working together: Detection platforms identify suspicious activity. Correlation engines connect related events. AI systems summarize findings. Investigation tools gather evidence. Automation platforms execute response actions. Analysts validate conclusions and make decisions. The result is not a fully autonomous SOC. Rather, it is a SOC where humans and machines each contribute what they do best. Machines excel at speed, scale, memory, and pattern recognition. Humans excel at context, judgement, creativity, and decision making. The most effective SOCs of the future will leverage both. Real Example: Following a Malware Investigation Across Multiple Platforms One investigation at Cisco Live involved a malware detection associated with a downloaded executable. A Secure Malware Analytics verdict generated an XDR incident, immediately providing analysts with a starting point for investigation. From there, the workflow expanded naturally across multiple integrated platforms. The analyst was able to pivot from XDR into Secure Malware Analytics, then into Splunk, where additional telemetry revealed the originating host, destination server, timestamps, and download activity. Further investigation identified the associated repository activity and enabled rapid scoping of the event. What stood out wasn’t the individual tools. It was the workflow. The investigation flowed naturally from one data source to another without forcing the analyst to manually stitch together information from disconnected systems. A few years ago, gathering this evidence might have consumed most of an analyst’s investigation time. Today, the workflow itself performs much of that heavy lifting. The analyst’s attention remains focused on understanding the situation and determining the appropriate response. Real Example: Turning Hundreds of Alerts Into a Single Conclusion Another investigation involved a large number of XDR incidents associated with HTTP authentication traffic. Historically, an analyst might have spent hours reviewing individual alerts to determine whether they represented malicious activity. Instead, analysts were able to pivot quickly from XDR into Splunk, then into Endace packet capture data, and ultimately into Wireshark analysis to understand the root cause. The investigation revealed that the alerts were being triggered by legacy Basic Authentication attempts rather than an active attack. By examining the underlying traffic and decoding the authentication data, the team was able to confirm the behavior and determine an appropriate remediation strategy. Even more importantly, the outcome wasn’t simply closing an incident. The outcome was improving the detection pipeline itself. The recommendation was to filter these noisy events before they entered XDR, reducing future alert fatigue and improving SOC efficiency. This is another hallmark of modern security operations. The goal is not merely to investigate alerts. The goal is to continuously improve the system. AI Is Already Embedded in Daily Operations Many people still imagine AI as a chatbot sitting beside an analyst. The reality is much more interesting. At Cisco Live, AI was already present throughout the workflow: Incident summaries generated automatically within XDR. Correlation across massive volumes of telemetry. Automated enrichment of security events. Investigation pivots across integrated platforms. Natural language interfaces for querying security data. AI-assisted code generation using tools such as Codex. Workflow automation that reduces repetitive analyst effort. The analyst experience increasingly resembles working alongside a highly capable research assistant that never sleeps, never forgets, and can process information at a scale no human could achieve alone. This doesn’t eliminate the need for expertise. If anything, expertise becomes more valuable. The analyst’s role shifts from data gathering to decision making. The Future SOC Looking ahead, I don’t believe the SOC of the future will be fully autonomous. Nor do I believe analysts will be replaced. What I do believe is that analysts who effectively leverage AI will dramatically outperform those who do not. The gap between AI-enabled teams and non-AI-enabled teams is already becoming visible. Cisco Live 2026 offered a glimpse of what comes next: Investigations moved faster. Context was easier to obtain. Knowledge was easier to share. Analysts could build their own automations. AI could summarize incidents in seconds. Workflows increasingly operated at machine speed. And analysts spent less time fighting tools and more time solving problems. That may be the most important change of all. AI isn’t transforming the SOC because it can replace analysts. AI is transforming the SOC because it allows analysts to operate at a scale, speed, and effectiveness that simply wasn’t possible a few years ago. The modern SOC is no longer just a collection of security products. It is becoming an intelligent, interconnected system where humans, automation, and AI work together to defend increasingly complex environments. And based on what I saw at Cisco Live 2026, that future has already arrived. Check out the blogs by the engineers who worked inside the SOC at Las Vegas:

In the era of distributed architectures and complex service chains, the “black box” approach to networking is no longer sustainable. As applications span thousands of machines, unowned networks, and third-party SaaS providers, tools designed for a simpler, centralized era fail to keep pace. When a single user request triggers hundreds of dependencies, any inability to isolate issues quickly doesn’t just lead to technical debt. It leads to a cycle of burnout, finger-pointing, and significant financial loss. To help organizations navigate this complexity, the latest edition of Splunk’s The Hidden Costs of Downtime report—developed in collaboration with Cisco ThousandEyes—shines a light on the critical role of the network in maintaining digital resilience. From the growing impact of AI-driven outages to the necessity of end-to-end visibility, this report provides a roadmap for IT leaders looking to modernize their infrastructure. We sat down with Greg Leffler, Splunk Director of Developer Evangelism, to discuss the new report and his perspective on how to move past the blame game and build a more resilient, high-performing organization. This second edition of The Hidden Costs of Downtime was more collaborative work. What are some of the biggest changes this brought to the new edition? The biggest change in our 2026 Hidden Costs of Downtime report was a focus on networking-related downtime and its impacts, thanks to Cisco ThousandEyes experts like yourself. We found that most incidents (43%) stem from network- or IT environment–related issues like routing errors, network congestion, and challenges managing a vast amount of endpoint and IoT devices. One of the most significant findings we learned from ITOps and engineering leaders was that downtime caused by public cloud failures cost their organizations the most. So clearly, there was a need to focus on the network in this year’s report. When you think about it, customer experience is really dependent on external service chains companies neither manage nor fully understand. That’s why network end-to-end visibility is so important. It turns this “black box” into something that can be proactively monitored. This year’s report also includes more insight into how AI is both a remedy for and a cause of downtime. While companies are turning to AI to find and fix issues faster, every technology executive surveyed admits their organization has experienced some form of AI-related downtime in the past year, whether from model drift, incorrect AI-driven automation, or adversarial attacks like prompt injections. Managing this paradox is going to be one of the greatest challenges for organizations moving forward. [For additional insights on this topic, see The accelerating impact of AI on campus and branch networks.] What role does visibility play in resolving complex network outages? Visibility is essential. Without it, you simply can’t resolve issues effectively. If we’ve learned anything from the past few years, it’s that you need to be able to isolate a problem in seconds and start fixing it fast, because your customers aren’t going to wait. They’ll abandon their cart, go to a competitor, or vent their frustration on social media. Perhaps because of this, organizations are starting to recognize the need to visualize the entire dependency chain. In fact, we found that among respondents with the lowest downtime costs, 98% say end-to-end visibility is very or extremely important for reducing downtime. Why do traditional monitoring tools struggle with modern distributed architectures? Because they were designed for a much simpler, centralized era. In the past, applications lived on a few servers that one person could easily manage and visualize. Today, applications are far more complex, running across thousands of machines in various locations and managed by many different teams. Traditional tools aren’t built to follow the path one user request takes in modern stacks, where one request can trigger hundreds of services, owned and unowned networks, and even third-party dependencies, like CDNs. How do current incident response practices impact business innovation? Incident response is still a game of hot potato. The first responder just wants to get the issue off their plate. Current tools don’t help with this; they fire off noisy alerts to the wrong people and often fail to provide diagnostic information needed to identify the root cause. In addition, businesses need to ship code, which means that, occasionally, code will break in production. So, the traditional incident response approach of “roll everything back” just doesn’t cut it anymore. To effectively innovate, businesses should adopt A/B testing, feature flags, and other ways to exercise new business logic without needing complicated deployment. When one change has a negative business impact, they should be able to turn it off without doing more deployments and potentially breaking things even further. Should IT leaders prioritize MTTI alongside MTTR? No, I don’t think they should, because it implies that the siloed world where “only the network is my problem, and everything else is somebody else’s issue” is a good end state. It isn’t. Resilience is an organization-wide goal, where every issue is everybody’s problem. MTTI reinforces a laissez-faire attitude that is counterproductive to true digital resilience. How does this approach improve the well-being of IT staff? ITOps and engineering teams constantly report burnout because they are asked to do more with less in increasingly complex, high-pressure situations. So, being able to confidently say, “This problem is outside of my area of expertise, and here’s why,” can help ease burnout and allow teams to feel less anxious about work. But there’s a delicate balance to strike here, as many IT staff that work in on-call roles enjoy being tasked with solving problems under pressure. You don’t take these jobs without embracing the tension of solving a “mission impossible” issue at hand. What is the primary business value of reducing time spent in situation rooms? The obvious one is the cost. According to The Hidden Costs of Downtime, Global 2000 companies lose $19 million from lost productivity and $13 million from overtime wages each year. And that’s only direct costs. Eighty-nine percent of technology executives admit that it requires many personnel to fix a downtime issue—a hidden cost that causes a chain reaction of consequences across an organization, like falling behind on product roadmaps. So, every second you have teams stuck in a war room is a second they’re not increasing overall value to your business. How does this visibility benefit campus and branch network teams? Visibility helps everyone by making it easier to rule out issues and quickly route problems to the right team, allowing them to resolve incidents with confidence. It’s frustrating to spend hours troubleshooting something only to find out your cat unplugged the router in the other room. Save your seat for The $600 Billion Blind Spot: Why Downtime is Now a Boardroom Crisis webinar and learn how to quantify downtime’s hidden costs. Additional resources: Download a copy of The Hidden Costs of Downtime 2026. Explore Cisco ThousandEyes Assurance.

Why the Fundamentals You Ignored Are the Only Things That Will Save You In 2023, a colleague and I wrote a cybersecurity guide for businesses of any size. It was not glamorous work. Nobody was asking for another whitepaper about multi-factor authentication (MFA) and network segmentation. The industry had heard it all before: Harden your devices, segment your networks, deploy endpoint detection and response (EDR), centralize your logs, test your backups, validate your designs. These are not revolutionary ideas. They are the kind of recommendations that get polite nods in client meetings and then get quietly dismissed somewhere between budget approval and implementation. We wrote the guide anyway. Not because I thought we were saying something new, but because after years of incident response work, I kept walking into the same rooms, looking at the same gaps, and having the same conversations with organizations that had just been breached. The attack vectors changed and the tooling evolved, but the reason organizations got hurt was almost always the same – the basics were not in place. In that paper we posed questions that, when answered honestly at the strategic level, could reveal the real state of an organization’s defenses. We covered endpoints, networks, cloud services, physical security, staffing, and logging. It was designed to be useful whether you had a team of 500 security analysts or a single IT person wearing multiple hats. The core thesis was that patching alone is not a security strategy. You need a foundation that holds when patching fails – because eventually, patching will fail. This scenario eventually arrived in April 2026. Anthropic announced Project Glasswing and Claude Mythos Preview, an AI model that autonomously discovered thousands of high-severity zero-day vulnerabilities across every major operating system and web browser. Not theoretical weaknesses or potential issues – working, exploitable vulnerabilities. One was undiscovered for 27 years in OpenBSD, the operating system chosen specifically because it is said to be among the most secure in the world. This is what happens when vulnerability discovery stops being a human-speed activity. It dawned on me everything we wrote about in 2023 – every recommendation, every question we posed -had just become dramatically more urgent, as speed is the new factor in the traditional risk triad. Cisco set out the strategic version of this argument in its Shields Up guidance after working with Mythos Preview. What follows is its operational companion. The new math Before Mythos and other frontier large language models (LLMs), the vulnerability lifecycle had a rhythm that most security teams had internalized. A researcher discovers a vulnerability, and weeks or months pass while an exploit gets developed. After a vendor releases a patch, organizations deploy it on their own schedule. There was slack in the system, which gave organizations time to triage, test, and be slow but still survive. After AI and LLMs, the first two stages of that lifecycle collapsed to near-simultaneity. AI discovers the vulnerability and writes the exploit in minutes, not weeks. But the last two stages, patch release and patch deployment, remain human-driven processes operating at human speed. The gap between discovery/exploit and patch/deploy has widened from a manageable delay into a structural gap. The numbers make this concrete. The FIRST 2026 Vulnerability Forecast projects a median of roughly 59,000 new CVEs this year, with a 90% confidence interval reaching up to 118,000. In 2025, 48,185 CVEs were published, a 21% increase over the year before, which works out to roughly 131 new vulnerabilities disclosed every single day. NIST acknowledged that CVE submissions grew 263% between 2020 and 2025. Starting April 2026, NIST announced it would only prioritize enrichment for CVEs appearing in CISA’s Known Exploited Vulnerabilities (KEV) catalog, software used by the federal government, and critical software under Executive Order 14028. Everything else goes to the back of the line. When talking about this data in customer briefings, I framed it around three factors: the minutes from discovery to exploit, the thousands of zero-days discovered, and how AI accelerates attackers and defenders equally. The Cloud Security Alliance was explicit about this in their April 2026 analysis. The ability to discover vulnerabilities at AI scale is not intrinsically a defensive capability. It is a dual-use capability whose effect depends entirely on who has access and what constraints govern their use. We are lucky that frontier models take responsibility for how they are used, but there are many open-source models with less oversight. When vulnerability management fails, who do you fall back on? The way I think about post-frontier model defense, and the way I have been presenting it to security leaders, follows a three-stage fallback model. The first pillar is vulnerability management. Scan, prioritize, patch, repeat. This is where most organizations have concentrated their security spending for two decades. Patch velocity cannot match AI-driven discovery rates. With 59,000+ CVEs projected for 2026 and growing, the volume exceeds organizational capacity to triage, test, and deploy (in production, live). Not all vulnerabilities even have patches on day zero; some are deemed as “operational risk,” or it would take years to redesign systems or hardware. Vulnerability management is not dead, but it is no longer the primary line of defense; it is now one input among many. This is where Cisco IQ becomes essential. Its digital interface provides complete asset visibility, security hardening insights, and risk assessments, allowing you to proactively identify vulnerabilities and harden your systems in the face of mounting CVE volumes. Automating what you can will be key to resilience acceleration. When patching fails, you fall back to the second pillar: the “old school” hardening that seems to be forgotten in era of EDRs. This is where the 2023 whitepaper becomes a guide: MFA everywhere, especially VPN and admin access, because credential theft is the most common way attackers establish initial access and MFA is the control that most reliably stops it. Device hardening via CIS benchmarks and golden images, because a hardened system with unnecessary services removed and Credential Guard enabled has dramatically fewer exploitable paths than a default installation. Network segmentation to limit blast radius, because a single zero-day should not cascade across your entire infrastructure. We recommended building golden images that incorporate appropriate security logging, refreshing them every 6 to 12 months, and applying the latest hardening standards. The whitepaper from 2023 asks questions that most organizations still cannot answer confidently: Are well-known security standards for hardening followed consistently across all devices? When was the last time core system golden images were reviewed for weaknesses? Are golden images part of security reviews? The third pillar is detection and response. Hardened systems do not prevent exploitation, but make it harder, slower, noisier, and survivable. Detection and response are what catches the exploitation that gets through, and in a post-AI exploitation world, some exploitation will get through. This is given and needs to be assumed. This means EDR, NDR, and XDR for visibility across layers. Behavioral detection is critical when zero-days outpace signature updates. An attacker using an AI-discovered vulnerability still needs to execute code, establish persistence, move laterally, and exfiltrate data. Those actions produce behavioral signals that a properly configured EDR can detect regardless of whether the specific vulnerability was previously known. It means that we can use threat hunting to find what automation misses. It also means you need incident response capability for when prevention fails. New attacks will emerge. The question is not whether you will be compromised. It is now how quickly you can detect, contain, eradicate, and recover. Validation is not optional Having the right products deployed is necessary, but not sufficient. You also need to know how they work – and here is where most organizations have a blind spot the size of a continent. The question every security leader should be asking right now is “Do my controls actually work? Not on paper, but under real-world attack conditions?” Penetration testing answers that question. So does assessing your configurations against CIS benchmarks and hardening what falls short. Threat modeling takes it further by mapping the attack paths a real adversary would use against your specific architecture, not a generic risk matrix. Breakout assessments deserve special attention. They test the boundaries between network segments. Can an attacker move from a compromised endpoint to critical infrastructure? From IT to OT? From one business unit to another? In a post-AI world where a zero-day can provide initial access to network segment, the integrity of those boundaries is arguably the most important architectural property of your network. Finding out they are broken before a real adversary does is the difference between a containable incident and an existential crisis. Then there is the response side, and this is where I see the widest gap between what organizations think they have and what they actually have. IR playbooks that have never been tested are not playbooks. They are hopes. Purple team exercises are what turn those hopes into muscle memory, the kind that determines whether your team freezes or acts when a real incident hits. Proactive threat hunts catch what your automation missed. When everything has been tested and still was not enough, emergency incident response is the capability that gets you from compromised to recovered. The full picture is a cycle. You want to prevent security issues with products and hardening, validate with testing and assessment, and respond with hunting and incident response – all of it backed by threat intelligence, and all of it working together as a system, not as disconnected point solutions checked off a compliance spreadsheet. What did not change AI will not get tired of system exploitation, so risk will get realized much faster than in the past. Because of this, we now add “speed” to risk equation. It becomes Risk = likelihood x impact x speed as opposed to just Risk = likelihood x impact. AI does not change the principles of cybersecurity. MFA still blocks credential theft; segmentation still prevents exploit cascading into the environment; EDR still detects exploitation behavior, memory abuse, and attempts to “write” to memory segments; centralized logging still records events for detection and investigation; and tested backups still enable recovery. Those statements were true before any LLM/AI vulnerability discoveries, they are true after LLM/AI, and they will remain true after whatever comes after current stacks. Because they operate at a layer of the security stack that is independent of how fast vulnerabilities are discovered. They work whether the attacker used a known CVE or a fresh zero-day, and whether the exploit was written by a human researcher over three weeks or by an AI in three minutes. This is the structural insight built around the whitepaper in 2023. Nobody had predicted that LLM/AI vulnerability discovery explosion, but we had seen, over and over again in incident response engagements, that the organizations that survived breaches were not the ones with the fastest patching cycles. They were the ones that had built their security foundations before the breach arrived. The current AI acceleration does not wait for budget cycles, board approvals, or strategic plans. It rewards preparation and it punishes delays.

Most organizations assume that anything inside their trust boundary, from vetted vendors and cleared employees to certified cloud providers and signed artifacts, can be treated as safe, and state-sponsored actors have built their entire approach around exploiting that often unexamined assumption. They operate from inside the boundary using legitimate tools and valid credentials, producing activity that looks fully authorized and slips past conventional security architecture. Responding to them is therefore very different from handling criminal attacks, since they are better resourced, more patient, and pursue quiet goals like espionage or long term data extraction that do not trigger normal alarms, making standard ransomware and malware playbooks inadequate. This is also why zero trust architecture matters, shifting from assumed trust to continuous verification with systems built to withstand failure. State-sponsored actors still follow the Cyber Kill Chain, but execute each phase with patience and covertness, using open-source reconnaissance, stolen credentials, trusted internal tools like PowerShell and SCCM, layered dormant persistence, and anti-forensics to stay invisible for months. Attribution is useful mainly for shaping threat models, while political attribution belongs to governments, so response teams should share indicators with authorities and ISACs and focus internally on containment, scope, and recovery. Being ready for the long game Preparing for state-sponsored threats means closing gaps before an incident, not during one. The following are some areas that organisations should ensure are prepared for. Visibility: deep logging across endpoints, identity, network, and cloud, including command-line, PowerShell, Sysmon, NetFlow, and DNS data, all centralized to survive log wiping. Behavioural baseline: Continuously updated behavioral baselines help surface low and slow activity, especially credential abuse that leaves no malware trace. OPSEC: If a breach occurs, responders must assume the adversary sees internal communications, so out-of-band channels, compartmentalization, and pre-established authority contacts are essential. OT and ICS readiness: OT environments need hardware-enforced separation, as well as established response procedures. Supply chain and insider threats: supply chains need mapped vendor access and SBOMs, and insider risk demands cross-functional hiring verification and pre-authorized monitoring. Is your Incident Response Plan ready? Most incident response plans still focus on malware and ransomware, leaving gaps around supply chain, insider, 0-days, and living-off-the-land threats that need their own playbooks and realistic tabletop exercises. State-sponsored incidents are harder because the adversary may watch the response, try to regain access, and force difficult containment calls that require legal and leadership input, not just SOC judgment. You can view the full blog post on the Talos website. Finally, post-incident work includes intelligence sharing, MITRE ATT&CK-based reviews, and continued threat hunting, since the actor often returns. For teams with limited budgets, the right order is visibility first through free logging improvements, then identity hardening, then focused monitoring on critical systems. We’d love to hear what you think! Ask a question and stay connected with Cisco Security on social media. Cisco Security Social Media

Somewhere right now, a Cisco colleague is on a call with a company facing the worst day of their professional lives. Their network is compromised, their data may be stolen, and their business is at risk. That Cisco colleague is calm, focused, and already three steps into solving the problem. Meet Cisco Talos Incident Response, or Talos IR – our frontline response team. These are colleagues who have dedicated their careers to being present when organizations face genuine crisis, systems fail, attackers succeed and everything feels uncertain. Who we are Every Cisconian knows we sell security products. Fewer know that we also have a team of people who parachute into chaos when those products, or any products, are not enough. Talos IR is not a helpdesk. They are the people organizations call when everything has gone wrong and they need someone who has seen it all before. Think of them as the fixers, or the ones who show up when the stakes are highest and the pressure is unbearable. Talos IR works holidays, weekends, and through the night because someone on the other end of that call is counting on us. If you are in a customer meeting and they ask, “What happens if things go wrong?” you can tell them that Cisco does not only sell products. We stand behind them with a team that will fight alongside you when it matters most. That is a promise very few companies can make. Talos IR also feeds intelligence back into everything we build. The threats responders see in the field today become the protections in Cisco products tomorrow. Every engagement makes Cisco smarter and our customers safer. Beyond the business value, there is something worth celebrating here. We have colleagues who choose to spend their careers helping organizations through their darkest moments. That says something about the kind of company we are. The human side of security We often discuss cybersecurity in technical terms: threats, vulnerabilities, exploits, etc. Behind every security incident are real people facing real consequences: a hospital administrator worried about patient safety, a retail executive concerned about customer trust, or a small business owner watching their life’s work hang in the balance. Our responders understand this. They bring extraordinary technical skill to every engagement, but they also bring something equally important: compassion. This is the ability to help people think clearly during moments of fear, the patience to explain complex situations to stakeholders who may not have technical backgrounds, and the commitment to stay on the line, through nights and weekends, until the crisis is resolved. Different perspectives, same mission Ask a Talos IR team member why they do this work and you will get different answers. Some are drawn to the intellectual challenge. Every incident is a new puzzle with different pieces and attackers are constantly evolving, which means the work never gets boring. Others talk about the relationships. Unlike many security roles, incident responders build deep connections with the people they help. In these situations, you are not only a vendor, but a partner in the trenches. Many simply say it feels meaningful. In a world where cybersecurity headlines are usually about failure, they get to be part of the success stories: the attacks that were stopped, the data that was recovered, and the businesses that survived. A final thought Privacy and security are fundamental rights and protecting them requires more than good intentions. It requires people willing to do hard work, often unseen and at inconvenient hours, because someone needs their help. We are fortunate to have those people at Cisco and I’m proud to be part of this team. We’d love to hear what you think! Ask a question and stay connected with Cisco Security on social media. Cisco Security Social Media

We’re excited to share a major update for IT and developer teams: the new Cisco Meraki → PagerDuty integration is now live! For developers and network engineers, managing critical alerts and reducing response times are top priorities. With this new no-code integration, you can now connect Cisco Meraki directly to PagerDuty—right from the Meraki dashboard, with zero custom scripting required. What’s New for Developers? Effortless Setup: Configure PagerDuty integration directly within the Meraki dashboard. No coding, APIs, or complex workflows needed. Pre-Mapped Alerts: High-value Meraki alerts are already mapped for you—making it easy to route the most critical events to your response teams. Automatic Incident Routing: Incidents are instantly sent to your existing PagerDuty on-call schedules, ensuring rapid response by the right people, every time. Why It Matters: Historically, integrating network alerts with incident management often required custom code, manual mapping, and tedious configuration. This new integration eliminates those steps, streamlining operations, reducing alert fatigue, and helping teams improve mean time to resolution (MTTR). See It in Action Want a closer look? Check out our demo video to see just how quickly you can enable and benefit from this integration. Get Started Today Ready to empower your network operations and developer workflows? Visit your Cisco Meraki Dashboard and navigate to Organization > Integrations to enable PagerDuty integration in just a few clicks. Stay tuned for more developer-centric updates and integrations from Cisco! Example Developer Use Cases: Immediate Incident Notification: When a Meraki device experiences an outage, developers are instantly notified via PagerDuty, allowing them to triage and resolve issues before end users are impacted. Automated On-Call Escalations: Critical network alerts auto-route to the correct on-call engineer, without custom webhook scripts or manual intervention. Note: The integration is designed for all skill levels—no coding required. Customization options are available for advanced alert routing in PagerDuty. For questions or feedback, let us know in the comments!