Cisco Talos

Cisco Talos, also known as the Cisco Talos Threat Intelligence Group, is Cisco Systems' cybersecurity research and threat-intelligence organization. Based in Fulton, Maryland, Talos investigates malware, cybercrime groups, vulnerabilities, botnets, ransomware, espionage activity, and attacks against critical infrastructure. Its research is used to improve Cisco's security portfolio, including network protection, endpoint security, DNS security, cloud security, email filtering, intrusion prevention, and incident-response services. The group also publishes technical intelligence for the wider security community and works with technology companies, law-enforcement agencies, government organizations, and other cybersecurity researchers. Talos was formed in August 2014 after Cisco acquired Sourcefire and combined several research and security teams: Sourcefire's Vulnerability Research Team, Cisco's Threat Research, Analysis, and Communications group, and Cisco's Security Applications organization. The Sourcefire heritage is important to Talos because Sourcefire was founded by Martin Roesch, creator of the open-source Snort intrusion-prevention system. Sourcefire's commercial Snort-based technology later became the basis of Cisco's Firepower product line. Talos has continued to maintain Snort and the ClamAV antivirus engine, while expanding beyond signature development into large-scale threat hunting, vulnerability disclosure, malware analysis, adversary tracking, and incident response. The organization is known for research into high-impact campaigns and vulnerabilities. Its public work has included analysis of the Nyetya or NotPetya destructive malware outbreak, the VPNFilter router malware, the Olympic Destroyer attack associated with the 2018 Winter Olympics, exploitation of the Windows PrintNightmare vulnerability, the BlackCat ransomware ecosystem, and later router malware such as Cyclops Blink. Talos has frequently emphasized technical evidence and has sometimes declined to make confident attribution when available evidence was inconclusive. Talos also operates Cisco Talos Incident Response, a service created through a 2019 partnership between Cisco's Security Incident Response Services group and Talos. The team provides preparation, detection, investigation, containment, and recovery support. It has participated in incident-readiness work and was recognized by IDC in its 2021 worldwide incident-readiness services assessment. In 2022, it was added to Germany's Federal Office for Information Security list of approved advanced-persistent-threat response providers. The group has a substantial public-interest and critical-infrastructure role. It helped establish the Cyber Threat Alliance in 2014, promoting intelligence sharing among security companies. During Russia's 2022 invasion of Ukraine, Talos supported protection of Ukrainian networks, developed country-specific safeguards, and reported on wipers, spam campaigns, and other attacks. Cisco and Talos later contributed to work intended to protect Ukraine's electrical infrastructure from GPS interference by adapting industrial networking equipment with more resilient timing components. Talos also supports cybersecurity for selected major sporting events, including Super Bowls and other NFL events. Its current scope therefore spans open-source security technology, commercial product intelligence, vulnerability research, managed and incident-response services, and collaborative defense against global cyber threats.

Cisco Talos traces its technical roots to Sourcefire, the security company founded in 2007 by Martin Roesch, creator of the Snort intrusion-prevention system. Sourcefire developed commercial products around Snort, including the Sourcefire 3D System, which later became part of Cisco's Firepower network-security line. The company also maintained security-research capabilities and open-source technologies such as Snort and ClamAV. Cisco announced in July 2013 that it had reached a definitive agreement to acquire Sourcefire for $2.7 billion. Following the acquisition, Cisco consolidated the Sourcefire Vulnerability Research Team, Cisco's Threat Research, Analysis, and Communications team, and the Security Applications group. This reorganization produced Cisco Talos in August 2014. The new organization combined vulnerability discovery, malware analysis, threat intelligence, detection engineering, and public research under a single identity. Talos became a major intelligence and research component of Cisco's security business rather than a separately incorporated company. In the same year, Talos helped establish the Cyber Threat Alliance, a nonprofit collaboration designed to encourage intelligence sharing among cybersecurity companies. The alliance's model reflected Talos's broader approach: threats affecting one vendor's customers can often be detected and disrupted more effectively when indicators, behavioral information, and technical analysis are shared across the industry. Over time, the alliance grew to include numerous security companies, including major network and endpoint-security providers. Talos's public profile increased through investigations of large and consequential attacks. In 2017, its researchers analyzed Nyetya, also called NotPetya, which initially appeared to be a ransomware incident linked to an update mechanism in Ukrainian tax software. Talos was among the research organizations that concluded the operation was primarily destructive rather than a conventional extortion campaign. In 2018, Talos worked with the FBI to disclose VPNFilter, a router malware campaign that had infected large numbers of networking devices in many countries. The malware included a destructive capability that could make affected devices unusable. U.S. authorities subsequently took steps to disrupt the associated infrastructure and advised users of affected devices to reset them. Talos also investigated Olympic Destroyer, the attack that disrupted systems supporting the 2018 Winter Olympics in South Korea. The incident affected the official Olympic website, ticket-related services, and stadium connectivity. While public commentary attributed the operation to particular state actors, Talos highlighted uncertainty in the available evidence and avoided presenting an overconfident conclusion. This episode illustrated the group's emphasis on technical attribution standards as well as malware detection. The organization broadened its service capabilities in 2019 when Cisco's Security Incident Response Services group partnered with Talos to form Cisco Talos Incident Response. Talos IR added preparation, investigation, containment, and recovery services to Talos's existing research and product-support activities. IDC later identified the group as a leader in its 2021 assessment of worldwide incident-readiness services, and Germany's Federal Office for Information Security included it on an approved advanced-persistent-threat response-provider list in 2022. In January 2021, Talos released Snort 3, a new generation intended to improve usability while preserving Snort's role as an open-source intrusion-detection and intrusion-prevention technology. Talos continued vulnerability research across operating systems, applications, industrial-control systems, and Internet-of-Things devices, reporting and coordinating remediation for hundreds of vulnerabilities over time. The Russian invasion of Ukraine in 2022 expanded Talos's role in active network defense. Cisco stated that Talos directly operated security products around the clock for critical Ukrainian customers, used intelligence from a large Cisco workforce, and produced protections tailored to threats observed in the country. Talos reported on wipers, spam operations, router threats, and other campaigns associated with the conflict. In 2023, Cisco and Talos helped launch the Network Resilience Coalition after the JaguarTooth campaign highlighted the risks posed by unpatched networking equipment. Talos has also supported the cybersecurity of major NFL events and contributed to efforts protecting Ukraine's energy infrastructure from GPS interference. Today, it operates within Cisco Secure as a global research, intelligence, product-protection, and incident-response organization.

• 2023

  Network Resilience Coalition launches

  [1]Cisco Talosen.wikipedia.org

  Cisco and Talos helped launch an industry effort promoting timely updates and stronger resilience in network infrastructure.

• 2022

  Ukraine network-defense work expands

  [1]Cisco Talosen.wikipedia.org

  Talos provided continuous protection and country-specific intelligence during the war in Ukraine.

• 2021

  Snort 3 launches

  [1]Cisco Talosen.wikipedia.org

  Talos released Snort 3 as a more approachable generation of its open-source intrusion-prevention technology.

• 2019

  Talos Incident Response is established

  [1]Cisco Talosen.wikipedia.org

  Cisco joined its incident-response services with Talos capabilities to create Cisco Talos Incident Response.

• 2018

  VPNFilter disclosure

  [1]Cisco Talosen.wikipedia.org

  Talos and the FBI disclosed a widespread router-malware campaign with a destructive capability.

• 2017

  Nyetya research

  [1]Cisco Talosen.wikipedia.org

  Talos analyzed the destructive nature and Ukrainian focus of the Nyetya or NotPetya malware outbreak.

• 2014

  Cisco Talos is formed

  [1]Cisco Talosen.wikipedia.org

  Cisco combined Sourcefire and Cisco research and security-application teams to create Talos.

• 2014

  Cyber Threat Alliance is co-founded

  [1]Cisco Talosen.wikipedia.org

  Talos helped establish the Cyber Threat Alliance to facilitate sharing of threat intelligence among cybersecurity organizations.

• 2013

  Cisco agrees to acquire Sourcefire

  [1]Cisco Talosen.wikipedia.org

  Cisco announced a $2.7 billion definitive agreement to acquire Sourcefire.

• 2007

  Sourcefire is founded

  [1]Cisco Talosen.wikipedia.org

  Martin Roesch founded Sourcefire, building a commercial security business around Snort and developing the research capabilities that later contributed to Talos.

A research-led cybersecurity organization that turns large-scale threat intelligence and vulnerability analysis into protections for Cisco security products while sharing actionable findings with the broader security community.

• Threat intelligence and research · 2014

  Talos Intelligence

  Talos Intelligence is the research and intelligence function through which Talos tracks malware, vulnerabilities, threat actors, campaigns, and emerging attack techniques. Its findings support Cisco security products and are also published for security practitioners, vendors, governments, and the wider research community.

• Open-source intrusion detection and prevention · 1998

  Snort

  Snort is an open-source network intrusion-detection and intrusion-prevention technology originating with Sourcefire and created by Martin Roesch. Talos maintains its rules and development within Cisco's security portfolio. Snort 3, released in 2021, was designed to improve usability and support modern security-deployment requirements.

• Open-source antivirus engine

  ClamAV

  ClamAV is an open-source antivirus engine maintained within Cisco's security ecosystem and supported by Talos intelligence. It is used to identify malicious files and contributes to email and malware-protection workflows.

• Incident-response services · 2019

  Cisco Talos Incident Response

  Cisco Talos Incident Response provides preparation, investigation, containment, and recovery services for organizations responding to cyber incidents. It combines Talos's threat research and detection expertise with Cisco's security incident-response capabilities.

• 2023Network Resilience Coalition

  Global

  Cisco and Talos helped launch an industry coalition encouraging organizations to update network infrastructure and improve resilience against campaigns such as JaguarTooth.

  Outcome. The initiative framed timely patching and infrastructure upgrades as a shared industry-defense priority.

  Source
• 2022Ukraine network defense

  Ukraine

  Talos operated protections for critical Ukrainian customers, developed Ukraine-specific defenses, and tracked cyber operations during Russia's invasion.

  Outcome. The work supported defensive monitoring and protection of networks facing wipers, spam campaigns, router malware, and other attacks.

  Source
• 2021NFL event cybersecurity

  United States · International NFL markets

  Talos supported Cisco's cybersecurity partnership with the NFL, including protection for Super Bowls and international games.

  Outcome. The partnership extended Talos's operational role into large-scale sports-event security.

  Source
• 2018Olympic cybersecurity support

  South Korea · International sporting events

  Talos investigated the Olympic Destroyer attack affecting the Pyeongchang Winter Olympics and subsequently worked on cybersecurity for other Olympic events.

  Outcome. The investigation documented disruption while cautioning that public attribution to a specific actor was not sufficiently established.

  Source
• 2014Cyber Threat Alliance

  Global

  Talos helped co-found an industry collaboration focused on sharing cyber-threat intelligence among participating security companies.

  Outcome. The alliance developed into a broad information-sharing organization with more than 40 members reported by 2022.

  Source

• 2021

  Release Snort 3Generation change

  Background

  The Snort platform needed a more accessible modern generation while retaining its role in network intrusion detection and prevention.

  Action taken

  Talos launched Snort 3 with a focus on improved ease of use.

  Aftermath

  Snort remained an active open-source component of Cisco's security technology and research ecosystem.

  Source

• 2019

  Integrate incident response with Talos researchStrategy

  Background

  Cisco wanted to connect its incident-response services with Talos's threat intelligence and investigation capabilities.

  Action taken

  Cisco's Security Incident Response Services group partnered with Talos to establish Cisco Talos Incident Response.

  Aftermath

  Talos expanded from research and product intelligence into formal incident-readiness and response services.

  Source

• 2014

  Consolidate Cisco and Sourcefire research teamsStrategy

  Background

  Cisco had acquired Sourcefire and needed to combine overlapping threat-research, vulnerability-research, and security-application capabilities.

  Action taken

  Cisco formed Talos by combining the Sourcefire Vulnerability Research Team with Cisco's threat-research and security-application groups.

  Aftermath

  Talos became Cisco's central public-facing threat-intelligence and security-research organization.

  Source

• 2013

  Acquire SourcefireM&A

  Background

  Cisco sought to expand its security portfolio through Sourcefire's Snort technology, threat research, and vulnerability expertise.

  Action taken

  Cisco announced a definitive agreement to acquire Sourcefire for $2.7 billion.

  Aftermath

  Sourcefire's technology and research teams became important predecessors to Cisco Talos, while its commercial Snort technology contributed to the Firepower product line.

  Acquisition value. $2.7 billion (2013 announced transaction)

  Source

1. 1Cisco Talosen.wikipedia.org
2. 2Cisco Talos official websitetalosintelligence.com