Cisco Talos IR Engineer Describes Faster, AI-Driven Breach Response
A Cisco Talos incident response engineer says AI agents are speeding up attacker activity and that Cisco is integrating detection and response into fewer consoles.
The story in focus
A principal engineer on Cisco Talos Incident Response described how the team coordinates incident commanders, forensic specialists and threat intelligence staff during breaches, and said AI agents are accelerating adversary activity, shortening the time attackers need to compromise organizations.
- The incident response practice spans incident commanders, forensic and incident response specialists, project managers and practice leads, working 24/7 across time zones.
- Kramarz said AI agents operate continuously searching for vulnerable systems, adding speed to initial compromise and lateral movement.
- Cisco is integrating products including XDR, Splunk, its firewall and Cisco IQ into fewer consoles with automated threat intelligence.
How the response team is organized
Cisco Talos Incident Response, part of Cisco Talos Intelligence, brings together incident commanders, forensic and incident response specialists, project managers and practice leads, according to principal engineer Yuri Kramarz. Incident commanders lead engagements, while forensic specialists examine logs, customer consoles, disk images, memory images and network records.
Kramarz, based in Qatar, said the team is available around the clock and spans time zones, allowing coverage across regions. The team also draws on Cisco's threat intelligence group for engagements and runs tabletop exercises with customers to prepare them for real incidents.
Containment and attacker speed
In the first hours of an incident, customers typically want to contain their environment, which can mean cutting internet access, resetting passwords at scale or migrating live systems from backups, Kramarz said. Some incidents turn out to be false alarms within minutes of a scoping call, while others require deeper investigation.
Kramarz said AI is adding speed to adversary operations. He said tasks that once took a couple of weeks could take less time, and that AI agents can search for vulnerable systems continuously, a change from attackers who previously had to pause. He also pointed to more sophisticated phishing across email, social media, communication platforms and voice.
Cisco's integration plans
Kramarz described Cisco's product strategy as integrating security tools into fewer consoles so products can share data and correlate threats. He cited Splunk's Agentic SOC working with security orchestration, automation and response to analyze logs and trigger actions such as isolation, plus automatic threat intelligence from Talos feeding Cisco products.
He said Cisco XDR, Splunk and Cisco Firewall are beginning to interoperate, and that Cisco IQ includes agents that identify attacks, vulnerabilities and patching needs. Looking ahead, he said frontier and open-source models will develop rapidly over the next six to twelve months, and that smaller models could later run attacks from ordinary laptops.
What did the Cisco Talos engineer say about AI's effect on breach response?
Kramarz said AI agents are adding speed to adversary activity, allowing continuous searching for vulnerable systems, while Cisco is using AI agents and integrated products to detect attacks and prioritize patching.
Sources & further reading
- On the front lines of a breach with Cisco Talos Incident Response ↗newsroom.cisco.com
Help keep the record accurate. Send a correction.
