AnalysisPublished 28 Apr 2026

Five defender priorities from the Talos Year in Review

Source Cisco Talos

Description

The Cisco Talos 2025 Year in Review highlights evolving attacker tactics emphasizing rapid exploitation, identity-based attacks, and persistent legacy vulnerabilities. Attackers increasingly abuse valid credentials, MFA workflows, and trusted systems to move laterally and evade detection. The report stresses prioritizing identity infrastructure protection, focusing on vulnerabilities with high exposure, addressing legacy embedded risks, securing critical management systems, and detecting anomalous behavior patterns despite automation and AI-driven attacks. While attackers move faster and leverage AI, their behavior still produces detectable anomalies distinct from normal users. Defenders are advised to focus on practical, prioritized controls and monitoring to detect and mitigate these threats effectively.

Impact

Attackers increasingly rely on credential abuse, MFA exploitation, and trusted access paths to compromise environments, enabling lateral movement and persistence. Rapid exploitation of newly disclosed vulnerabilities and continued exploitation of old, high-value vulnerabilities increase risk exposure. Legacy and embedded vulnerabilities in EOL systems create persistent blind spots. Compromise of network management and control-plane systems can provide attackers with broad operational control. AI-driven automation accelerates attack lifecycles but does not eliminate detectable anomalous behavior. These factors collectively increase the complexity and speed of attacks, challenging defenders to prioritize and focus on high-impact controls and detection strategies.

Defensive guidance

The vendor advisory does not indicate that the threat is already mitigated or that no action is required. Recommended mitigations include treating identity infrastructure as critical assets with strong monitoring and protection, securing MFA device registration with strict verification, enforcing rate limiting and anomaly detection on authentication systems, and building behavioral baselines for user activity. Prioritize patching vulnerabilities based on external exposure and access impact, reduce time-to-patch for internet-facing systems, and continuously reassess reachable attack surfaces. Improve visibility into legacy and embedded components, isolate or retire legacy systems, and secure management-plane and control-plane systems with enhanced monitoring and access controls. Focus detection on anomalous patterns rather than isolated alerts, reduce alert fatigue by prioritizing meaningful detections, and support investigation with automation alongside human analysis.

Summary

This report from Cisco Talos summarizes key defender priorities based on observed attacker behaviors in 2025. Attackers exploit valid credentials and MFA weaknesses, rapidly weaponize new vulnerabilities, and continue to leverage long-standing legacy vulnerabilities. Critical systems like identity and access management, network infrastructure, and management platforms are frequent targets. The report emphasizes the importance of establishing baselines for normal user behavior to detect anomalies, prioritizing patching based on exposure rather than just CVSS scores, improving visibility into embedded legacy components, and securing systems that broker trust. Despite automation and AI accelerating attacks, attackers still generate detectable patterns of unusual activity that defenders can leverage for detection and response.

References

blog.talosintelligence.com/five-defender-priorities-from-the-talos-year-in-review/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 May 2026, 20:29 UTC

References

Community reviews