Talos Intelligence

Talos Intelligence
Name	Talos Intelligence
Type	Cybersecurity research group
Founded	2006
Parent	Cisco Systems
Headquarters	San Jose, California
Key people	Markable

Talos Intelligence Talos Intelligence is a cybersecurity research and threat intelligence group within Cisco Systems that focuses on vulnerability research, incident response, and threat discovery. The group interacts with organizations such as Microsoft, Google, Amazon (company), Apple Inc., and collaborates with entities including National Security Agency, Federal Bureau of Investigation, Europol, and INTERPOL. Talos publishes advisories and tools that affect products from vendors like Adobe Inc., Oracle Corporation, Red Hat, VMware, and Fortinet.

Overview

Talos Intelligence provides threat detection signatures, vulnerability disclosure coordination, and defensive guidance that influence platforms including Windows NT, Linux, Android (operating system), iOS, and macOS. The team’s outputs integrate with Cisco product lines such as Cisco IOS, Cisco ASA, and Cisco Secure Firewall, and inform standards bodies like Internet Engineering Task Force, International Organization for Standardization, and National Institute of Standards and Technology. Talos analysts regularly publish reports that are cited by publications including The New York Times, Wired (magazine), The Guardian, The Wall Street Journal, and Reuters.

History and Development

Talos originated from research groups that preceded the formation of Cisco’s security efforts and expanded following acquisitions by Cisco such as Sourcefire and integrations with technologies from Snort, ClamAV, and OpenSSL. Its timeline intersects with events like the disclosure of Stuxnet, Heartbleed, WannaCry, NotPetya, and SolarWinds hack, where Talos contributions paralleled work by teams at Kaspersky Lab, Symantec, CrowdStrike, Palo Alto Networks, and FireEye. Leadership and personnel movements have involved individuals with backgrounds at institutions such as MIT, Stanford University, Carnegie Mellon University, SANS Institute, and collaborations with labs like CERT Coordination Center and Fraunhofer Society.

Services and Capabilities

Talos delivers services including malware analysis, intrusion detection, incident response, threat hunting, and signature development that operate alongside platforms like Snort, Suricata, Zeek (software), and Bro (software). Capabilities encompass exploit development analysis, reverse engineering of binaries for vendors such as Intel, AMD, NVIDIA, and coordination for patching with projects like Chromium (web browser), Mozilla Firefox, and KDE. Talos teams provide intelligence feeds consumed by security operations centers using technologies from Splunk, Elastic NV, IBM Security, and Microsoft Sentinel.

Research and Threat Intelligence

Talos conducts research into advanced persistent threats associated with actors tied to regions referenced in analyses by United States Department of Defense, United Kingdom Secretary of State for Defence, NATO, and academic partners at University of California, Berkeley, University of Oxford, and ETH Zurich. Research outputs have examined campaigns linked to groups monitored alongside reporting by Mandiant, Recorded Future, ESET, Trend Micro, and AhnLab. Talos publishes technical blogs and whitepapers that reference standards from Common Vulnerabilities and Exposures and coordinate disclosures with entities including CERT-EU and Japan Computer Emergency Response Team. The team’s telemetry and indicators of compromise are used in joint investigations with Department of Homeland Security, Australian Signals Directorate, and Canadian Centre for Cyber Security.

Partnerships and Industry Impact

Talos maintains partnerships with technology vendors, academic institutions, and international law enforcement to improve ecosystem resilience; counterparts include Cisco Umbrella, Cisco Talos Incident Response integrations with Amazon Web Services, Microsoft Azure, Google Cloud Platform, and collaborations with universities such as Georgia Institute of Technology and University of Maryland. Its intelligence has influenced procurement and policy discussions at forums like G20 summit, Black Hat, DEF CON, RSA Conference, and contributed to policy debates in legislatures including the United States Congress and European Parliament. Talos contributions have also shaped product hardening practices at firms such as HP Inc., Dell Technologies, and Lenovo.

Controversies and Criticism

Talos has faced scrutiny typical of large vendor-affiliated research teams, drawing critique in media reports alongside debates involving Edward Snowden disclosures, discussions by organizations like Electronic Frontier Foundation, and academic critiques from researchers at Princeton University and Harvard University. Critics have raised questions about disclosure timelines compared with independent firms such as Project Zero (Google), policy coordination with agencies like National Cyber Security Centre (United Kingdom), and potential conflicts of interest when advising customers including U.S. Department of Defense or multinational corporations like Siemens and General Electric. Debates have also paralleled controversies involving attribution methodology similar to those discussed in analyses by RAND Corporation and commentary in outlets like The Atlantic.

Category:Cybersecurity organizations