Forest Global Training Partners

Cyber Risks · Cisco Talos

Five defender priorities from the Talos Year in Review

Summary: Cisco Talos reports that proof-of-concept exploit code that once took attackers months to build now takes hours, and that vulnerabilities like React2Shell and ToolShell are exploited immediately after disclosure while Log4Shell remains among the most exploited over four years later. Talos also found that nearly 40% of the top 100 most targeted vulnerabilities affect end-of-life systems and 32% are over a decade old, with attackers favoring VPNs, Active Directory controllers, firewalls, and network management platforms to steal session tokens, bypass MFA, and impersonate users.

Key Takeaway: Nearly 40% of the most targeted vulnerabilities sit on end-of-life systems and 32% are over a decade old, meaning the persistent risks are the ones least inventoried and hardest to remove. Talos's point is that even automated, AI-assisted attacks reuse the same infrastructure and follow predictable sequences, so the anomalies are there to detect if you have a baseline of normal behavior.

Read the original at Cisco Talos ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026