From the field to the report and back again: How incident responders can use the Year in Review
Summary: Cisco Talos published its annual Year in Review, drawn from endpoint detections, network traffic, email data and Talos Incident Response engagements, and says the 2024 report found identity-based attacks accounted for 60% of all Talos IR cases, with Active Directory the focal point in 44% of those incidents. The 2025 report found MFA spray attacks expanding against IAM infrastructure and privileged accounts, manufacturing the most impacted sector for ransomware, and React2Shell compressing the window between disclosure and exploitation.
Key Takeaway: Talos reports that attackers were not breaking in with zero-days but walking through the front door with stolen credentials, often bypassing MFA through push fatigue, misconfigured policies, or accounts where MFA was never fully enrolled - so a detection portfolio weighted toward exploit-based intrusions is mismatched with how most of these incidents actually started.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026