Stop running security in passive mode
Summary: Cisco Talos reports that its incident response engagements most commonly find the right security technology was deployed and detected the activity, but the product was not running in blocking mode, so the adversary still compromised the organization. Talos notes that adversaries including state-sponsored groups and ransomware affiliates still need to run commands and execute tooling, and those actions are commonly detected but not blocked.
What you should know: Talos frames the cost directly: organizations spend in some cases millions of dollars on security technology only to get an alert at 3 a.m. while no one is watching and the adversary is exfiltrating data. The alternative it poses is occasional false-positive headaches versus a breach, with ransom or extortion payments potentially reaching millions.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026