From federal SOCs to Talos: Ryan Fetterman on practical security research
Summary: Ryan Fetterman, a security researcher with about 15 years in the field, described his path from consulting and federal agency security operations in the DC area to Splunk's SURGe research team and then into Talos after Cisco's acquisition of Splunk. He cited his first APT incident, tracked by the Pandora Song command-and-control name, as a formative moment while he was writing host-based analytics in Splunk in a federal SOC.
What's compelling: Fetterman's account of detection engineering is one of attackers continually evolving tactics to stay ahead of traditional defenses, which means the analytics a SOC builds are always chasing a moving target.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026