Talos 2025 Year in Review - Insights for Cyber Defenders

What Happened

In the 2025 Talos Year in Review, Cisco's security leaders discussed the evolving threat landscape. They highlighted a significant trend: attackers are exploiting vulnerabilities faster than ever, particularly through identity-related attacks. The report reveals that 40% of the top 100 exploited vulnerabilities are linked to outdated systems, emphasizing the need for organizations to improve their patch management and visibility.

Identity as the Primary Target

One of the most alarming findings is the 178% increase in fraudulent device registrations. Attackers are targeting administrators through vishing, exploiting their access to register devices on behalf of attackers. This shift indicates that controlling identity is crucial for controlling access across networks. The report stresses that identity management must evolve beyond simple authentication to include continuous monitoring and risk-based access adjustments.

State-Sponsored Activity

The report also noted a rise in state-sponsored cyber activity, particularly from actors linked to China, Russia, and North Korea. Cisco Talos observed a 75% increase in investigations into China-nexus campaigns. These actors are exploiting both zero-day and n-day vulnerabilities while engaging in financially motivated activities. This blurring of motives between state-sponsored and criminal actors complicates the defense landscape.

The Role of AI in Cyber Threats

AI's role in cyber threats is accelerating, as attackers use it to automate and scale traditional attack methods. The report indicates that AI is lowering the barrier for creating convincing phishing attacks and fraudulent websites. Furthermore, the emergence of AI-enabled malware poses new risks, as it can analyze environments and adapt its tactics rapidly. Organizations must implement strict controls over AI deployment to mitigate these risks.

Prioritization for Defenders

To combat these evolving threats, Cisco Talos recommends that defenders focus on three critical areas:

• Strengthening identity controls to prevent unauthorized access.
• Improving visibility across devices to detect abnormal behavior.
• Safeguarding and removing end-of-life infrastructure that attackers exploit.

The Talos Year in Review serves as a vital tool for organizations to prioritize their cybersecurity efforts and adapt to the fast-changing threat landscape. As attackers evolve, so must the strategies and technologies used to defend against them.