Threat Response Needs New Thinking. Don't Ignore This Key Resource.

### Overview In this keynote address, Cisco leaders Jeetu Patel and Tom Gillis address the disjointed nature of modern cybersecurity defenses, comparing siloed tools to musicians in an orchestra playing in separate rooms unable to hear one another. To overcome sophisticated, multi-stage attacks, Patel outlines two essential breakthroughs defining the next era of threat defense: cross-domain native telemetry and artificial intelligence operating at machine scale.

### Key Topics - **Coordinated Defenses vs. Siloed Tools:** Attackers blend in with legitimate user and application behaviors across multiple stages. Isolated point solutions see less than half the picture and create uncoordinated noise. - **Extended Detection and Response (XDR) vs. SIEM:** While SIEMs focus on log aggregation, summary data, and long-term storage (thinking in days, weeks, or years), XDR operates in near real-time directly in the data path, gathering high-fidelity telemetry across email, web, endpoint, and network to automate intelligent responses. - **The Role of Artificial Intelligence:** Security operations require three pillars to leverage AI effectively: specialized domain models, rich domain-specific telemetry and threat intelligence, and a streamlined natural-language user experience. - **Automated Response and Recovery:** Moving beyond simple blocking, native telemetry enables progressive mitigation (snapshots, packet capture, network isolation) that can reduce ransomware recovery point objectives (RPO) to zero.

### Technical Details - **Attack Anatomy and Telemetry:** Tom Gillis illustrates an attack sequence derived from Turla (a benchmark in the MITRE ATT&CK framework). The attack begins with an AI-crafted phishing email, directs the user to a newly created site, downloads malicious code, and invokes PowerShell to spawn an unknown process that moves laterally to access database records. - **Cisco Ransomware Statistics:** At Cisco, data indicates that 80% of ransomware attacks observed in the prior year originated from a phishing email, and 80% of observed ransomware attacks involved an unknown process spawned out of PowerShell. - **Intelligent Response Chain:** Rather than generating noise early, an integrated system can silently create a system snapshot upon email detection, trigger packet capture when PowerShell runs, isolate the network segment as the threat reaches sensitive databases, and block data exfiltration at the point of theft. - **AI Assistant Concept (AMES):** A demonstration features a SOC analyst named Carmen interacting via natural language with an AI security assistant called AMES. Drawing on the Talos threat database, AMES identifies an ongoing PowerShell-based ransomware infection with 90% confidence, restricts host network access, recommends deploying a honeynet, and restores impacted users using pre-encryption clean snapshots.

### Takeaways To defeat modern threats, organizations must move away from disconnected 'bags of parts' toward unified security platforms that correlate native data across the entire execution path. Combining high-fidelity cross-domain telemetry with domain-specific AI models enables automated threat neutralization, resilient recovery, and natural-language assistance that dramatically shortens SOC investigation and response times.