In the first tense moments of a security breach, response time is critical. Organizations need to know exactly what is happening and where, while taking precise actions to limit and isolate the damage. That’s where the Cisco Talos Incident Response (CTIR) team shines. Combining the most sophisticated technology with broad human analysis and expertise, it can mean the difference between disaster and quick recovery.
To learn more, we spoke with Yuri Kramarz, principal engineer for CTIR.
Kramarz, who is based in Qatar, described the high-pressure, intricately coordinated response to a security incident, the unique capabilities of his team, and how Cisco innovations counter an increasingly complex AI-powered threat landscape.
Thank you, Yuri! You are on the front lines in the first moments of a serious breach. What drew you into a high-pressure environment like incident response?
Thank you for having me, Kevin. And you said it well. The high pressure is actually what's great about this line of work. There are no two days alike in the world of incident response. And I enjoy the speed — incident response is one of the fastest paced services offered by Cisco. We have to be ready, on the front lines, to respond to cybersecurity incidents and get out precise, forensic reports to our customers efficiently. The variety, speed, and complexity add to the excitement.
Tell us about a typical incident, especially the first hours when so much is at stake.
Well, each incident is different. We get some incidents where it might be a false alarm — and it’s easy to find out within five minutes of our scoping call. Others take some digging. We might have to check logs, disk and memory images, to try to identify what transpired and how the adversaries moved through the network and achieved their objectives. Of course, as we do that, the customers want to contain their environment. That can mean shutting down things like internet access, doing mass password resets, or migrating live systems from backups. An effort at that scale takes a lot of coordination, know-how, and dedication between Cisco teams and customer teams or even third parties.
Speaking of that coordination, could you share a bit about your team?
Our incident response practice is an arm of Cisco Talos Intelligence, effectively consisting of incident commanders, forensic and incident response specialists, project managers, and practice leads. We all come together quickly to help our customers 24/7 across the globe. What helps us to act quickly is the split responsibilities between different team members. Incident commanders lead the engagements from start to end, forensic experts deep dive into logs, customer consoles, disk, memory and network records. We coordinate with project management teams, and with our service leads as well. And we bring in our threat intelligence team (Talos Threat Intelligence) to all our engagements. Together, we assist our customers during some of the worst days of their careers and help them to contain, detect, and prevent adversary activities in their environments.
That’s a very diverse team. And as you said, a LOT of coordination.
Yes, a lot of our work is making sure that everybody gets the right information, so we can make the right decisions at the time of the incident. As a team, we bring the whole of the Cisco Talos organization to help us respond. That diversity is our strength. And some of our incidents require global response. Our team spans time zones, so we are available 24/7, 365 days a year for our customers. Being here in Qatar allows me to work really well between EMEA and APJC time zones.
Your region has its unique challenges.
Yes, it’s a very dynamic region, although not that different then my previous home in the UK. Adversaries work across border, across function, and across organizations. The virtual borders don’t really exist on the Internet, so the threats are similar whether in EMEA and APJC regions, for example.
I’m assuming a whole lot of prep work goes into responses.
Indeed, our team is very well versed in incident handling, so when an incident happens everybody knows exactly what they are doing and how we run response. We follow various standards, but with a twist of practical experience. On top of that, we drill with our customers through tabletop exercises, which helps them recognize what a real incident would feel like when it comes knocking. The questions we get during these types of exercises also help us to improve our own processes.
What are you seeing in terms of how attackers are evolving?
Obviously with the advancement of AI, we see a lot of speed added to adversary activities. What used to take a couple of weeks, to breach an organization, will take a shorter amount of time going forward. In the past, adversaries would have to eat and sleep and take breaks. Now there are AI agents working 24/7/365 looking for vulnerable systems. In some of the recent, bigger incidents we’ve seen, agents just kept going until they reached their objective. And once they breach the environment, they start to move around. So, the speed of initial compromise and the lateral movement are changing.
What excites you about Cisco innovation to meet those evolving threats?
The good news is that we are picking up speed as well. As the adversaries get faster, so do our defenses. We have agents effectively doing the first layers of defense. Because it’s very difficult to spot some of those activities. You have terabytes of logs from all different places in your organization, and you need to identify that needle in the haystack. AI agents are getting much better at telling you when there’s an actual attack. It used to be you’d throw a lot of different tools at the problem and not necessarily detect the adversary activity easily.
But Cisco’s offering a really good pipeline of products. There’s Splunk with the Agentic SOC — and the coordination between that and Security Orchestration, Automation, and Response (SOAR), to automatically analyze the logs and trigger activities like isolation. We have automatic threat intelligence from Talos feeding into pretty much every solution offered by Cisco. And we have, of course, the whole Cisco security stack. All of this plugs into solutions like Cisco IQ, which includes agents that will tell you about the attacks, the vulnerabilities, what you need to do, the patching. It adds up to a really strong offer going out into the world.
Cisco’s platform strategy is integrating much of this.
Oh, that's a crucial factor. In the past, you’d look at 20 different consoles or 15 disjointed solutions. But Cisco’s integrating so much of this into one pane of glass. Now, solutions like Cisco XDR, Splunk, Cisco Firewall — there’re all starting to talk to each other. That’s saving a lot of time and allows for cross-product correlation, which makes defenses stronger.
It’s Cybersecurity Month. What advice would you share with business and technology leaders to keep things safe?
Well, if you have patching that you are delaying, now is the time. AI is not going to get tired. AI will be probing across your environments, your networks, and looking for vulnerable endpoints and systems. So, patching is more critical than ever; don’t delay it.
On the defense side, AI can help with the patching.
Yes, 100 percent. AI can detect which systems are vulnerable and need patching. It can help you to prioritize as well. Combine this with vulnerability scanning and security auditing and you get a list of prioritized systems to fix before they become a serious problem. I would encourage everyone to look into Cisco IQ which addresses exactly these types of problems faced by organizations.
Humans, at least the unaware ones, are another vulnerable point.
Yes, phishing is more sophisticated than ever, and it’s not just emails. Social media, phishing via communication platforms, voice phishing are all tools in the arsenal of a capable adversary. Bad grammar, strange accents, overseas phone numbers are no longer a giveaway. You can go on the Internet and find voice recording software that would allow you to impersonate anyone’s accent, speech patterns, and voice based on just a one-time recording — and then use these recordings to trick people into opening links, following instructions. So, train your folks to recognize it, and have a system in place to report it and investigate it.
Also, you don't want to have a thousand systems to defend. So where possible, narrow down your environments facing the Internet, map your exposure surface, put anything you can behind VPN, and deploy multi-factor authentication everywhere. These are typical cyber-hygiene recommendations that we encourage every organization to consider. What also helps is a bit of self-reflection (i.e., do we need this server on the Internet, should this application expose administrative interface, when was the last time we patched our publishing system?). When you ask these types of questions, you will often find a few extra systems or applications to secure or even take down.
Some of these are fundamentals, aren’t they?
Absolutely. These days, talking about AI we can think in terms of how difficult it is for autonomous swarms of agents to find the target networks. So, the more tokens adversaries have to spend trying to attack you, the more likely there are to go elsewhere — to find the low-hanging fruits that are just easier to target.
What do see for the future. What keeps you up at night…
I would say the speed of changes that we're going through. In the next six to twelve months, there will be very rapid development both in frontier models as well as open-source models. Over a longer time, adversaries will be able to run smaller models on an average laptop to execute attacks. And the moment that happens, we're likely to see an explosion of cybersecurity incidents. They won’t need specialized hardware similar to what’s currently running in major AI labs. By that time, I hope all the patching and basic cybersecurity are implemented in most organizations.
… and what gives you hope for the future?
What gives me hope is the flip side of that: We, too, are getting models that will be defending much faster and running on smaller hardware. So, we’ll be able to scale them easily to defend, detect, and contain incidents. And we’ll have even more products integrated at Cisco, for a full-stack solution with networking, compute, security, threat intelligence, observability. Cisco is really putting their A-game out there.
