What Cisco Talos Intelligence Group does

Cisco Talos Intelligence Group is Cisco's internal threat intelligence research organization, described in company materials as one of the largest private threat intelligence organizations globally. The division provides four primary product lines: an Intelligence Center for web, file, IP, and domain reputation and IPS/IDS detection; vulnerability research and Microsoft advisories; incident response services (reactive emergency response and proactive hunting, compromise assessments, tabletop exercises); and a hypothesis-driven threat hunting service augmented by AI engines that execute hunts across customer telemetry at scale. Talos also publishes open-source security tools, multiple podcasts, a YouTube channel, and the Threat Source newsletter, generating the threat research corpus that powers brand authority.

The underlying technology combines AI/ML with human-analyst validation: autonomous AI agents continuously execute hunt hypotheses across telemetry, analysts provide contextual judgment, and an internal "Talos AI Tiger Team" has published prompt-engineering methods that delivered a 50% reduction in IR report drafting time. Detection methodologies include phone-number clustering for scam email campaigns and detection of threat actors abusing legitimate SaaS notification infrastructure. The technical differentiator is hybrid AI+human architecture applied to one of the largest aggregated telemetry streams available in private industry, sourced from Cisco's global network of security products.

Commercially, Cisco Talos operates within Cisco Systems, Inc. (NASDAQ: CSCO) as a wholly-owned internal division with no separate capitalization or independent revenue disclosure. Revenue accrues via inclusion in Cisco security subscriptions (network intrusion prevention, web filtering, email security, malware detection) and via billable incident response retainers and professional services. The division serves enterprises and government entities globally, with documented research across critical infrastructure, government, healthcare, education, financial services, telecommunications, and technology verticals, and operating geographies spanning North America, South America, Europe, Asia Pacific, the Middle East, and Africa. Go-to-market is enterprise field sales backed by Cisco's global channel and a self-service Intelligence Center portal.

Name

Cisco Talos Intelligence Group

Legal name

Cisco Systems, Inc.

Website

https://talosintelligence.com

Company type

Private

Founded year

2018

Operating status

Operating

Short description

Cisco Talos Intelligence Group is the threat intelligence research division of Cisco Systems, providing AI-augmented threat hunting, vulnerability research, incident response, and reputation/intelligence feeds to global enterprise and government customers, with its intelligence embedded across Cisco's network, email, web, and endpoint security portfolio.

Ownership category

akta.pro rank

Product category

Threat Intelligence Services

akta.pro primary industry

Threat Intelligence Services (BPAEADAC)

akta.pro secondary industries

Vulnerability Intelligence & Exploit Prediction (HDADAHAI), Deception Technology & Threat Hunting (HDADAGAI), Security Operations (SOC), Incident Response & Threat Hunting (EDAOAIAI), Fraud, Cybercrime Investigations & Brand/Dark Web Monitoring (BPAKAHAO), Network Security Managed Services (Firewall/IDS/IPS/SASE) (BPAEADAG)

Keywords

• Threat intelligence services
• Incident response
• Vulnerability research
• Cyber threat hunting
• Malware analysis

Headquarters

HQ city

Fulton

HQ country

United States

HQ region

North America

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Infrastructure, Marketing or Sales

Revenue model

1. Threat Intelligence Integration: Talos intelligence integrates across Cisco's security product portfolio including network intrusion prevention, web filtering, email security, and malware detection. As an internal division, revenue is generated through inclusion in Cisco security subscriptions and contracts rather than standalone pricing.
2. Incident Response Services: Provides emergency incident response and proactive services (threat hunting, compromise assessments, tabletop exercises) as billable professional services. Offered via retainer subscription model for ongoing access.

Pricing tiers

Go-to-market motion1 record

Distribution channels3 records

Marketing channels7 records

Core offering

Cisco Talos Intelligence Group is Cisco's threat intelligence research organization that delivers intelligence-led cybersecurity services and tools. It operates the Intelligence Center (web/file/IP reputation and IPS/IDS detection), publishes vulnerability research and Microsoft advisories, and provides global Incident Response (reactive and proactive) and hypothesis-driven Threat Hunting engagements. Its telemetry and research power the broader Cisco security product portfolio, including network intrusion prevention, web filtering, email security, and malware detection.

Product overview

Cisco Talos Intelligence Group is Cisco's threat intelligence research organization, providing superior protection through comprehensive intelligence capabilities. The portfolio consists of the Intelligence Center (offering web reputation, file reputation, IPS/IDS detection), Vulnerability Research (including vulnerability reports and Microsoft advisories), and Incident Response services (emergency response and proactive security assessments). The ecosystem is supplemented by security resources including open source tools, the Talos Intelligence Blog, Threat Source Newsletter, and multimedia content through the Beers with Talos and Talos Takes podcasts. Threat Hunting represents a proactive add-on service leveraging AI-powered hypothesis-driven methodology.

Differentiator

Problem solved

Functional benefit

Brands

• Talos Intelligence Center: Reputation and categorization system for web, email, file, and IP threat intelligence
• Beers with Talos
• Talos Takes
• Talos Incident Response
• Talos Threat Hunting

Products and services

• Intelligence Center A self-service threat intelligence and reputation platform that provides web reputation, content categorization, sender IP and domain reputation, file reputation, and intrusion prevention system (IPS/IDS) detection for enterprise security teams and integrators.
• Vulnerability Research Comprehensive vulnerability research service producing vulnerability reports and Microsoft security advisories, documenting known exploits and security weaknesses across software and hardware platforms for defenders, vendors, and enterprise security teams.
• Incident Response Global incident response service delivering reactive emergency response and proactive services such as compromise assessments, tabletop exercises, IR plan and playbook development, and intel on demand for enterprise and government customers, available via retainer subscription.
• Threat Hunting Proactive threat hunting service that uses a hypothesis-driven methodology in which AI engines execute hunt hypotheses across customer telemetry at scale and human analysts validate findings, identifying advanced threats that bypass conventional detection tools.

Quantifiable outcome

• Talos AI Tiger Team achieved 50% reduction in total report drafting time while maintaining quality standards through prompt engineering methods for LLM-generated incident response reports.
• +1 more outcomes

Named customers10 records

Segments5 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability2 records

Feature5 records

Scale indicators8 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• CrowdStrike Intelligence: CrowdStrike's threat intelligence team publishes adversary attribution, malware analysis, and operates Falcon Intelligence alongside its endpoint detection platform. It directly competes with Talos for threat intel-driven detection and IR engagements, especially among large enterprises.
• Recorded Future: Recorded Future is a leading pure-play threat intelligence platform, providing IOC feeds, brand monitoring, dark web intelligence, and adversary tracking. Now owned by Mastercard, it competes with the Talos Intelligence Center on standalone threat data and reputation services.
• Mandiant (Google Cloud): Mandiant is one of the most direct comparables to Cisco Talos, offering threat intelligence and incident response services. Acquired by Google Cloud in 2022 for $5.4B, Mandiant competes head-to-head with Talos IR on emergency response, threat hunting, and compromise assessments for enterprise and government customers.
• Palo Alto Networks Unit 42: Unit 42 is Palo Alto Networks' threat intelligence and incident response arm, providing threat research, IR retainers, and proactive hunting services. Like Talos, Unit 42 powers its parent company's security products and competes for the same enterprise and government IR engagements.
• Microsoft DART (Detection and Response Team): Microsoft's DART provides enterprise incident response and proactive hunting services, integrated with Microsoft Defender and Sentinel. As a platform-native competitor with similar intelligence-to-product integration model, it is a direct rival for Talos's IR and threat hunting offerings.

Emerging players

• Secureworks: Secureworks combines managed detection and response with its own threat intelligence research, offering Taegis XDR. It competes with Talos on intelligence-led MDR services and has a comparable focus on proactive threat hunting for enterprise customers.
• Sophos X-Ops: Sophos X-Ops is a unified threat research function spanning SophosLabs, SophosAI, and MDR operations. It competes with Talos on integrated threat intelligence feeding into endpoint/managed detection, though with a stronger mid-market orientation.
• ESET Research: ESET Research publishes threat intelligence reports, APT tracking, and vulnerability discoveries, with comparable depth on malware analysis. While more endpoint-focused than Talos, its research output and open-source contributions make it a thematic peer.
• Kaspersky GReAT: Kaspersky's Global Research and Analysis Team is an elite threat research organization that publishes APT attribution, malware analysis, and vulnerability research comparable to Talos's research output. It serves as a peer on threat intelligence production quality, though its geographic market access is constrained by regulatory restrictions.

Broad incumbents

• Trend Micro Research: Trend Micro Research is a long-established threat intelligence and vulnerability research organization publishing zero-day disclosures, IoC reports, and APT tracking. As a broad incumbent security vendor, Trend Micro competes with Cisco/Talos for enterprise and government security mindshare.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat6 records

Key risks6 records

Key highlights6 records

Customer concentration

• Xx.com/TalosSecurity
• GitHubgithub.com/Cisco-Talos
• YouTubeyoutube.com/channel/UCPZ1DtzQkStYBSG3GTNoyfg/featured
• LinkedInlinkedin.com/company/cisco-talos-intelligence-group

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Cisco Talos Intelligence Group