Cisco Talos Intelligence Group

Cisco uses AI tools built into its Talos threat intelligence organization to automatically detect and block email-based attacks including phishing, business email compromise, and brand impersonation, by analyzing traffic patterns and anomalies across Cisco's global telemetry data.

Cisco Talos Email Threat Prevention uses AI tools to analyze traffic trends and anomalies in Cisco's telemetry database to detect attackers mimicking trusted brands or targeting employees with tailored phishing attempts. Talos also uses AI for DNS security, including Domain Generation Algorithm (DGA) analysis that proactively identifies and predicts malicious domains before they impact users. According to Cisco's official Talos product page, these AI tools power automated detections across Cisco Secure Firewall, Cisco Secure Endpoint, Cisco Secure Email, and Splunk. Cisco states Talos blocks more than 400 million malicious URLs per month.