Cisco Threat Hunting – Stop Attacks Everywhere

Tony Giandomenico and Ant Ducker of Cisco covered the human side of threat detection and the resilience of the infrastructure underneath it. Giandomenico described a human-led threat hunting service designed to catch campaigns before they reach vendor threat intelligence. Ducker outlined privileged access management, post-quantum resilience, secure boot, and the rollout of Live Protect. The session closed the stop attacks everywhere portion of Cisco Security’s appearance at Security Field Day 16.

Giandomenico, product manager for the threat hunting service, argued that a human element remains essential no matter how much AI is applied to detection. Products must limit false positives, but his hunters can run broad hypotheses that return a thousand hits, triage them with automation, and have investigators review about a hundred a day. Customers are notified only about findings that matter. He said new threat intelligence often takes a day or two to reach products, which leaves attackers a 24-to-48-hour window of unclassified command and control activity that the service aims to catch. Its hunts draw on first-party research, automated OSINT, and data from Cisco’s global incident response work against nation-state and criminal actors. The data sits in large Elasticsearch clusters, and federated searches help control storage costs.

Giandomenico said his team plans to bring Duo and Cisco Identity Intelligence telemetry into hunts early next year, alongside endpoint and firewall data, and to add vendor-neutral sources over time. Ducker then turned to attacks that target infrastructure rather than applications. A privileged access management capability, a couple of months away, will limit user access to a defined change window. Ducker said Cisco can later extend that control to agentic workloads, so even a misbehaving agent stays bound to its maintenance slot. Cisco plans post-quantum resilience across most of its product range by early summer next year, along with secure boot across its data center switches and routers. Live Protect is available now on Nexus smart switches and will extend shortly to SD-WAN and LAN controllers. The rest of Cisco’s infrastructure follows early next year, so critical exploits can be shielded without waiting for a change window.