From the field to the report and back again: How incident responders can use the Year in Review
Every year, Cisco Talos publishes Year in Review, a comprehensive look at the previous year’s threat landscape. It’s drawn from an enormous volume of telemetry, such as endpoint detections, network traffic, email data, and boots-on-the-ground Cisco Talos Incident Response (Talos IR) engagements.
As incident responders, we see threats mid-detonation in the wreckage of an Active Directory environment, or in the lateral movement artifacts left behind by an affiliate who got in using nothing more than a valid account. The Year in Review distills those raw observations into structured intelligence, but that intelligence loop works both ways. The same report that our IR casework feeds into is the report that defenders should be feeding back into their own preparation cycles.
IR casework shapes the Year in Review, the Year in Review shapes your readiness
When Talos IR closes out an engagement with customers, the tactics, techniques, and procedures (TTPs) we observe through forensic work and analysis are catalogued, aggregated, and analyzed alongside broader Cisco telemetry. When we track the emergence of a new exploit like React2Shell redefining attacker speed, or when we see Qilin rise to dominate the ransomware landscape while legacy groups like others maintain rare, sustained momentum, those shifts in the adversary ecosystem become the intelligence that informs what we are on the lookout for during the next investigation. When we observe patterns of behavior, they may form trend lines that span multiple years and reveal how the landscape is evolving.
For defenders, this means the Year in Review is not a theoretical document. It is a distillation of what actually happened to organizations we respond to, investigated by the people who were in the room when things broke down. Here are some suggestions on how to operationalize these findings.
Turning findings into tabletop scenarios
One of the most immediate and practical applications of Year in Review is raw material for tabletop exercises. The report hands you the adversary playbook. For example, the 2024 Year in Review highlighted that identity-based attacks accounted for 60% of all Talos IR cases, with Active Directory being the focal point in 44% of those incidents. Attackers were not breaking down doors with zero-days; rather, they were walking through the front door with stolen credentials, often bypassing multi-factor authentication (MFA) through push fatigue, misconfigured policies, or the simple fact that MFA was never fully enrolled in the first place for some accounts.
The 2025 Year in Review reinforces and deepens this picture. Attacks against MFA evolved significantly, with MFA spray attacks doubling down on identity and access management (IAM) infrastructure while expanding efforts against high-value privileged accounts. Device compromise attacks saw a significant rise in activity, showing that actors increasingly value reliable, repeatable access methods over one-off exploitation. These are adversary preferences that should directly shape your exercise scenariosand cybersecurity preparedness.
That is a ready-made tabletop scenario. Work with your team on this exact entry scenario and walk through it just as adversary would. An adversary authenticates to your VPN. MFA fires, but the user approves the push because they were already expecting a login prompt. The attacker is now inside your perimeter with legitimate access. What does your detection look like? How quickly do your analysts identify the anomaly? Who makes the call to force a password reset and revoke sessions? These are some good questions to cover in this scenario. The 2025 Year in Review found that actors tailor their MFA attack style depending on the sector, and that manufacturing was the most impacted sector for ransomware in 2025, underscoring persistent risk to repeatedly targeted industries. If you operate in manufacturing, health care, or another sector that has appeared consistently in ransomware targeting data, your tabletop should reflect the specific TTPs directed at your vertical — not a generic ransomware exercise. These are just some ideas to get started on scenarios.
Validate your detections against real-world tradecraft
Beyond tabletops, the Year in Review provides a prioritized list of what to test your detections against. Year after year, Talos IR engagements reveal a consistent core of adversary tradecraft that organizations are still struggling to detect. Tools like PowerShell and Mimikatz appear in a significant portion of engagements. Remote services such as RDP and SSH continue to be abused for lateral movement. Ransomware operators are increasingly disabling security solutions before deploying payloads, and in 2024, they succeeded in doing so at an alarming rate.
The 2025 Year in Review adds critical nuance to detection priorities through its vulnerability analysis. The top 10 most targeted vulnerabilities tell a story about what attackers reach for. React2Shell redefined attacker speed and targeting, compressing the window between disclosure and exploitation. ToolShell’s quick rise to the top five highlighted the sheer volume and impact of attacks exploiting development tool vulnerabilities.
For defenders, this is a checklist. Can your endpoint detection and response (EDR) detect and alert on the disabling of its own agent? Do you have detections for credential dumping from LSASS or web shell deployment? What about a scenario where direct exploitation takes place, but no web shell is deployed? Are you monitoring for anomalous Remote Desktop Protocol (RDP) sessions originating from unexpected source hosts? The Year in Review tells you what the adversary is actually doing, not what they might hypothetically do. That distinction is critical when you are prioritizing detection engineering across your organization.
Map these findings to the MITRE ATT&CK framework, which the Talos Quarterly IR Trend Reports and the Year in Review already reference, and you have a structured way to assess your coverage gaps. If valid account abuse is the dominant initial access technique and your detections are heavily weighted toward exploit-based intrusions, you have a mismatch between your defensive posture and the actual threat landscape.
Stress-test your IR plan, not just your tooling
The Year in Review also reveals patterns in where organizations struggle that go beyond technology. Across multiple years of IR engagements, common security weaknesses keep surfacing: incomplete asset inventories, inconsistent logging, missing or misconfigured MFA, inadequate network segmentation, and unpatched or end-of-life network devices that remain exposed. The 2024 report noted that some of the most targeted network vulnerabilities affected end-of-life devices with no available patches, yet those devices remained in production environments. The 2025 data reinforce this with even sharper clarity: Legacy systems remain highly vulnerable to attack, CVE age distribution data highlights systemic patch delays, and a small number of vulnerabilities in network infrastructure continue to drive outsized risk.
Two additional areas from the 2025 report deserve attention in your planning cycle. First, phishing continues to evolve. Phishing plays a key role in both initial access and post-compromise activity, with business email compromise-style and workflow-based lures remaining the primary theme. Travel and logistics lures surged, while political lures dropped off and IT-themed lures became more prominent. These shifts matter for security awareness training; if your phishing simulations are still heavily weighted toward current-events lures, they may not reflect what your users are encountering.
Second, the AI threat landscape warrants monitoring. The 2025 observations include dedicated coverage of how AI is shaping the threat environment. While the full scope of AI-enabled threats is still emerging, defenders should consider how AI may be lowering the barrier for adversaries in areas like phishing content generation, vulnerability discovery, and social engineering at scale. Your IR plans should be tested, validated, and updated to handle the new security regime we find ourselves in.
Build a year-round preparation cadence
Rather than treating the Year in Review as a one-time read, consider building a recurring preparation cycle around it. When the report drops, review the top-level findings with your security leadership and identify the three or four trends most relevant to your environment. In the quieter early months, run a tabletop exercise built around the most applicable scenario. Through the middle of the year, use Quarterly IR Trend Report data to adjust detection priorities and validate coverage. Before year-end, when threat activity tends to intensify, conduct a focused review of your IR plan.
Cisco Talos Blog – Read More
