Cisco is launching an AI-powered DNS defense platform integrated into Cisco Secure Access, backed by Talos threat intelligence. The platform uses machine learning models — including convolutional neural networks and domain generation algorithm (DGA) detection — to proactively identify and block malicious domains before ransomware can execute. It disrupts the ransomware lifecycle at multiple stages: initial access via phishing, C2 channel establishment, lateral movement, and DNS tunneling-based data exfiltration. For SOC analysts, the platform replaces fragmented alert triage with pre-correlated, contextual investigation dashboards, reducing manual log-stitching and enabling campaign-level blocking rather than individual IP blocking.
Table of contents
How Cisco disrupts the ransomware lifecycle (DNS focus)The view from the SOCThe new standard for defense100 Impressions