Preview: Cisco Talos at Black Hat USA 2026
Cisco Talos will be at Black Hat USA 2026, showcasing research and demonstrations focused on AI-driven security challenges and threat hunting. They'll cover topics like AI-powered threat actor prompting, securing enterprise environments with AI agents, and leveraging AI to identify sophisticated adversary behavior within security operations centers. The core message is that Talos intelligence is deeply integrated across the Cisco security portfolio, not a standalone product.
Cisco Talos will be at Black Hat USA 2026, presenting a range of sessions and demonstrations centered around the evolving landscape of AI and cybersecurity. The event will take place within the Cisco and Splunk booths (2633).
During the conference, Talos researchers will deliver lightning talks on various topics, including how threat actors are increasingly utilizing AI-powered prompts, agents, and tools to enhance their efficiency, and exploring the complexities surrounding Warlock ransomware – a group that doesn’t neatly fit into traditional RaaS or state-linked labels. Additionally, a Main Stage keynote, featuring Cisco’s David Dalling and Rick Miles, will address the security challenges posed by the growing prevalence of AI agents within enterprise environments.
Talos will also host a workshop titled "When AI finds vulnerabilities faster than humans can patch," led by Nick Biasini and Cisco’s Omar Santos. This hands-on session will demonstrate how to integrate AI into security operations center (SOC) workflows, specifically utilizing Foundry Security Spec and Project CodeGuard to convert autonomous testing findings into reusable secure-coding rules. Another workshop, "When agents become insider threats," led by Splunk, will illustrate how AI agents can be leveraged to conduct sophisticated attacks, such as moving sensitive data across tools and distributing brute-force attempts under delegated authority, all without triggering traditional SIEM or UEBA alerts.
The overarching message is that Talos intelligence is not a standalone product, but is deeply embedded across the Cisco security portfolio, continually benefiting from Talos’ threat research and intelligence.