Protecting Cisco's front lines with AI-powered Email Threat Defense and Splunk

[ad_1] In at this time’s dynamic risk panorama, securing the digital entrance traces is paramount. At Cisco, with greater than 326 million emails incoming every quarter, we confronted the identical problem many organizations do: the best way to defend towards refined electronic mail threats whereas sustaining consumer productiveness. Our reply was a daring, layered safety method, powered by AI-driven options like Electronic mail Risk Protection and the superior analytics of Splunk. Right here’s how we did it, and what we discovered.

The rising risk panorama Electronic mail: It’s the only main assault vector for safety breaches for companies throughout the globe. In 2023, the FBI reported $2.9 billion of enterprise losses attributed to electronic mail cyberattacks within the US, an alarming improve of over 805% since 2016. Since 2022, electronic mail ransomware incidents are up 18%. These looming threats develop on daily basis and underscore the important want for a strong, multi-layered electronic mail safety technique.

Whereas native electronic mail filters present a baseline stage of safety, they're inadequate in at this time’s complicated risk surroundings. In Cisco IT, we acknowledged this hole and commenced constructing a plan to boost our defenses.

Nonetheless, as we have been crafting a plan, a brand new drawback rose in precedence. Our executives have been pissed off with inboxes stuffed with spam, advertising, and muddle. A fast session with Cisco Talos confirmed our plan, and we got down to improve our front-line electronic mail defenses — and shortly.

Placing our plan into motion We leverage many options throughout Cisco’s safety portfolio to maintain us digitally resilient. However we knew that bringing the items along with the AI-driven capabilities of Cisco Electronic mail Risk Protection and Splunk would give us an unparalleled benefit: deeply built-in, layered defenses that cut back gaps, improve safety of customers and gadgets, and safe entry to functions. Over the previous decade, we have now carried out a layered method to guard our customers on any machine, anyplace they join, leveraging:

Cisco XDR , which acts as a bridge between our safety functions. It unifies our safety insights and correlates knowledge throughout a number of domains. Cisco Safe Malware Analytics , which determines if incoming recordsdata include malware by isolating and opening them on a digital machine, then analyzing system impacts. This powers extra knowledgeable risk detection. Cisco Safe Endpoint , which protects our endpoints by figuring out and blocking recordsdata containing malware, together with details about who could have opened and/or shared these recordsdata. Cisco Safe Endpoint Analytics , which gives endpoint machine visibility, discovering endpoint threats earlier than they’re an issue together with day-zero malware, harmful consumer habits, knowledge exfiltration, and many others. It sees what functions or Software program as a Service (SaaS) are in use, makes use of forensics for incident response, and beneficial properties visibility to machine varieties and working techniques on the community. Cisco Umbrella , which p rovides knowledge and insights about particular domains, enabling us to dam these with poor reputations. Cisco Endpoint Safety Analytics Constructed on Splunk (CESA) with Cisco AnyConnect Community Visibility Module (NVM) , which feeds us wealthy consumer habits knowledge for electronic mail risk investigations. The NVM is the one know-how for cell gadgets that creates IPFIX knowledge (IP Circulation Data Export). It plugs into CESA, which delivers all the required Splunk analytics software program crucial to investigate NVM telemetry.

And in Might 2024, dealing with more and more complicated threats, we deployed Cisco Safe Electronic mail Risk Protection to m itigate threats in actual time. This platform enlists 90+ AI language fashions ( LLM ) detectors to routinely detect electronic mail risk s , then it proactively take s the crucial subsequent step s to guard the enterprise. This innovation saves us hundreds of hours of manually sorting, learn ing , and gauging intent of emails, with plenty of room for human error. As dangerous actors more and more u tilize AI , Electronic mail Risk Protection ranges the taking part in discipline for us.

The Electronic mail Risk Protection influence report gives full visibility into AI-tracked threats, exhibiting developments over time in addition to additional insights and analytics. For Cisco IT, integrating Electronic mail Risk Protection was seamless, taking solely a matter of days. In actual fact, since deployment day, we’ve acquired zero complaints from the enterprise and 0 detrimental influence on our workers’ expertise. With Electronic mail Risk Protection on prime of our current layers of electronic mail safety, worker mailboxes now not should deal with enterprise electronic mail compromise (BEC) the place dangerous actors impersonate trusted sources to steal cash from companies, phishing , or different threats. From malware to advertising spam, we are able to shortly establish and remediate every kind of undesirable mail, and do with it as we see match organizationally, whether or not it’s shifting it to the junk folder or blocking it altogether.

Elevating incident response with Splunk’s superior analytics Even with our entrance traces being well-protected by our sturdy layered defenses, our groups wanted extra to remain forward of dangerous actors. In April 2025, our incident response group built-in Splunk into our operations, giving us entry to a number of the most modern safety developments available on the market.

With Splunk Assault Analyzer , Cisco now permits automated risk evaluation and digital forensics for credential phishing and malware. Its proprietary know-how extracts and analyzes malicious content material hidden in textual content, photographs, macro supply code, web site content material, and extra. This automation considerably improves our group’s operational effectivity, saving analysts’ time and enhancing the power of our group to research complicated phishing threats with larger velocity and accuracy.

Quantifiable influence: Attaining resilience at scale For Cisco, our layered method is constructed to frustrate the attacker, not the consumer. With regards to attackers, we’ve had lots. Throughout a typical quarter, Cisco mailboxes collectively obtain greater than 326 million inbound emails. For us, “one in 1,000,000” isn’t adequate in terms of safety. Our unified portfolio stops threats of their tracks.

Let’s break down the influence of our method over a typical quarter:

41,000,000 (12.57%) emails blocked for having poor IP reputations 23,000,000 (7.05%) emails blocked for DMARC failures (Area-based Message Authentication, Reporting, and Conformance) 6,800,000 emails blocked for spam 49,000 emails blocked for having poor area reputations 1,940 emails blocked for holding viruses 840 emails blocked for holding malware 70,000 further emails confirmed threats blocked by Electronic mail Risk Protection’s LLM detectors 1000's extra emails blocked for different numerous causes

This stage of visibility, integration, and automation is unmatched out there. While you’re coping with various customers, workplaces, and a mixture of managed and unmanaged gadgets, there’s no different to a layered complete, platform-based method. Our technique successfully closes gaps within the assault floor to make our techniques as well-defended as attainable.

For IT and safety groups our journey gives important classes:

A layered protection is non-negotiable: Counting on single-point options is inadequate. A complete, built-in portfolio is important. AI is a drive multiplier: AI-driven options like Cisco Safe Electronic mail Risk Protection considerably improve risk detection and cut back handbook overhead, even leveling the taking part in discipline towards AI-powered assaults. Automation and analytics are key to effectivity: Options like Splunk Assault Analyzer automate important processes, releasing up useful safety group assets and enhancing incident response. Integration is paramount: The true energy comes from seamlessly connecting safety instruments, guaranteeing knowledge correlation and unified insights throughout your surroundings.

Trying forward: Persevering with to construct a future-proofed office We’re not performed constructing but. Cisco’s integration of AI, Splunk, and electronic mail safety represents a paradigm shift in how organizations can method safety and office innovation. By combining cutting-edge know-how with a unified imaginative and prescient for a way they'll work extra successfully collectively, we’re not solely defending our entrance traces but in addition setting a brand new commonplace for resilience and adaptableness within the fashionable office. We’re bringing know-how collectively to realize issues which have by no means been attainable earlier than.

Constructing on this basis, our incident response group is within the early levels of deploying Splunk Enterprise Safety as a part of our evolving electronic mail safety technique. Whereas this integration continues to be in progress, it displays our ongoing dedication to strengthening detection, investigation, and response capabilities throughout our surroundings. As we proceed to discover and develop sensible use instances, we anticipate that Splunk Enterprise Safety will develop into a key element in our total method to figuring out and mitigating email-based threats — additional future-proofing our safety posture for what’s forward.

Because the risk panorama evolves, so does Cisco. Taking these learnings, we push ahead, persevering with to innovate, combine, and strengthen our defenses to guard what issues most.