New research from some of my Talos colleagues. How do threat actors prompt their LLMs? Sounds like the setup of a dad joke, but finding the answer yields valuable insights.

Cisco Talos Intelligence Group@talosintelligence.com · yesterday

Some threat actors really need to learn how to prompt. Talos recovered attacker prompts logs and another AI artifacts to learn how they bypass guardrails, build and scale capabilities, and automate workflows. While amusing, some made sophisticated outputs: cs.co/63329BEAg9c

Just to put this into perspective, this would be about $11.97 when adjusted for the US median household income of about $84000 (US Census Bureau, 2024). For that money, you or I could buy a couple of Frappucinos. Musk can buy a country.

Robert Reich@rbreich.bsky.social · 5d ago

Elon Musk is planning to spend at least $100 million to help Republicans in this year’s midterms. That’s just 0.014 percent of his current $702 billion net worth. Oligarchs can rig the system at the expense of everyone else, and only spend pennies doing so. We must get Big Money out of politics.

Movie pitch: a Terminator reboot, but the difference is Cyberdyne Systems publishes a humblebrag press release about how Skynet broke containment.

EvidenceForge v1.13.0 is out this morning. If you're generating long scenarios with millions of network flows, you're going to need the fixes. github.com/Cisco-Talos/...

GitHub - Cisco-Talos/EvidenceForge: Generate realistic synthetic security logs for cybersecurity threat hunting training and research

Generate realistic synthetic security logs for cybersecurity threat hunting training and research - Cisco-Talos/EvidenceForge

github.com

I even use my middle initial for disambiguation. 😀

Joe Slowik@pylos.co · 2w ago

I stand by my decision.

Neat work from my previous team. New open weight #SLM Antares optimized not for #vulnerability discovery à la #Mythos but for vuln *localization* (find instances of a known vuln in your code) which is what orgs really need. The 3B param model is on par with GPT-5.5. blogs.cisco.com/ai/introduci...

Introducing Antares: Highly Efficient Open Weight AI Models for Vulnerability Localization

Today, Cisco is introducing Antares, a family of security small language models (SLMs) purpose-built for one of the hardest, most time-consuming and expensive problems in security: pinpointing where…

blogs.cisco.com

HuggingFace got hacked by an AI. What stuck out to me was the guardrail asymmetry. The attacker had no constraints, but HF's response ran afoul of the abuse guardrails, forcing them into an unplanned switch to local models. Another aspect for your IR plans. huggingface.co/blog/securit...

Nothing drives views like a post saying how wrong you were.

Cisco Talos Intelligence Group@talosintelligence.com · 3w ago

David Bianco argues with his past self as he explores how defenders can thoughtfully integrate AI into threat hunting without losing the essential human reasoning that defines the work: cs.co/63328BEkSwG

For years, I've been very clear: "You can't automate threat hunting. It is an essentially human process." Now I'm not so sure. Read why I've reconsidered my stance in my latest post: "The Hunter's Paradox: Is it time to embrace automated threat hunting?" blog.talosintelligence.com/the-hunters-...

The Hunter's Paradox: Is it time to embrace automated threat hunting?

Humans can no longer keep up with the volume and velocity of security data on their own, but AI can't be fully trusted. David discusses the merits of both and muses on what the future might look like.

blog.talosintelligence.com

In a recent study, those who actively planned, monitored, and critiqued their thinking (aka higher metacognitive skills) used LLMs more effectively and produced more creative work. Thinking about thinking has never mattered more.

My local Nextdoor is apparently very worried about Russian interference in the 2026 US elections. The good news is that there is very little chance of that happening. The bad news is that the reason the Russians won't interfere is because we're doing a good enough job of it all by ourselves.

Some recent(ish) updates to CFPlease.io: - Shareable links to CFPs and events - Submit your own events to the queue (moderation req'd) - A public API for searching and filtering Looking for a place to present your cybersecurity research, or just a cool conference to attend? Give it a try!

Look, I don't know the truth. All I'm saying is that delaying a Mitch McConnell announcement until the August 3rd deadline would be a fitting tribute to his legacy.

EvidenceForge v1.10.0 brings major updates: - Far more realistic, configurable email activity. Also produces .eml files as artifacts. - Configs can be split into modular, reusable components, making it easy to define a consistent org/environment across scenarios. github.com/Cisco-Talos/...

GitHub - Cisco-Talos/EvidenceForge: Generate realistic synthetic security logs for cybersecurity threat hunting training and research

Generate realistic synthetic security logs for cybersecurity threat hunting training and research - Cisco-Talos/EvidenceForge

github.com

If you haven't yet checked out #EvidenceForge, now is a great time. There have been big improvements in functionality, realism, and performance since the initial release. Create synthetic, correlated logs for training, testing, and more. github.com/Cisco-Talos/...

GitHub - Cisco-Talos/EvidenceForge: Generate realistic synthetic security logs for cybersecurity threat hunting training and research

Generate realistic synthetic security logs for cybersecurity threat hunting training and research - Cisco-Talos/EvidenceForge

github.com

Finding security CFPs and events scattered across the web is a pain, so I built something to fix it. CFPlease.io crawls the web for upcoming CFPs and events, so you can search and filter by topic, format, or geography. A free service for the security community. cfplease.io #infosec #cybersecurity

The video for my Antisysphon #ThreatHunting Summit keynote is now up. "The Hunter's Paradox: Is it Time to Embrace Automated Threat Hunting?" www.youtube.com/live/GLgF-GO...

*Is* it time to embrace automated #ThreatHunting? Maybe, maybe not. You'll have to come (virtually) to my free talk tomorrow to find out!

Antisyphon Training - Powered by BHIS@antisyphontraining.bsky.social · 2mo ago

Can automation improve threat hunting or just speed up noise? Join David Bianco at the Threat Hunting Summit on June 17, 2026, 10:00–10:50 AM ET. Register here: events.zoom.us/ev/AkZQPl5kU...

I'm David, and I also approve this message.

Brian Tyler Cohen@briantylercohen.bsky.social · 2mo ago

Bob Odenkirk is a national treasure. Take 44 seconds and watch. www.youtube.com/watch?v=z0rB...

Have they tried using '/goal' yet?

CNN@cnn.com · 2mo ago

AI models are rapidly improving – so fast that they may soon be able to develop themselves without human involvement. That’s why Anthropic is warning the AI industry: It needs to build a “brake pedal,” or companies risk losing control of their creations: https://cnn.it/4dQC0f1

I did a podcast talking about my newest open source project, EvidenceForge. Realistic synthetic log data turned out to be a lot more interesting of a project than I expected.

Cisco Talos Intelligence Group@talosintelligence.com · 2mo ago

Stop testing against hollow and anonymized logs. In the latest Talos Takes, David Bianco explains how EvidenceForge, a new open-source tool, generates the realistic, causal telemetry your team has been missing: cs.co/63323B8mmwz

That CFP. That blog post. That workshop. That idea. Hit submit. Some of the best opportunities in my career started with putting myself out there before I felt ready. 🔥 New @thorcollective.bsky.social Dispatch: You've Got This. Just Hit Submit. dispatch.thorcollective.com/p/youve-got-...

Saw #1776 at our local community theater last night. One of my favorite musicals, and this was a banger. Wok up this morning ready to vote for Independency!

If you think you have a "supply chain", you're wrong. What you actually have is a "supply web". Changing your mental model can help you gauge supply web risks more accurately.

At some point, America is going to have to decide exactly how much of this Dear Leader BS we're willing to put up with. Apparently, it's a lot.

Forbes@forbes.com · 2mo ago

Printing currency with a living person’s face on it is not currently authorized by U.S. law and must be approved by Congress.

Called it. bsky.app/profile/poli...

David J. Bianco@davidjbianco.bsky.social · 3mo ago

100% state tax on J6 fund payouts. Make it happen!

I released a new tool for creating synthetic security logs from a simulated network. Not just a random log generator, more of a log simulator. Coherent, correlated, realistic. AI helps create the scenario, a Python script generates the data. Blog post: blog.talosintelligence.com/introducing-...

Introducing EvidenceForge: Synthetic security logs that don’t look (as) fake

EvidenceForge generates high-quality, realistic, and consistent datasets across multiple log formats, enabling teams to effectively train personnel and validate detection models without the need for…

blog.talosintelligence.com

100% state tax on J6 fund payouts. Make it happen!

If AI driven attacks become more prevalent, it'll only be a matter of time before attackers push the token burden on to their victims, using the AI that's already (probably) there. I'm calling it "living off the lAInd".* *Jokey name. Probably will happen, though.

"Threat hunting is human-driven" and "AI threats require AI speed". How do you fit both of those into your threat hunting program? Well, I have some thoughts. Join me as I kick off the @antisyphontraining.bsky.social Threat Hunting Summit, a free virtual event on June 17th!