Cisco Advanced Malware Protection

Cisco Systems, founded in 1984 and headquartered in San Jose, has grown into a global networking and telecommunications leader, supported by over 71,000 employees across more than 80 countries and inclusion in major market indexes. Beyond core networking hardware, Cisco has expanded through acquisitions and product development into areas such as VoIP, wireless, cloud, and information security, with major acquired assets like WebEx becoming billion-dollar business units. In security, Cisco offers a broad portfolio spanning firewalls, network security, web/email/cloud security, identity and access control, and advanced malware protection, strengthened by acquisitions including Sourcefire and Threat Grid.

As cyberattacks become more persistent and multi-vector, and the traditional perimeter model erodes, the emphasis of security has shifted from primarily preventing intrusions to continuously monitoring environments to quickly uncover, analyze, contain, and remediate threats. Traditional signature-based tools and classic intrusion detection are described as insufficient against sophisticated attacks that may remain hidden for months. SIEM platforms, while widely adopted, are portrayed as increasingly ineffective due to alert overload and false positives, even when staffed by dedicated teams. A newer generation of security analytics tools applies big data techniques to correlate signals across sources, detect anomalies in real time, and automate analyst workflows.

Cisco Advanced Malware Protection (AMP) addresses this shift by combining preventive controls with continuous monitoring and correlation across multiple “control points” (endpoints, network, cloud, email, web gateways, data centers, and virtual environments). AMP tracks files throughout their lifecycle, generates context-rich alerts when malicious behavior emerges, and enables response actions such as quarantine and network-level containment. Its effectiveness is reinforced by integrations with Cisco Talos threat intelligence and Threat Grid analysis, while a unified browser-based console and shared ecosystem across deployments aim to reduce alert volume and prioritize incidents via risk scoring. Despite strong coverage and deployment flexibility, AMP is characterized as not fully meeting the breadth and extensibility of a true security analytics platform, with cost and centralized administration limitations noted.

• Cisco Systems, Inc. is headquartered in San Jose, California, USA.
• Cisco was founded in 1984 by pioneers of the multi-protocol network router concept.
• Cisco’s stock is part of the Dow Jones market index and is included in the S&P 500 and NASDAQ-100 indexes.
• Cisco has over 71,000 employees in more than 80 countries.
• Cisco’s Security unit portfolio includes firewalls, network security, web/email/cloud security, identity and access control, and advanced malware protection.
• Cisco AMP is positioned to watch every file through its lifecycle, from entry into the network to signs of malicious behavior.
• Cisco Talos analyzes over 100 TB of data, including 1.5 million malware samples daily.
• Threat Grid analyzes millions of malware samples each month against over 700 behavioral indicators.
• Each sample submitted to AMP Threat Grid is analyzed against over 450 behavioral indicators and assigned a risk score.
• Cisco acquired Threat Grid in 2014.

• “As cyber-attacks are becoming increasingly advanced and persistent, and the very notion of a security perimeter has almost completely disappeared, organizations have to rethink their cybersecurity strategies.”
• “Traditional security tools, such as signature-based anti-malware products or intrusion detection systems are no longer able to reliably protect from sophisticated attacks…”
• “Even a large dedicated team of experts operating a SIEM-powered security operations center is eventually overwhelmed by a sheer number of (possibly false) alerts…”
• “The focus of modern security solutions has gradually shifted from perimeter protection towards monitoring corporate networks to uncover malicious activities as quickly as possible…”
• “AMP is able to identify an attack as an ongoing event, not a large set of individual alerts.”
• “Thus, the number of alerts can be significantly reduced, and these alerts are prioritized by risk scores and enriched with historical and contextual data…”
• “With all the context data, it is possible not just to identify a malware, but also its method and point of entry, as well as the systems affected by it.”
• “Cisco Advanced Malware Protection is a hybrid solution that combines a number of ‘traditional’ preventive security technologies…with continuous monitoring and correlation…”
• “Still, we cannot consider Cisco AMP a full-featured security intelligence platform, given its relatively narrow focus on malware detection…”
• “To be as efficient as possible, a security infrastructure must cover as many attack vectors as possible.”