Cisco Talos published its incident response trends for the third quarter of 2026 on 29 October, written by Aliza Johnson. The headline finding is that attackers impersonated IT help desks on vishing calls, and that is a real technique worth knowing. It is not the number that should change what you do on Monday.

That number is further down. The leading security weakness Talos found across its engagements was "insufficient logging leading to visibility gaps", in over 40 percent of them.

None of the top three is a vulnerability

Behind logging came improper credential and secret management at 33 percent, and missing or insufficient authentication and MFA at 33 percent. Single-factor reliance, legacy authentication left enabled, and MFA not enforced on high-privilege accounts made up that third category. All 3 of the leading weaknesses are configuration rather than code.

There is no CVE to look up for any of them, no vendor advisory to wait for and nothing a scanner will flag, which is precisely why they persist. Talos notes the list closely mirrors last quarter, so this is not a bad run of luck either.

We made the same argument on the 28th, when a 2.7-scored VMware flaw went onto the exploited list because it let an administrator act without being logged. A low score, no code execution, and real enough that it was being used. Talos has now measured the same thing from the other end.

How they are getting in

Phishing remained the leading initial access technique, but its share fell hard: from over 50 percent the previous quarter to 37 percent. Exploitation of public-facing applications came second at 33 percent, which puts the two within a few points of each other.

Ransomware and pre-ransomware incidents were 27 percent of engagements. The maximum across the previous 4 quarters was 20 percent.

The families named are The Gentlemen, Qilin, Rhysida and Interlock, which Talos describes as operating as a closed group, plus an emerging one called VYPR. No per-family shares are given.

The help desk call, and what it is for

The technique is simple to describe and hard to defend. An actor calls a user, says they are from the IT help desk, and talks them into allowing remote access "via a legitimate remote monitoring and management (RMM) tool". In the VYPR engagement the user was walked into starting a Microsoft Quick Assist session.

Nothing there is malware until much later. The remote access tool is one your own administrators probably use.

Once in, ransomware actors predominantly disabled EDR, usually through vulnerable drivers or Windows Defender Application Control. VYPR deployed an unusually large number of vulnerable drivers, which Talos suggests was for redundancy, and took an unusually long time to exfiltrate and encrypt. Talos reads that as experimentation rather than a refined playbook.

Who got hit

The financial industry was 18 percent of engagements, tied with public administration for the most targeted sector, and up from last quarter. Health care fell to third after leading the previous 2 quarters.

Talos notes finance had not been in the top three since 2024. The report does not explain the return.

On the intrusions linked to Salt Typhoon, the finding is one sentence and it matches the weakness list: the environment showed "reliance on password-only authentication without evidence of multi-factor authentication (MFA)".

What to do

  • Check that you log at all in the places an investigation would start, then check how long you keep it. Over 40 percent of these organisations found out during an incident.
  • Enforce MFA on high-privilege accounts specifically, and turn off legacy authentication. Both are named.
  • Decide now what your help desk will never ask for, tell staff, and make the rule survive someone sounding urgent on the phone.
  • Alert on an RMM tool starting where it has no business starting, including Quick Assist. The tool is legitimate; the session is not.
  • Watch for driver loads that precede EDR going quiet, rather than for the ransomware that follows.

What is not established

  • Dwell time. The report does not give one.
  • How often help desk impersonation appeared. Talos says several other engagements and gives no count.
  • The share each ransomware family accounted for.
  • The exact social engineering technique in the VYPR case, which Talos says was not confirmed.
  • Whether VYPR is as immature as it looks. That is an assessment, not a finding.
  • Why finance returned to the top. The report states it and does not reconcile it.
  • Whether this generalises. These are the engagements Talos worked, not a census, and Talos notes its MITRE technique list is not exhaustive.