Why It's Okay to Be Underwhelmed by Cisco ETA by Oliver Tavakoli

This piece critiques Cisco’s “Encrypted Traffic Analytics” (ETA), which applies machine learning to TLS handshake and flow metadata to detect malware, arguing it can be easily evaded by attackers who standardize crypto, improve certificate hygiene, and randomize traffic. It warns of a costly cat-and-mouse retraining cycle tied to switch upgrades and contrasts ETA with behavior-based detections (e.g., Vectra’s external remote access model) that remain effective regardless of specific tools or encryption.