Cisco has switched on latent features in its recent routers and switches, plus a cloud service, that together make it possible to detect the fingerprints of malware in encrypted traffic. Those devices can't do the job alone: users need to sign up for Cisco's StealthWatch service and let traffic from their kit flow to a cloud-based analytics service that inspects traffic and uses self-improving machine learning algorithms to spot dodgy traffic. Some of the techniques used to spot malware's activities aren't super-sophisticated: Cisco looks at unencrypted handshake packets for known dodgy destinations, searches for things like self-signed certificates and other signs of either sloppiness or slippery intentions. The cloud service does the heavier lifting, with over 400 'classifiers' hunting for signs of malware at work. To make the magic happen, Cisco users have to send metadata - parsed NetFlow data - to Switchzilla's cloud. By doing so, they'll get the ETA service and help it to improve by feeding it more data for its algorithms to consume and learn from. The new tool has applications beyond defence, as it can also detect the encryption applied to traffic. That's a useful function for organisations that must encrypt traffic to stay on the right side of industry or government regulations. Cisco has therefore geared up to sell ETA as a compliance tool as well as a malware-spotter.