In one embodiment, a method includes establishing a first virtual talk group (VTG) that includes a plurality of endpoints and has a first multicast address. The plurality of endpoints includes a first endpoint and a second endpoint. The method also includes monitoring traffic associated with the first VTG, determining when a denial of service (DOS) attack is indicated by the traffic, and identifying at least one rogue endpoint responsible for the DOS attack when it is determined that the DOS attack is indicated. The first endpoint and the second endpoint are notified that they are to participate in a dynamic switchover to a second VTG when a DOS attack is indicated. The second VTG is established using a second multicast address, and includes the first endpoint and the second endpoint, but not the rogue endpoint.