TCG074: From SOAR to Agents: Why Practical Automation Has to Survive Contact with Real Infrastructure

The episode features host William, co-host Yvonne, and guest Sif, a long-time infrastructure and automation practitioner who has worked at Infoblox and a SOAR vendor called Swimlane, among others. The conversation opens with nostalgia around early network automation tools, particularly Net MRI, which Sif used at DirecTV to change 30,000 interface descriptions in a single night and later to discover rogue printer devices causing broadcast storms across 19 manufacturing plants. These stories frame the core argument that automation has always been about solving real operational problems at scale, not just replacing manual labor.

The group addresses the fear engineers have around AI replacing jobs, arguing consistently that automation has historically elevated engineers to higher-order work rather than eliminating roles. Sif notes that he has never automated himself out of a job despite decades of automation work. William extends this by arguing that the most valuable engineers are those who identify problems and independently solve them in ways that benefit the business, and that AI creates new roles around governance, prompt engineering, and data science rather than simply eliminating existing ones.

A significant portion of the conversation focuses on the gap between polished vendor demos and the messy reality of brownfield infrastructure. Sif acknowledges that AI and automation solutions work well roughly 90-95% of the time, but real environments always have snowflake systems requiring custom handling. Yvonne argues that customers who actively help vendors understand this gap have outsized influence on product direction, often more than vendors' internal teams, because builders and operators have fundamentally different perspectives.

The discussion shifts to DNS as an underappreciated security surface. Sif describes how DNS logs can quickly answer forensic questions that security teams spend days investigating through other means, and how DNS exfiltration was a known attack vector long before most organizations thought to monitor it. He highlights Infoblox's IETF draft proposal to use DNSSEC-signed records to publish MCP server locations, allowing LLMs to securely discover and connect to vendor AI services through trusted DNS infrastructure rather than through unknown third-party MCP servers.

Yvonne raises the challenge of dependency mapping in multi-cloud environments, noting that the early excitement around cloud was largely a greenfield effect, and that as environments matured into multi-cloud complexity, understanding service interdependencies — including identity systems, DNS, and networking — has become nearly impossible. She warns that AI risks becoming a technical debt accelerator, citing the Jurassic Park principle of being so focused on what can be built that teams skip asking whether it should be built. The group agrees that standard workflow automation is still the right tool for many problems that are being reflexively framed as AI problems, and that the AI SOC as a black box concept is being sold faster than organizations can evaluate whether it actually addresses their specific risks.