TNO071: The Network Team Is Drowning. Is AI the Life Raft? (Sponsored)

The episode opens with Scott Robon presenting a stark reality: 49,000 CVEs were published last year, averaging over 130 new vulnerabilities daily, yet network teams haven't grown proportionally. Rekha Shenoy (CEO) and Irfan Kimji (Field CTO) of Backbox explain why this creates a crisis specifically for network infrastructure teams, which face unique challenges compared to traditional endpoint patching.

They highlight that network infrastructure is the most actively compromised component because it's easier to exploit than servers, yet patching network devices is exponentially more complex than deploying patches to Windows or Linux systems. The diversity of vendors, device types, and operating system variants makes standardized patching impossible. They present concrete examples: a large financial institution calculated it would need 23 additional full-time employees just to maintain vulnerability compliance across 23,000 network devices, while another customer was spending $8 million annually on manual configuration changes—two per day on every switch.

The speakers explain that the real work begins when vulnerability reports land on network engineers' desks, requiring them to spend hours rationalizing whether vulnerabilities apply to their environment, identifying workarounds, checking patch versions, and determining mitigation strategies—all before any actual patching occurs. This prevents network engineers from doing strategic work and has led to a "smart intern" approach where AI assists with information gathering and analysis rather than autonomous decision-making.

Regarding traditional tools and automation approaches, they note that many organizations have attempted Python scripting solutions, with one customer requiring 80,000 lines of code to handle device variety—an approach that only works if your team wants to become coders. They position Backbox as offering a low-to-no-code alternative that allows network engineers to build automations using vendor documentation and configuration language they already understand, rather than requiring new programming skills.

A critical theme throughout is responsible AI use. Both speakers emphasize that network engineers fear autonomous self-healing systems that make changes without human verification, as this creates accountability gaps and alert fatigue. Instead, they advocate for AI that provides dispositioned information, accurate cross-vendor vulnerability analysis, and recommended automations that humans must test and approve before deployment. They stress the importance of AI transparency, using trusted sources rather than allowing hallucinations, and focusing on business outcomes rather than AI as a buzzword.

The speakers also discuss the convergence of traditionally opposing viewpoints: those who rejected AI entirely and those demanding full AI implementation both responded positively when the focus shifted from "AI" to "solving your specific operational challenges." They emphasize that multi-team collaboration—security, infrastructure, operations, finance, and business working together—is essential, as attackers target the business holistically, not infrastructure silos.

The episode concludes with optimism about emerging tools that can correlate network flows, security information, and application performance across traditionally siloed systems, potentially enabling more holistic threat detection and response than was previously possible.