UWillC

Network security + automation.
CVE triage · vendor-severity skepticism · where AI fits in NetOps.
26 years in IT. Free tools below ↓

[UWillC @uwillc]

Source of truth first. Deterministic guardrails. The agent reasons, executes inside your boundaries. The winners of the next two years know which config the agent should never touch.

What is the one task you would never hand an agent?

[UWillC @uwillc]

Generating 10,000 lines of code with AI is a vanity metric. Ivan Pepelnjak said the quiet part out loud.

[UWillC @uwillc]

John Capobianco of Itential said it cleanest: LLMs are probabilistic and infrastructure is not. A probabilistic model improvising on a network with no source of truth is not automation. It is a faster outage.

[UWillC @uwillc]

AgenticOps has a $9B order book behind it. The question is no longer whether AI runs your network, but what you let it run unattended.

What is the first change you would trust an agent to make, and the first you never will?

[UWillC @uwillc]

Cisco posted record AI orders and cut nearly 4,000 jobs. The same quarter.

[UWillC @uwillc]

Cisco raised its AI infrastructure order target to $9B, up from $5B. And cut under 4,000 roles. Record demand for AI networking, fewer people to run it. That is the trade.

[UWillC @uwillc]

GreyNoise: across 104 scanning surges, 68 preceded a vendor CVE. Median lead 11 days. A surge is a weather forecast, not noise.

Are scanning surges in your patch-prioritization signal yet?

[UWillC @uwillc]

Your IP blocklist is 98% blind.
Here is the date and the number.

[UWillC @uwillc]

May 12: roughly 597,000 scanning sessions against SonicWall management interfaces in one day, about 46x normal. SonicWall was 72% of enterprise VPN-targeted activity that week.

[UWillC @uwillc]

AIOps was a dashboard. Agentic NetOps is an actor in your control plane. The value moved from writing the change to building the guardrails the agent runs inside. I build audit-grade tools around exactly this. In my profile.

[UWillC @uwillc]

The NSA just published a security playbook for your AI agents.

Not a vendor.
The National Security Agency.

[UWillC @uwillc]

Every MCP-connected agent is a new identity making privileged calls, most authenticating weakly or not at all.

NSA fix: filtering proxy, signed messages with replay protection, just-in-time credentials.

[UWillC @uwillc]

Patch: PAN-OS 12.1.4-h6, 12.1.7, 11.2.12, 11.1.15, 10.2.18-h6. Prisma Access vulnerable to 11.2.7-h13. Then hunt identity logs for forged cookies.

When did you last audit which features share a certificate?

[UWillC @uwillc]

A reused certificate just turned your VPN into an open door. CVE-2026-0257, actively exploited.

[UWillC @uwillc]

Rapid7 saw exploitation start May 17, second wave May 21. CISA KEV May 29, federal deadline June 1.

Root cause CWE-565: cookies without integrity checking.