The Register recently reported on a dispute between a US law firm and a UK AI software company that reads like every IT manager's nightmare wearing a legal coat. The firm alleges its AI-powered telco system suffered frequent issues and simply did not work as promised. When it tried to walk away, it was hit with an unwanted auto-renewal. The vendor, in a parallel case, is suing for non-payment.
Strip away the attorneys and the invoices, and this is the most familiar story in IT operations: a tool was purchased on the strength of a demo, it underdelivered in production, and nobody on the customer side had independent, ongoing visibility to prove it. By the time frustration peaked, the only options left were keep paying or litigate.
If you have ever inherited a contract for a platform nobody on your team trusts, you already know how this movie ends.
The Problem in Depth: You Can't Dispute What You Can't See
You're grading the vendor's homework with the vendor's answer key. When the phone system drops calls mid-deposition, who do you call? The vendor. What does the vendor show you? Their own console, reporting everything green. If your only window into a critical system is that system's own dashboard, you have no independent evidence. You have their word — and their word is attached to a renewal invoice.
Siloed tooling kills correlation. The PBX vendor says "our side is fine, it's your network." The network team says "the port is up." The helpdesk has 40 tickets from angry attorneys, but those tickets live in Zendesk while network data lives in a standalone monitoring console, and nothing connects the two. Every incident becomes a three-way blame standoff resolved by whoever shouts loudest on the bridge call.
Your topology map is a museum piece. Discovery ran last quarter. The Visio diagram is from 2019. Nobody has traced the switch fabric since the last office move. When a link flaps between the core switch and the session border controller, the first person to notice is a user holding a dead phone.
There's no evidence trail when contracts come due. Auto-renewal clauses typically fire 30–90 days before expiry. If you can't produce availability data showing the system missed its SLA — actual timestamps, actual outage windows — you are negotiating with "we feel like it doesn't work" against their "our records show 99.9% uptime." Guess which argument holds up in a renewal meeting, let alone a courtroom.
And the costs compound: hours of triage per incident, war rooms with three vendors finger-pointing, techs burning out on tickets they cannot resolve because the data they need lives in someone else's tool, and budget bleeding out on a platform nobody trusts but nobody can prove is failing.
How AlertMonitor Changes the Equation
Continuous discovery, not quarterly snapshots. AlertMonitor continuously discovers and maps every device on the network — switches, firewalls, access points, printers, IP cameras, and unmanaged endpoints — using SNMP, ARP, and active scanning. When a new device appears, you know. When a device vanishes, you know. Your inventory reflects the network as it is right now, not as it was during the last audit.
A live topology map. When a switch goes offline, a link drops, or a new endpoint appears, an alert fires instantly with full network context. Your team stops relying on stale Visio diagrams and quarterly scans and works from a map that shows the real network state — the state you will need when a vendor claims their appliance "never went down."
Evidence you own, not evidence the vendor grades. AlertMonitor's alert history and availability reporting are your records. When renewal season arrives, you export the exact outage windows, the flapping uplink, the packet loss on the segment feeding the phone system. That is a negotiation built on data instead of feelings.
Context that ends the blame game in minutes. If the phone system fails, the topology map shows in seconds whether the path to it is healthy. Clean network? You have proof, and the vendor owns their problem. Degraded link? You found it before their support line finished the hold music.
One platform instead of five tabs. Monitoring, RMM, helpdesk, patch management, and topology live in the same product. The 40 tickets from users who could not make calls correlate directly to the network event that caused them. MTTR drops because triage starts with a complete picture, not with archaeology across disconnected consoles.
The old way: user reports dropped calls → helpdesk ticket → call the vendor → vendor blames your network → your team pings a laptop and shrugs → vendor emails "no issue found" → repeat next Tuesday.
With AlertMonitor: alert fires with the exact device and link → tech confirms the upstream path on the live map in 90 seconds → ticket auto-linked with evidence → escalation call conducted with timestamps, not anecdotes.
Practical Steps You Can Take Today
1. Run your own discovery and compare it against the vendor's device list. If their inventory of "managed devices" does not match what is actually on your network, that is your first conversation. A quick sweep:
# Sweep a subnet to see what is actually alive right now
$subnet = "10.10.20"
$live = foreach ($i in 1..254) {
$ip = "$subnet.$i"
if (Test-Connection -ComputerName $ip -Count 1 -Quiet) {
[PSCustomObject]@{ IP = $ip; Seen = (Get-Date) }
}
}
$live | Export-Csv "C:\Reports\live-hosts-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "$($live.Count) live hosts found. Compare this with your vendor's inventory."
2. Verify SNMP reachability on every device your monitoring depends on. Discovery is only as good as its data sources. If SNMP is not answering, you are blind and do not know it:
# Check that the SNMP service is running on critical servers
Get-Content "C:\Reports\critical-servers.txt" | ForEach-Object {
$svc = Get-Service -Name "SNMP" -ComputerName $_ -ErrorAction SilentlyContinue
[PSCustomObject]@{
Server = $_
SNMP = if ($svc) { $svc.Status.ToString() } else { "NotInstalled" }
}
} | Export-Csv "C:\Reports\snmp-status.csv" -NoTypeInformation
3. Build your own evidence log for vendor-managed appliances. A five-line script on cron gives you a timestamped, independent record of reachability — the difference between "it felt unreliable" and "here are 340 documented failures this quarter":
#!/bin/bash
# evidence-probe.sh — run every 5 minutes via cron
LOG="/var/log/vendor-evidence/probe.log"
mkdir -p "$(dirname "$LOG")"
TS=$(date '+%Y-%m-%d %H:%M:%S')
TARGETS=("pbx.client.local" "sbc.client.local" "core-sw01.client.local")
for t in "${TARGETS[@]}"; do
if ping -c 2 -W 2 "$t" &> /dev/null; then
echo "$TS OK $t" >> "$LOG"
else
echo "$TS FAIL $t" >> "$LOG"
fi
done
4. Put every renewal date in your own calendar with a 90-day lead. Not the vendor's renewal team — yours. If a tool is not earning its keep by day 275 of the contract year, start documenting why, with data instead of vibes.
5. Make the live map the first stop in every incident. Before the bridge call, before the vendor ticket, check the topology. Thirty seconds on a current map answers the question that otherwise burns the first 45 minutes of every multi-vendor outage: is it us, or is it them?
The Bottom Line
The law firm in this story is fighting in court over a question that should have been answerable with a dashboard: did the system actually work? When your visibility is owned by the vendor you are evaluating, you never get a neutral answer. AlertMonitor gives you your own continuously discovered, live-mapped, alert-driven view of the network — so the next contract conversation happens on your evidence, not their invoice.
Related Resources
AlertMonitor Network Monitoring & Visibility AlertMonitor Platform Overview Book a Demo Network Monitoring & Visibility Resources
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.