Satya Nadella just said out loud what a lot of security-minded people have been thinking: treat powerful AI models like potential insiders. Not because they're malicious, but because they can be wrong — or compromised. His proposed safeguard is elegant: separate a model's intelligence from its authority. Keep access controls, permissions, and the ability to shut it down outside the model, in systems you control and can audit.
He's right, and the principle generalizes far beyond AI. Authority — the ability to reach things, move data, affect users — should never be self-attested. It should be bounded, observed, and revocable from the outside. Now the uncomfortable part for anyone who runs IT: you cannot apply that principle to your own network if you don't know what's on it.
Because that's the reality in most shops. AI agents, Copilot deployments, vendor laptops, IP cameras, a consumer access point someone bought on lunch break — new "insiders" appear on the network constantly, and most monitoring tools never notice. The network map is a Visio diagram last touched during the 2023 audit. The device inventory is a spreadsheet. The monitoring tool watches a device list someone manually entered and never revisited.
You can't bound authority you've never seen. You can't revoke access for a device your tools don't know exists. Nadella's rule — control lives outside the thing, grounded in visibility — is impossible to satisfy without a live, complete picture of what's connected and how it's wired.
The Problem in Depth: Your Tools Only Know What You Told Them
Four systems, four partial truths
The typical IT department — and the typical MSP stack — is a patchwork where each tool sees a slice of reality:
- Standalone monitoring (PRTG, SolarWinds, Zabbix, LibreNMS) polls a device list built by hand, often years ago. It monitors what it was told to monitor. A device that was never added doesn't exist as far as alerting is concerned.
- RMM platforms (NinjaOne, ConnectWise RMM, Datto RMM) see only endpoints with agents installed. Great for Windows patch status on managed machines. Completely blind to the unmanaged switch in the closet, the printer on the sales floor, or the camera vendor plugged into an access port last Tuesday.
- Helpdesks (ConnectWise PSA, Zendesk, Freshservice) only know what users report. And users are, in practice, your primary outage detection system — they notice dead Wi-Fi before your monitoring does.
- Documentation — a Visio diagram and an IP spreadsheet — gets trusted during audits and incident response despite being months out of date.
Each tool holds a piece of the truth. None holds all of it, and none of them talk to each other.
Why the gaps exist
- Discovery is a project, not a process. Quarterly scans produce point-in-time snapshots that are stale the day after they run.
- "Managed" is defined as "has an agent." Agent-based tools exclude unmanaged infrastructure by design — which is exactly where the risk lives.
- Alerts fire without topology. "192.168.10.24 is down" tells you nothing about which uplink failed, which VLAN is affected, or which 30 users just lost connectivity.
- Siloed architecture. Monitoring data, ticket history, patch state, and network documentation live in four systems that have never exchanged a single packet of context.
What it actually costs
- Triage eats your MTTR. Industry surveys routinely put network incident MTTR in the 3-5 hour range, and the majority of that time isn't fixing — it's finding. Which switch? Which port? Who's downstream?
- The 2 a.m. page a live map would have prevented. A flapping uplink between two access switches generates a night of "server down" alerts while a tech SSHes from box to box tracing the path manually.
- New devices appear and nobody notices. The contractor's laptop, the shadow AP, the IP camera on VLAN 1 — discovered weeks later during an incident, not before one.
- Audits fail on documentation. Firewall rule reviews, segmentation audits, cyber-insurance questionnaires — they all ask "what's on your network?" and the honest answer is "whatever the last scan caught."
- MSPs multiply all of this by client count. Answering "is it our stack, their firewall, or their ISP?" means five browser tabs and twenty minutes of cross-referencing before diagnosis even begins.
And the AI angle makes this worse, not better. Every Copilot rollout, automation agent, and integration service account the business spins up is a new network actor with reach. If discovery runs quarterly and the map is decorative, the "authority boundary" Nadella is calling for is being enforced against a picture of the network from six months ago.
How AlertMonitor Solves This
Continuous discovery, not quarterly archaeology
AlertMonitor continuously discovers and maps every device on the network — switches, firewalls, access points, printers, IP cameras, unmanaged endpoints — using SNMP, ARP, and active scanning. Not on a schedule you set and forget. Continuously. The day a camera gets plugged into an access port, it's on the map. IT teams stop relying on stale Visio diagrams and quarterly scans and work from a live map that reflects the real network state right now.
A topology map derived from live link state
When a switch goes offline, a link drops, or a new device appears, an alert fires instantly with full network context: which device, which port, which uplink, which VLAN, and what's downstream. The map reflects actual connections, not what someone drew in a diagram two years ago.
The workflow, before and after
Old way — an access switch port dies:
- Users call the helpdesk: "the internet is down in accounting" (8-12 minutes)
- Ticket created; tech opens the monitoring tool and sees "192.168.10.24 down" (4 minutes)
- Tech SSHes to the core, reads the MAC table, traces the path switch by switch (25-40 minutes)
- Fix applied; the diagram never gets updated (ever)
AlertMonitor way:
- Link-down alert fires in seconds with topology context — the affected switch, the dead port, the users and devices downstream
- The alert creates a ticket in the integrated helpdesk with that context already attached
- Tech remediates remotely via RMM or dispatches with the exact port location
- Alert, ticket, action, and resolution live on one timeline — which means one accurate SLA report instead of three systems that disagree
Triage drops from 40+ minutes of forensics to under two minutes of reading. That's not a marginal improvement — that's the difference between meeting the SLA and explaining why you didn't.
One NOC view for MSPs
All client networks in a single dashboard. When Client 7 calls, the tech sees their live topology, current alerts, open tickets, and patch state without leaving the console — instead of keeping 12 tabs open across 5 tools.
Practical Steps You Can Take Today
1. Find out what's actually connected — right now
Before any platform does this continuously for you, take a one-off inventory. From a Windows box on the client VLAN (the -Parallel switch requires PowerShell 7+):
# Sweep a /24 to populate the ARP cache
$octet = "192.168.10"
1..254 | ForEach-Object -Parallel {
$ip = "$using:octet.$_"
if (Test-Connection -ComputerName $ip -Count 1 -Quiet) { $ip }
} -ThrottleLimit 64
# Read back everything that answered
Get-NetNeighbor -State Reachable,Stale |
Where-Object { $_.IPAddress -like "192.168.10.*" -and $_.LinkLayerAddress -ne "00-00-00-00-00-00" } |
Select-Object IPAddress, LinkLayerAddress, State |
Sort-Object IPAddress
Or from a Linux jump host:
# Live hosts on the client subnet, saved for later comparison
nmap -sn 192.168.10.0/24 -oA clientA_discovery_$(date +%F)
2. Compare reality against your "official" inventory
# What did we discover that the inventory spreadsheet doesn't know about?
$discovered = Get-NetNeighbor -State Reachable,Stale |
Where-Object { $_.IPAddress -like "192.168.10.*" -and $_.LinkLayerAddress -ne "00-00-00-00-00-00" } |
Select-Object -ExpandProperty IPAddress
$inventory = Import-Csv "C:\IT\network-inventory.csv" |
Where-Object { $_.IPAddress -like "192.168.10.*" } |
Select-Object -ExpandProperty IPAddress
Compare-Object $discovered $inventory | Where-Object SideIndicator -eq "<=" | Select-Object @{n='UndocumentedIP';e={$_.InputObject}}
Every IP in that output is a device with network authority that your documentation doesn't know exists.
3. Verify your monitoring scope against the switch itself
# Pull live interface status from a switch - does it match what your monitor actually polls?
snmpwalk -v2c -c yourcommunity 192.168.10.2 IF-MIB::ifOperStatus
If the switch shows 24 active ports and your monitoring tool has 15 devices registered, you just found your blind spots.
4. Make new-device events into alerts
"Unknown device appeared on VLAN 10" deserves the same operational priority as a link-down. In AlertMonitor, discovery events and topology changes alert instantly with full context — so the contractor's laptop gets noticed in minutes, not at the next audit.
5. Audit authority boundaries against the live map
This is the Nadella principle applied to infrastructure. Your firewalls, VLANs, segmentation, and access rules are the "controls outside the thing." Review them against what the network looks like today — not the diagram from 2022. Every unmapped device is a control enforced against a fiction.
6. Put AI and automation endpoints in scope
When a department rolls out Copilot, an AI integration, or an automation service account, treat those endpoints like any other asset: known, mapped, watched. The authority stays bounded, and the control stays with you — not with the tool.
The Bottom Line
Nadella's warning is really a visibility warning wearing AI clothing. Intelligence — artificial or human — should never be trusted to enforce its own boundaries. Authority has to live outside, in controls you can see, audit, and revoke. On a network, that starts with one non-negotiable capability: knowing, at all times, what's connected and how it's wired together.
If your honest answer to "what's on your network?" starts with the word "probably," that's the gap to close first.
Related Resources
AlertMonitor Network Monitoring & Visibility AlertMonitor Platform Overview Book a Demo Network Monitoring & Visibility Resources
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.