FireMon CEO Jody Brazil On Why ‘You Can’t Out-Patch’ Attackers In The AI Era
‘Network security is not just a mitigating control. It is the foundational mitigating control,’ Brazil tells CRN.
The acceleration of cyberattacks driven by increasingly powerful AI models is providing a major resurgence in the importance of network security—and creating a massive opportunity for solution providers to help protect their customers against threats that patching can’t address on its own, according to FireMon CEO Jody Brazil.
“You can’t out-patch the threat actors now, and so you need to have other mitigating controls,” Brazil said in an interview with CRN. “Network security is not just a mitigating control. It is the foundational mitigating control.”
With advanced AI now enabling attackers to rapidly exploit vulnerabilities—including previously undiscovered flaws—businesses need to put more focus around controlling what their IT systems can connect to and access, Brazil said.
As a result, there’s no question that the policies governing firewalls and other network security technologies are as critical as ever, he said.
“AI has really elevated the importance of network security—but then as a result, elevated the importance of FireMon, and somewhat revitalized these conversations with our channel partners,” Brazil said.
Brazil—who has deep roots in the channel going back to his role as founding CTO at FishNet Security—said that FireMon has maintained a fully channel-focused approach since the company’s separation from FishNet in 2004.
Brazil co-founded FireMon and served as its CEO for more than a decade before leaving to launch DisruptOps, a cloud security operations startup. He rejoined FireMon as CEO in 2021 after the company acquired DisruptOps.
‘Tremendous Opportunity’
Without a doubt, partners are in a unique position to help customers across the realms of defending against AI threats, securing AI systems and using AI to improve security operations, according to Brazil.
“I think the channel has a tremendous opportunity to bring clarity to customers, and it’s not just about a product,” he said.
FireMon on Tuesday announced the debut of its new Agentic AI platform, which provides agent-driven capabilities for investigation of network access as well as providing recommendations around policy changes.
With the platform, key tasks—such as designing firewall rules based on change requests and cleaning up existing policies—can be dramatically accelerated, Brazil said.
Going forward, “the next stage in the journey for the AI-ready enterprise is agentic AI,” he said.
“How can we move from querying our data or interacting with our data with a chatbot to actually having the AI acting as an agent on our behalf?”
Brazil also discussed the impact of AI vulnerability discovery models such as Anthropic’s Claude Mythos, how partners can help customers to navigate AI security and the challenges of shifting policy changes from human speed to AI speed.
What follows is more of CRN’s interview with Brazil.
How is AI changing the role of network security? And what does that mean for FireMon and its partners?
At a very macro level, not necessarily FireMon-specific, I think the [Claude] Mythos news was a wake-up call from a partner perspective, from a security landscape perspective. But certainly partners as well, it’s really revitalized network security.
Network security is one of the oldest technology solutions in the cybersecurity space—you’ve got vulnerability scanners, network security and authentication. Those would be the holy trinity if you go back to the ‘90s. And I think network security seemed like a solved problem. There were incremental advancements, of course.
But from a channel perspective, I think channel started to feel like their role in network security was degraded. They’re just nothing but a reseller. And if the customers already understand network security, what’s the real value-add that the channel is providing?
Mythos was a true wake-up call. Network security is not just a nice-to-have or a thing you’ve got to do because it’s part of the program. It’s a fundamental part of security for a reason. Mythos changed the perspective—where if you assume every connected system has a vulnerability, and every vulnerability an exploit can be developed within minutes, not months, then you have to assume every connected system is exploitable.
What do you do to solve that problem? Address the connectivity problem. Prevent connections from the threat actors, and you prevent the Mythos attack path. Of course, at a macro level that’s your traditional firewalls. But at a microsegmentation level that’s your [vendors such as] Illumio, Guardicore etc.
But it all comes down to network security. From a FireMon perspective, the conversations we’re having with our channel partners is that network security is not the firewall. It’s enforcement technology, but it only enforces the policy that you apply to that technology. The actual security is implemented from a policy perspective.
That used to, in some cases, feel like a compliance burden—”Oh yeah, we got to check the policy.” Now that the threat is much more urgent, it’s faster, it’s more complex. All of a sudden now you’ve got nation-state capabilities in the pocket of [an inexperienced attacker]. Now policy really becomes the control plane that matters.
How important is the actual firewall then at this point?
You of course have to have the right [firewall] technology. And they have to be deployed in the proper parts of your network. But without an effective policy, you won’t get the intended security. Of course, that’s what FireMon does. We’ve been doing it for 25 years. And so AI has really elevated the importance of network security—but then as a result, elevated the importance of FireMon, and somewhat revitalized these conversations with our channel partners.
Part of the advantage of being around for 25 years is that everybody knows your name. There’s not a channel partner I could walk to that doesn’t know who FireMon is, and probably within a close approximation could say what we do. But the downside of that 25-year history is there’s a [dynamic of], “Oh yeah, those guys, they’ve been around forever. What’s new? What’s different?”
AI has changed that. It’s re-elevated and brought network security policy control to [a] top-of- mind [issue] and a really important conversation to go have with customers. And then just in general, now network security is a hot topic for channel partners to go have conversations with customers—as opposed to simply being a reseller trying to make some slim margin off of your firewall.
How are you using AI to help partners and customers manage their network security policies?
On the control side, what we are doing with AI then is to make security operations more effective, to gain better policy control. Our headline message is really trying to bring policy control to the AI-ready enterprise.
The way we think about that is, everybody’s at a different stage of their AI journey. At a minimum, we’re meeting them where everybody is, which is here’s a chatbot that you can interact with that makes all of this really complex network security data more accessible. Asking questions like, “Is access allowed from A to B?” We’ve had the best capability in the market for over a decade now, called SIQL, Security Intelligence Query Language. But it can get complex. You have to be somewhat of a FireMon expert and a network security expert in order to understand the true power of SIQL.
AI changes that. AI now allows us to have natural language on top of this really powerful SIQL language, and now anybody in the security team can ask these critical questions of security intelligence platforms like FireMon. What access is allowed?
We also have what we call Insights, but it’s the analysis of your risk posture. We have hundreds of KPIs that we monitor across these firewalls, all the different security controls and usage behaviors, and while powerful, it’s also complex. Hundreds of KPIs. OK, what should I worry about today?
Insights leverages the power of generative AI to feed in all of these KPIs. And it’s not just raw KPI data. We also have benchmark comparisons. How do you stack up against others that look like you, and feed that into the LLM, and come back with an answer that says, “OK, here’s where you should focus your attention.”
What are some of your latest expansions in the AI arena?
Everybody understands ChatGPT. They’ve all interacted with some chat, so it brings that capability to our data. But the next stage in the journey for the AI-ready enterprise is agentic AI. How can we move from querying our data or interacting with our data with a chatbot to actually having the AI acting as an agent on our behalf?
We’re releasing our agentic AI platform to our customers, to bring agentic AI to policy control. So, think things like change management. How do you design new rules based on a change request, or how do I clean up my policy given all of this work that I need to do? Where should I focus my attention, and can I hand this work goal off to an agent to go perform that action for us?
And then finally, in this journey, is the customers that want to go DIY, build their own agent framework because they’ve already invested in platforms and Claude or whatever other LLM they’ve invested in, and they want to integrate this network security intelligence from FireMon into their core AI investments elsewhere. Maybe it’s in their SOC, their incident response team. Maybe it’s their own AI-built security platform. So making all of our data available through an MCP server is foundational to that.
FireMon has always been known as having the most robust APIs, and just building up that heritage and legacy, bringing that capability to an MCP server to expose it to an LLM is an obvious next step for us.
Given that AI is accelerating exploitation of vulnerabilities, where does network security ultimately fit in?
If we assume that every connected system is exploitable, we’re talking about [in] many cases zero-days, undiscovered vulnerabilities that are now being exploited—you can't patch. You can’t out-patch the threat actors now. And so you need to have other mitigating controls. And network security is not just a mitigating control. It is the foundational mitigating control.
That new threat, that fear [is] not unfounded fear. [But it’s] a very real fear of threat from an AI actor [which] is driving customers to recognize the importance of network security—and ultimately, to policy control of FireMon.