This article is based on an episode of CYBR.SEC.CAST featuring FireMon founder and CEO Jody Brazil, with hosts Michael Farnum and Sam Van Ryder. FireMon sponsored the episode. Full episode and related article:
, and CYBR.SEC.Media
Bill Brenner
A firewall rule mistakenly blocks critical business traffic. The firewalls themselves are working perfectly, but nobody immediately knows why the traffic has stopped. Executives are furious, money is being lost and the engineer responsible for figuring it out is summoned to the data center at 2 a.m.
That was the situation Jody Brazil faced in the late 1990s, when he was helping a telecommunications company manage its network security infrastructure.
The company's cell phone records weren't reaching its billing system. After investigating the firewalls, examining traffic and digging through the security policy, Brazil discovered the culprit: Someone had inadvertently created a rule blocking the very traffic the business depended on.
Deleting the rule restored service. Understanding why it had been created was another matter.
That experience led Brazil to develop scripts tracking firewall policy changes, eventually laying the groundwork for FireMon, the network security policy management company he founded.
More than 25 years later, the underlying problem hasn't disappeared. It has grown exponentially.
During a recent episode of CYBR.SEC.CAST, hosted by Michael Farnum and Sam Van Ryder, Brazil described enterprise networks containing thousands of firewalls, enormous collections of security rules and potentially billions of access paths.
The result is a management challenge that threatens to undermine one of cybersecurity's most important architectural goals: zero trust.
Thousands of firewalls. Millions of rules. Billions of access paths.
When Brazil first encountered the telecommunications outage, the environment consisted of just two firewalls and what he estimated was a policy containing hundreds of rules.
Today's large enterprises operate on an entirely different scale.
Brazil described customers with as many as 5,000 firewalls, potentially thousands of rules per policy and millions of rules governing how systems communicate.
Those policies can collectively produce billions of possible access paths.
"We as humans are supposed to manage billions of access paths? Probably not," Brazil said.
The difficulty isn't simply the number of rules. It's understanding how they interact, whether they permit unnecessary connectivity and what happens when someone makes a change.
A rule that appears reasonable on one firewall may introduce an unintended access path when combined with rules elsewhere in the environment. Conversely, a legitimate business request may require coordinated changes across multiple security controls.
The larger the network, the harder it becomes to determine whether security policies reflect what the organization actually intends.
And that's a problem for zero trust, which depends on granting only the access necessary for legitimate activity.
Zero trust is easier to describe than enforce
Zero trust has become a foundational cybersecurity principle, but putting it into practice across a large enterprise remains difficult.
Farnum, who has worked extensively with network security technologies, acknowledged that he rarely sees zero trust implemented as comprehensively as its underlying principles demand.
Organizations may successfully isolate specific environments, such as payment-card systems, without extending the same level of granular access control throughout the business.
The obstacle isn't necessarily a lack of security technology.
Many organizations already possess extensive firewall infrastructure and other controls capable of restricting communication between systems.
The challenge is determining which connections should exist and maintaining those restrictions as applications, users and infrastructure change.
Brazil expects network security to continue evolving toward increasingly granular access controls, potentially reaching the point where individual systems or processes have explicitly defined connectivity requirements.
But achieving that level of control manually is difficult.
"We can't put 50 people on to manage zero trust in a 2,000-person company," Farnum said, arguing that security teams simply cannot keep pace with the work required.
That's where artificial intelligence could change the equation.
AI could help manage the complexity humans can't
Brazil believes AI's most valuable contribution to network security may be its ability to analyze large, complicated policy environments and help engineers make more informed decisions.
Consider a routine business request: An application team needs access to a new service.
In a small environment, the change might involve adding a firewall rule.
In a large enterprise, however, the request can require understanding multiple possible network paths, identifying the firewalls involved, evaluating existing policies and determining which changes will provide the requested access without introducing additional risk.
The security team must also ensure the changes don't violate compliance requirements or inadvertently expose other systems.
"That's really hard," Brazil said.
FireMon recently introduced an agentic AI framework designed to help customers perform that kind of analysis.
According to Brazil, the framework includes prebuilt agents that can assist with policy design and access requests, combining large language models with network intelligence from FireMon's platform.
The idea is to give engineers an AI assistant capable of analyzing substantial amounts of policy information and helping identify appropriate changes.
Instead of manually tracing complex network paths and evaluating rules one by one, engineers could use AI-generated analysis to support their decisions.
The distinction is important: Brazil described agents working alongside security engineers, not an autonomous system replacing them.
The discussion did not provide independent performance measurements or establish how reliably the agents handle complex policy changes. Their effectiveness would depend on the accuracy of the underlying network information, the quality of the analysis and the controls governing implementation.
Still, the potential is significant because policy complexity has long limited how consistently organizations can enforce restrictive access.
Firewall administration isn't the same as security policy management
One of Brazil's recurring points was that organizations often confuse administering firewalls with managing network security policy.
The two activities are related, but they aren't interchangeable.
A firewall management console allows an administrator to create objects, add rules and configure devices.
Policy management requires understanding whether those rules satisfy the organization's security and governance requirements.
That distinction became increasingly important as compliance obligations such as PCI and HIPAA forced organizations to demonstrate not merely that security controls existed, but that their configurations aligned with established requirements.
Today, the challenge extends beyond compliance.
As organizations pursue zero trust, security teams need to know whether access policies remain appropriate as the environment evolves.
A firewall can function exactly as designed while enforcing a rule that exposes sensitive systems or disrupts essential business operations.
Brazil's telecommunications outage demonstrated that problem decades ago.
AI doesn't eliminate the need for policy governance. It may, however, make the work of understanding and maintaining those policies more manageable.
Zero trust needs operational muscle
The broader implication is that zero trust cannot succeed as an architectural ambition alone.
Organizations need the operational capability to continuously understand and enforce their access policies.
That means knowing which connections are necessary, identifying rules that permit unnecessary access, validating changes before implementation and monitoring whether policies continue to meet security requirements.
AI-assisted policy analysis could help security teams perform those tasks at a scale that manual processes struggle to support.
But the technology also introduces questions about accuracy, oversight and accountability. An AI-generated policy recommendation that overlooks a dependency could disrupt business operations. One that permits excessive access could undermine the security objective it was supposed to support.
Human review and effective change controls therefore remain essential.
For security leaders, the immediate priority is to examine the gap between the access restrictions their organizations intend to enforce and the policies their infrastructure actually implements.
The lesson from Brazil's 2 a.m. outage remains relevant: A firewall doing exactly what it was told can still produce a serious failure.
Twenty-five years later, the stakes are higher, the networks are vastly more complicated and the number of potential access paths is difficult to comprehend.
Agentic AI may help security teams regain control of that complexity.
But the goal isn't simply to manage more firewall rules faster. It's to ensure those rules consistently enforce the security the organization intended in the first place.
