Enterprise Networks Know Who Connected. AI Agents Make the “Why” Harder

We spent decades teaching networks to recognize people, devices, and applications. AI agents are about to make that considerably more complicated.

A few years ago, I was on a troubleshooting call when someone asked a question every network engineer eventually hears: “Does anyone know what that device is?”

We had a MAC address and an IP address. We knew which switch it was connected to, which network it belonged to, and where it was communicating. What we didn't know was why it was there.

Eventually, someone figured it out. It was a perfectly legitimate device, installed long enough ago that nobody on the call remembered it. Mystery solved.

I hadn't thought about that kind of incident in a while. Then I started thinking about AI agents, because we are about to introduce something much stranger into enterprise infrastructure. This time, the problem isn't an unknown device. We may know exactly what the agent is, who owns it, and how it authenticated. What we may not know is why it decided to do what it did next.

And I don't think our current definition of network identity is ready for that.

Networks Have Always Liked Predictable Things

Networking is, in many ways, the art of putting things into boxes. An employee laptop belongs in one category, a guest phone in another, and a printer, camera, IoT sensor, server, or cloud workload somewhere else. Once we know what something is, we can begin answering the questions that actually matter: How should it authenticate? What should it be allowed to access? Where should it be segmented? What happens when its behavior changes?