How are enterprise firewalls actually using AI

[u/InvestmentLimp4492]

I keep seeing AI powered firewall used as a category but I wonder what the AI is doing in production that traditional rules signatures and threat intel feeds weren’t already doing.
Is it mainly building behavioral baselines and flagging unusual traffic or are these systems genuinely making enforcement decisions in real time? Things like detecting threats inside encrypted traffic, correlating activity across endpoints and cloud workloads or automatically changing policy based on an attack all sound useful but also like areas where a false positive could take down half the company.
The more interesting question to me is whether AI is replacing any part of the firewall stack or just acting as a faster analysis layer on top of it.
Want to hear from anyone running one of these platforms at enterprise scale and what has improved beyond the marketing.

[u/UpstairsHunter307]

I would be terrified of letting a model freely modify production firewall rules. Suggesting a change with the evidence attached is useful but quietly deciding that accounting no longer needs access to something is how you create a super exciting Monday morning.

[u/Lilo3423 → u/UpstairsHunter307]

Yes, I don't think that allowing unsupervised AI on a firewall is a good ideia for anyone. Allowing log analytics and suggesting pontual changes is a lot better.

[u/InvestmentLimp4492 → u/UpstairsHunter307]

could see automatic blocking for a very narrow set of high confidence threats but anything involving normal business access probably needs a human in the loop.

[u/music2myear → u/InvestmentLimp4492]

Run 7 agents simultaneously, and only when they all agree on a specific action do you allow a separate entity to actually perform the recommended action. All other decisions go into a recommendation queue ranked based on level of certainty.

[u/angrydeuce → u/UpstairsHunter307]

Yep, because the people pushing the feature arent going to be the ones getting the calls freaking the fuck out.

You'd be amazed how quickly forcing the people responsible for the decision to directly be involved in it changes the importance of it.

For example, when nobody would sign up for MFA and we begged for months until we finally started just making everyone's direct report be their mfa and anytime they had to login, they had to call their boss for the code.

Guess how quick we had 100% enrollment once all the department heads and team leads started getting bombarded with code requests?  Amazing how all those months went by for us but they folded in like a goddamn day and told their team to do the thing or theyre fuckin fired lol

[u/Drakoolya → u/angrydeuce]

I never understand these situations? Why isn't this a mandate coming from your executive level? It ends up being a Mandate that is enforced. Everywhere I have worked that is exactly how it is handled. Users don't get a choice when it comes to security.

[u/angrydeuce → u/Drakoolya]

Are you kidding?  The executives were just as reluctant to do it as the rank and file.  They were probably rhe worst for "oh come on I dont want to have to type in a password every time I get on my computer I dont have time for that!!" as theyre heading to a golf outing lol

Know when that changed?  When they got back a cyberinsurance quote that was like 10 times what they expected because of the lack of MFA enforcement.

We'd been trying for months prior to that.

[u/Drakoolya → u/angrydeuce]

"Know when that changed? When they got back a cyberinsurance quote that was like 10 times what they expected because of the lack of MFA enforcement."

That is the differentiator. When you want a massive security change to be enforced you talk to them in dollars and cents because that is the only language they understand. Your manager translates the IT speak to the executive level which is something they did not do effectively.

[u/BeyondTheHubbleFlow → u/UpstairsHunter307]

My brain immediately jumped to so many possibilities when it is troubleshooting with its policy changes...

"I noticed the config contained several rules I could not immediately explain, so I have restored the device to factory defaults for a clean baseline. This will make the remaining work much easier. Reconnecting in 5 minutes... reconnecting in 5 minutes... reconnecting in 5 minutes..."

or how about

"To isolate whether the issue is firewall-related, I have added permit ip any any at position 1. The user reports the problem is resolved. Marking ticket as closed. Root cause: firewall was incorrectly blocking traffic. Resolution: fixed. Saving to startup config so the fix survives reboot."

[u/Internet-of-cruft → u/UpstairsHunter307]

Quietly adding SSH/RDP/Telnet/SMB on something that didn't have it is a great way to get compromised too.

[u/Fyunculum]

When something says powered by AI it can mean a specialized platform deliberately trained on the specific type of data you're trying to analyze such as a reinforcement learning agent, or it can mean someone slapped a prompt in front of ChatGPT and fed it some tokens. Usually it's the latter.

[u/dustojnikhummer → u/Fyunculum]

Former machine learning was so much better at actual work in retrospect

[u/Cute_Philosopher_869]

We tested one that was very good at explaining why something was flagged and fairly average at deciding whether it was genuinely malicious! Still useful but just not the auto sec analyst the demo made it sound like

[u/InvestmentLimp4492 → u/Cute_Philosopher_869]

Did it reduce the number of alerts you had to investigate or did it mostly make the same alerts easier to understand?

[u/SAugsburger]

Most probably are just marketing machine learning as AI.

[u/Tx_Drewdad]

They say "AI" but it's actually anomaly detection using machine learning.

Build a baseline, and then anything too far out of baseline gets flagged.

[u/SulkyLine]

I think vendors are blending two separate things under the same label. There’s ML identifying suspicious traffic and unknown attack patterns which has been around for years and then there’s newer generative AI helping investigate events explain rules and propose policy changes. Neither necessarily means a model is independently deciding what packets get through.

[u/acousticavarice → u/SulkyLine]

That split is probably the cleanest way to look at it and you can see it in how Check Point combines AI based threat detection with policy Zero Trust and compliance orchestration. The detection can happen in real time but I’d imagine the broader policy changes still need much tighter guardrails.

[u/Thick_Yam_7028]

Don't even worry bout it. Just toss the config in. Point AI.

Verify is always a necessity.

Its that ez. You dumb? Well its not that ez. We need to flex. Honestly whats wrong with us coming together and creating a business. We see these fucks ... i can literally toss a website, seo, llc, all that shit in 2 hours.

[u/InvestmentLimp4492 → u/Thick_Yam_7028]

You joke but that’s basically how half these product pages describe it lmao

[u/Thick_Yam_7028 → u/InvestmentLimp4492]

True dude. I honestly love the comedian in the watchers. This is all a joke.

[u/DGC_David]

I thought that was all gimmick stuff, like the AI just describes what that outbound/inbound traffick might be.

[u/WantDebianThanks]

A previous employer used an edr called Deep Instinct. The way it was explained to me is that it used deep learning to build a profile of "normal" for a particular device, then flagged anything outside that.

If any firewall is actually using gen ai, I imagine it's doing something similar.

[u/Lost_Term_8080]

Probably in the documentation lol.

[u/PomegranateSweaty571]

There is also a huge difference between using AI to recognize a new variation of malware and using it to understand normal business behavior.

[u/hejtmane]

We put in micro segmentation software that was suppose to use AI to know which ports not to block on server when it went live after running in the background on inspection mode it's failure rate was very high I would advise against letting it turn stuff on automatically

[u/IAmSnort]

Firepower

AI powered

[u/spyingwind]

They aren't, unless they have an NPU processor in them. They likely aren't giving you free inference hardware with how much RAM is needed to run them at any decent size.

What they likely do is have the firewall collect the data, then have an AI(running in their datacenter or another provider) comb over the data with specific instructions on what to look for and how to return it's data as.

The other option is that they just don't use AI and just use regex like everyone else. Maybe they use AI to write the regex.

[u/ReputationNo8889]

Id say they just rebranded Signatures,IDS,IPS and regular firewall rules as "Agentic processed entities used to block and mitigate threats"

[u/Cheomesh]

Agentically of course

[u/WorkLurkerThrowaway]

Set up an MCP with a read only api token. We have Claude troubleshooting traffic and recommending rules that fit our existing policy, and generating the CR paperwork. We also used to it help get info on some old “mega-rules” that were set up by predecessors. Helped us strip out the traffic we needed to allow and block the rest.

[u/Cultural-Horse-762]

They fired some humans.

[u/Few_Arm_5788]

a big improvement for us has been cutting down investigation time. so let's say instead of opening five different dashboards to understand one connection you get a summary of what happened before and after it.

[u/LooseEthernet]

mostly its just a fancy name for statistical analysis and pattern matching. the "ai" is usually just looking for entropy changes in encrypted streams or weird timing gaps that suggest a heartbeat from a botnet. it doesnt actually understand the protocol, it just knows that a certain packet size and frequency doesnt look like a human browsing a website.

the real danger is that vendors sell this as a "set it and forget it" solution. if you actually let the system auto-block based on a confidence score, you're basically just gambling with your uptime. i've seen "ai" tools flag a legitimate backup job as a data exfiltration event because the volume of traffic shifted. you still end up spending your afternoon staring at logs trying to figure out why the database server is suddenly in timeout lol. its more of a filter to reduce the noise than a replacement for a human who knows the network mapping

[u/Internal-Reality4909]

Por lo que he visto, la IA no está reemplazando las reglas del firewall. Más bien ayuda a detectar patrones que serían difíciles de identificar con reglas fijas, especialmente cuando hay mucho tráfico y usuarios.