Here I am — at my desk, third coffee getting cold — reflecting on the years spent ensconced in cables and code since 1993, when I began as a network admin. In those days, mux gear for voice and data over PSTN was commonplace. And, yes, I feel those 16 years of experience whenever I think about that worm, the Slammer, as if it were my next-door neighbor and it never left in 2003. Those early days taught me that waiting for things to explode to start to react? Not a strategy. It’s a liability.
Today, as a running PJ Networks, I find myself squarely on the proactive incident detection side of the table. What that means is it’s not just sitting here waiting for alarms to scream — it’s watching, predicting, flagging and handling problems before you have a downtime disaster on your hands. And downtime? It is the bane of every ops manager and CTO I know.
Fine — let’s do this IRL, and I’d like to offer a few war stories from the front lines.
For many, the safety measure’s use will be more like a fire drill than like the fire itself.
When I had my networks set up on routers that were just small fridge units, we had NO alerts. Each outage was like a surprise party — at which no one was happy. Threshold alerts made that game.
And here’s the thing: you set thresholds for CPU utilization, bandwidth, error rates — and when these thresholds are within shouting distance, the NOC swoops in. But the tricky part is setting those thresholds right. Too sensitive and you’re drowned in false alarms. And it can be too loose and you miss the early signs.
At PJ Networks we customise these alerts for each client depending on:
We detected a barely-over-the-threshold CPU utilization on a core router of a mid-size bank just last month. A single cleanup operation was not being performed during maintenance windows – our alert had provoked human intervention before the router hit 95%. Result? No downtime in their most intense trading times.
Client quote: “Sanjay’s team saved us from what would have been a multi-hour outage while we were conducting banking work. The proactive alert saved his life.” — CTO, Regional Bank
Trend and threshold alerts catch the known-knowns. But what about the bizarre things — the surprise spikes, weird packet patterns, odd user behaviors? This is where anomaly detection shines — and (I’d argue) where many vendors hype overpriced AI solutions that I personally question.
Our adoption of anomaly detection isn’t to mindlessly fire off alerts for any ‘unusual’ occurrence, but to provide some background and context around that occurrence using the network timeline, and the environmental norms. It’s kind of like, if you’re driving your car and you hear a weird rattle, you don’t just flip out, you compare it to what an engine would sound like normally, right? Same concept.
Consider the example of a client’s firewall that is showing sporadic strange-looking outbound traffic late at night, during the time of day when the client’s business is closed. The looming anomaly detection sense the bitches. Not a virus, but a badly set-up backup script flooding data on to an offsite server. The client saw, after corrections:
This pre-emptive catch kept them from a costly ISP fine and hours of painful investigation.
Now, trend analysis may sound boring, but it’s pure gold. Most major network disasters don’t appear out of nowhere — they slink, like the slow oil leak in a classic car you never quite get around to fixing because, dammit, it’s only a few drips.
At PJ Networks, we gather measurements every few seconds and process its data over months. With that trend lens, we’ve seen:
One recent success: a large bank client was experiencing higher and higher packet loss on their geo-redundant WAN link. Externally, few major alarms, but the trend lines were evident. We were able to respond to vendor support before the link went down, and no downtime occurred. They told me later, ‘We never saw that until PJ pointed it out. Like a canary in our coal mine.”
Our NOC team is available around the clock, with some key tenets in mind:
Three major banks’ zero-trust upgrades: I recently spearheaded upgrades integrating proactive monitoring into the zero-trust ecosystem. By integrating our NOC’s intelligent alerts, these banks reduced response time to incidents by over 40% in roll-out alone.
I’m not some consultant spouting theory. I came of age during the Slammer worm days — when networks were being obliterated in seconds because no one thought such an infection could actually occur, much less be unstoppable. I realized then that good security is not a set-it-and-forget-it proposition.
And while I’m on the subject of the limitations of AI, here’s a bit of a rant: I’m pretty leery of the plethora of buzzword-heavy AI-powered security products that are out there that make big promises of being able to do everything, but can’t reliably tell the difference between a legit alert and a false positive. Automation in the absence of human insight is far from ideal. Balance is key.
I am proud that at PJ Networks, we have a NOC that combines high tech with seasoned analysts. That’s what keeps your network purring along and prevents that sickening moment of downtime.
I suspect nothing stops lousy password policies like reactive monitoring does. I mean, honestly, I still come across institutions with their password rules rooted in the 1990s — complex yet guessable. To paraphrase Rogers, it’s like maintaining a classic car with duct tape and luck.
We’re about strong identity controls and MFA, because monitored network is only as good as your user’s access controls.
For the same reason you already have insurance when you drive a car and an insurance when you have a business: because they change your risk profile fundamentally, and the potential downsides are too great. If you’re an ops manager or a CTO trying to wrap your arms around random, unpredictable downtime, spend a moment thinking about how PJ Networks’ proactive incident detection can transform your company’s risk?
Our masterful mix of threshold-based alerts, anomaly detection, and trend analysis—all refined over two decades of both beautiful successes and spectacular failures—is the safety net your business needs.
We’re not just sorting out problems anymore. We’re shutting them down before they even start.
And believe me, that is more than all the coffee in the world.
— Sanjay Seth
Cybersecurity Consultant | Founder, PJ Networks Pvt Ltd