Beyond Operational Obsolescence: The New Paradigm of IT Management in the AI Era

Cisco Blogs | Michele Festuccia

State-sponsored cyber campaigns like Volt Typhoon and Salt Typhoon are targeting critical infrastructure by exploiting vulnerabilities in legacy IT systems. This shift exposes the limits of traditional manual operations, which cannot keep pace with AI-driven vulnerability discovery, creating systemic risks to operational continuity. Traditional ITIL frameworks, designed for static environments, are failing to govern the rapid evolution of hybrid multi-domain architectures.

To counter these threats, enterprises are transitioning toward autonomous architectures built on Services as Code, AIOps, and AI-powered DevOps. These pillars establish machine-speed automation, continuous validation, and rapid configuration remediation across networks. Security remains paramount. By implementing standardized configurations, policy-as-code guardrails, and unified observability, organizations can safely deploy autonomous AI agents for closed-loop remediation. This shift redefines the IT operator's role from manual task execution to strategic governance, ultimately aiming for self-healing, fully autonomous enterprise infrastructures across multi-domain hybrid IT cloud environments.

Comment

The persistent targeting of critical infrastructure by Volt Typhoon exposes a fundamental vulnerability in traditional network defence paradigms. Legacy IT operations rely on periodic manual patching cycles that are entirely outmatched by AI-accelerated vulnerability discovery. This asymmetry allows state-sponsored actors to identify and exploit software flaws in complex codebases before administrators can deploy updates. Consequently, static governance frameworks like ITIL no longer provide adequate protection against rapid, automated intrusion campaigns.

The mechanism of this threat relies on living-off-the-land techniques, where attackers use legitimate administrative tools already present within the targeted network. By automating the detection of these dual-use utilities across multi-domain environments, Volt Typhoon evades traditional signature-based detection systems. Mitigation of this risk depends on deploying autonomous AI agents that continuously validate network states against a version-controlled Cisco Services as Code baseline.

Strategic Question for Discussion

If Volt Typhoon continues to exploit dual-use administrative tools via living-off-the-land tactics, does the transition to autonomous Cisco Services as Code architectures successfully eliminate the attack surface, or does it merely shift the vulnerability to the AI training data and policy guardrails themselves?

The transition to programmable architectures significantly reduces the window of opportunity for living-off-the-land exploits by enforcing deterministic state validation. However, the shift introduces a new attack vector, as the integrity of the autonomous system becomes entirely dependent on the security of the policy-as-code repositories. Consequently, securing the software supply chain of the AI guardrails themselves will likely emerge as the primary defensive priority.

Share your assessment in the comments below.

To read in details click here