FireMon announced FireMon Agentic AI on October 27, 2026, adding AI agents to its network security policy management platform to handle the investigation and planning behind firewall policy changes. The agents work inside limits customers set on which devices and tools each one can touch, and nothing is deployed to firewalls automatically. The platform and a new FireMon MCP Server will be available in November, with no additional FireMon charge for the initial offer, and AI features arrive switched off by default.
Three Agents For One Painful Workflow
Network security teams face a growing volume of policy decisions across firewall vendors, cloud environments and segmentation technologies, and a single business access request can span multiple devices and policies, with several technically valid ways to implement it. Engineers have traditionally gathered the facts, evaluated the alternatives and coordinated the proposed changes by hand, a process that consumes expertise and slows delivery as businesses demand faster decisions.
FireMon supplies three agents to take on that legwork. The FireMon Intelligent Agent searches and analyses policy data, constructs and runs Security Intelligence Query Language queries, and explains its findings, so practitioners can ask which rules allow access to a given service without manually assembling searches. The Network Designer Agent analyses an access requirement and produces firewall policy recommendations, for example identifying recommended changes for an application that needs HTTPS access to a reporting service, for the practitioner to evaluate.
The Policy Change Designer Agent goes furthest, carrying an access request through discovery, recommendations and preparation of Policy Plan changes. It fills required fields such as rule names automatically, and pauses whenever a practitioner must choose among valid alternatives. Nothing is saved until someone reviews and accepts the proposal, and even then acceptance only stores the work in FireMon’s workflow rather than deploying it to firewalls. Customers can also customise FireMon’s agents or build new ones inside the platform.
Connecting FireMon To External Agent Workflows
The FireMon MCP Server, built on the Model Context Protocol, makes selected policy data and supported operations available to external agents. An incident investigation workflow can combine alert information with FireMon policy evidence, while an access workflow can discover relevant devices and policies, compute recommendations and prepare changes without a practitioner gathering and transferring the information manually.
Authorised external workflows can also convert selected recommendations into staged Policy Plan changes and save them into the FireMon workflow, with access controlled through roles and credentials. The external application directs the interaction and interprets the results, which connects FireMon’s network security intelligence to the broader workflows customers are already building around AI agents, rather than keeping policy evidence locked inside one console.
Control Stays With The Practitioner
FireMon stresses that control is the point of the design. Customers define agent instructions, assign skills and tools, and scope permissions to appropriate device groups. They can choose a supported large language model, including their own approved model environment, and AI enablement is optional and off by default, with access controls and an audit trail supporting accountability. Practitioners retain authority at the decision and approval points in the supported workflow.
That restraint addresses a practical barrier to policy automation. More than one policy may satisfy an access request, and an object name that is technically valid may not fit an organisation’s conventions. FireMon combines policy context, agent instructions and specialised tools to prepare work that reflects those requirements and brings consequential choices back to the practitioner, instead of letting an agent quietly pick the easiest valid rule.
Founder and chief executive Jody Brazil said network security has never been more complex, and that the answer is not more infrastructure but putting the policy context FireMon has built over 25 years to work. Customers can deploy FireMon’s agents, build their own, and connect FireMon to broader agentic workflows, he said, while practitioners keep the calls that need human judgment.
Why It Matters
This matters because firewall policy is one of the places where an AI mistake is not a bad draft but a hole in the network, so governed agents that prepare work without deploying it are a more credible model than full autonomy. If FireMon’s approach holds, security teams could clear backlogs of access requests without surrendering approval, and policy evidence could flow into incident and access workflows instead of living in separate consoles, while agent identity and kill switches and safe agent execution set the guardrails for the same shift. The risk to watch is scope creep: agents that start by answering policy questions could quietly expand into change preparation, so the off-by-default setting and audit trail will matter as much as the agents themselves, and verified agent identity will be part of proving who did what.
Background
FireMon, based in Lenexa, Kansas, says it founded the network security policy management category more than two decades ago, and describes its platform as the control plane that sits above every vendor and every environment, on premises, in the cloud and hybrid, so enterprises can see, prove and safely change policy from one place instead of reconciling it console by console.
Source: FireMon announcement
0 Comments