Security · 8 min read
A question of if has become a question of when: Andrew Igloo's AI network monitoring
For years a small business in SW Washington could reasonably ask whether anyone would bother with its network. That has changed. The scanning is automated, cheap and fast, so the question now is when a door gets tried, and whether anyone on your side notices. We built Andrew Igloo, our AI network administrator, because of that. He runs AI network monitoring from The Igloo, and this post is about what he watches and what he is never allowed to do.
What changed?
The way in moved from your staff to your equipment. According to the Verizon Data Breach Investigations Report 2026, exploiting an internet-facing device (your firewall, VPN box or router) rose from 20% to 31% of breaches, ahead of stolen passwords. The rest of the numbers are on our evidence page.
The skill it takes collapsed. "AI has lowered the barriers to sophisticated cybercrime," Anthropic wrote in its Threat Intelligence Report of August 2025, describing people with few technical skills running operations that once took years of training.
And it moves in minutes while most businesses notice in months. The CrowdStrike Global Threat Report 2026 puts the average gap between the first compromised machine and the second at 29 minutes. IBM's Cost of a Data Breach 2026 puts the average time to identify and contain a breach at 247 days. Nobody out-types a script, so the goal is to find out the same afternoon.
Why "when" is not a scare tactic
Security marketing runs on fear, and we'd rather not. Nobody chose your business. Automated scanning sweeps the whole internet and stops wherever a door answers, and that is what reaches a twenty-person office in Chehalis.
What it finds is rarely clever. In our assessments it is almost always a setting: a guest Wi-Fi never really separated from the billing computer, a firewall feature switched off years ago, a camera recorder reachable from the internet, or the password the box shipped with. None of those needs new hardware, and none is visible until somebody reads the configuration, which is what our sample network report shows.
So "when" is constant scanning meeting a common open setting. The part you control is whether someone on your side finds that setting first, and that is the part we do.
Who is watching your network at 3am on a Sunday?
Usually nobody, and your provider is in the same spot as everyone else. Watching takes people, and a small business can't pay for a night shift to watch a network that is usually fine. So network monitoring for small business mostly means alerts: a message fires when a number crosses a line, and the quiet failures never cross one.
We learned this on our own phone lines. The overseas-calling fraud that hit one customer account this year was caught at 2am on a Sunday by our owner, who happened to be awake. He tells that story, and what we changed, in his ten-months-in post. Phone systems are on the internet too, and a person who happens to be awake is not a plan.
It happens to public bodies in this state too. Chelan County said in its own June 2026 release that its computers, networks and phone lines went down, and the Port of Seattle reported its phone systems down in its official cyberattack notice. Franklin Pierce Schools cancelled classes in June 2025 after its network and phones went out. Each time, the first thing people noticed was that they could not make a call.
What does AI network monitoring watch?
Andrew is a small PC on your network that listens around the clock. He reads the status reports your equipment already produces, whether that is UniFi, Cisco or Meraki gear or the standard status feed (called SNMP) most business equipment can publish, and sends what he learns to The Igloo, our operations center in Tenino.
He keeps asking three questions:
- Is everything up? Every device, both internet lines, the phones, the cameras, the VPN box your remote staff sign in through, and the monitoring itself. Anything that goes quiet is noticed within about two minutes.
- Is anything new or moved? A device nobody ordered, your internet address changing, a change in how the network hands out addresses, or a setting drifting from what you signed off.
- Is anything about to fail? Wi-Fi getting worse in one corner, an internet line filling up, a switch near its limit.
A dashboard reports each number on its own. Andrew reads every layer at once and turns them into one sentence: the internet is fine, a backup job on one desktop is filling the upload, and that is why the phones stuttered this morning.
When something looks wrong, Andrew alerts a second AI at The Igloo, which pages a human. Our owner calls this "AI that battles AI". The scanning on the other side is automated, so the AI threat detection on ours has to be too. A person can't listen to a network all night, and software can. The full list is on the network monitoring service page.
Three things a dashboard misses
- The router somebody brought from home. The printers vanish for half a morning, the file server with them, and by lunch everything is back with no explanation. Next month it happens again. The cause is a home Wi-Fi router in an open wall jack in the back office, handing out its own addresses to whichever computers asked first. Andrew notices the moment your network's addressing changes, and names the device, when it appeared and which machines it caught.
- The backup line that was already dead. You pay for a second internet line every month so the office stays up when the first one fails. On one audit this summer, the spare had been dead for as long as the box connecting the office to the internet had been running, and nothing had said so, because nothing was checking it. Andrew tests both lines all day, so a dead spare shows up while the main one is still fine.
- The camera that died three weeks ago. Nothing tells you. The light stays on, nobody complains, and you learn there is no footage on the day you need it. Because our cameras are network devices, Andrew notices one that stops answering within about two minutes and tells someone the same day.
The technical version of each is on Andrew's page.
What Andrew does not do
Andrew watches and explains; you and our team decide. That is built in, because "an AI on our network" makes a sensible owner pause, and it should.
Say Andrew works out that the guest Wi-Fi can reach your billing computer. He sends a note: what he found, what he would change, and what it would affect. A person at The Igloo reads it, you agree a time, and one of our team makes the change in that window. Andrew can't make that change himself, deleting is switched off for him, and he never sees a real password. The settings that limit him live in our software, where only a person can change them, with a record. The full list of those limits is on Andrew's page.
He is one narrow agent with one job and a person who has to say yes, the same pattern we run everywhere else in our company. You still need a firewall and the basic business network security work. Andrew's job is to check, around the clock, that the firewall you paid for is still doing what you think it is.
There are two limits you should know about. When your building loses power, the small PC there goes dark too. That silence is itself the alert, and it lands at The Igloo, which runs on solar and two internet lines. And when a whole site goes quiet, the platform waits about eight minutes before calling it an outage, so that alert is slower than one for a single device. We'd rather you knew that number.
What this means in SW Washington
A manufacturer near Tumwater Falls in Tumwater, a timber company's office at the Port of Longview and a waterfront hotel in Port Angeles share the same problem: a firewall installed years ago, a phone system on the internet, cameras nobody checks, and nobody looking at any of it after five. None of them is a target, and all of them are reachable.
We do it in this order, and the first step is free.
- Find out what you have. We read what is really set on your equipment and write it up for you, ranked critical to low. That is the free on-site assessment, and the report is yours whether you hire us or not.
- Close what is open. Most of what we find is a setting we can change; new equipment is the exception.
- Then keep watching, every night. Andrew goes onto the network with that report as his baseline, and from then on "when" has an answer: the same afternoon, with a person told. All for less; ask us how we do it.
Your phones are in from day one, because they ride the same network, and the remote path your softphones and home-office phones use is one of the first doors we check. Call (360) 515-2500 any time; our AI answers and a person follows up. Or write to hello@wallabynetworks.com.
Questions, answered
What do SW Washington business owners ask about this?
What is AI network monitoring, in plain English?
It is software that listens to your network equipment around the clock, reads the data every device reports, and turns it into plain sentences a business owner can act on. At Wallaby Networks that software is Andrew Igloo, our AI network administrator, running on a small PC on your network and reporting to The Igloo in Tenino. He reads the firewall, switches, Wi-Fi, phones and cameras at once and pages a person when something matters.
Is AI network monitoring the same as antivirus or endpoint protection?
No. Antivirus lives on each computer and watches the files and programs on it. Network monitoring watches the equipment those computers sit behind: the firewall, the switches, the Wi-Fi, the internet circuits, the phone system and the cameras. That is now the most common way in, and the layer almost no small business has anyone watching. We treat it as network and infrastructure security, and endpoint protection is an optional add-on.
Do we need new equipment before Andrew can watch our network?
Not necessarily. Most business network equipment already reports its status in a standard way, and Andrew Igloo, Wallaby's AI network administrator, reads that report whether the gear is UniFi, Cisco or Meraki. The free on-site assessment Wallaby runs for SW Washington businesses tells us what you have and whether it can be read. If a piece cannot be, we say so and put the fix in the quote instead of surprising you later. That report becomes the baseline Andrew watches against.
What happens when Andrew finds something in the middle of the night?
Andrew Igloo, Wallaby Networks' AI network administrator, does not touch your network. He alerts a second AI at The Igloo in Tenino, which pages a person on call. Critical events, like a circuit failing, get a person that night, every time; everything else lands, ranked, in your written report. Any fix that changes a setting is previewed and approved by a person before it runs, and firewall rules, firewall openings and voice-priority settings are changed by a person in a window you agreed to, never by Andrew.
Does AI network monitoring cover our phone system and cameras too?
Yes. Andrew Igloo, Wallaby's AI network administrator, watches your phones as network devices, because they ride the same network as everything else and sit on the internet the same way your firewall does. He flags a phone that drops off, or an outside attempt to reach the phone system. Cameras are watched the same way, so a dead one is noticed in about two minutes instead of three weeks later.