HPE Networking Presents at Security Field Day 16

HPE Security in the Al Era: Zero Trust and Al-powered Threat Defense

Watch on YouTube
Watch on Vimeo

Madani Adjali of HPE Networking introduces the company’s SASE and security portfolio, spanning SD-WAN, SSE, network access control, and firewall. The session previews HPE’s Security Field Day agenda on zero trust and AI-powered threat defense, covering Unified SASE, AI-native operations with EdgeConnect, Central NAC for AI infrastructure, and firewall integration with existing SecOps workflows. Adjali, vice president of product management for the SASE and security portfolio, opened HPE Networking’s presentation at Security Field Day 16. He framed the day around two themes: AI for security and security for AI.

Adjali noted that this was HPE’s return to Security Field Day as a unified company, about a year after its previous appearance, and he reviewed what the team had shipped since then. Early in the year, HPE launched the SRX 400 and 440 firewalls at RSA. The company also introduced HPE Threat Labs and deliberately branded it without the “networking” label so that its research would reach beyond the networking world. In June, HPE launched Unified SASE at Discover. Adjali called the Discover demo a lightweight version and promised a much deeper look for this audience. The newest item was an announcement made that same week that brings EdgeConnect into HPE’s full-stack deployments, and the delegates were the first audience to see it.

Adjali then outlined the four sessions that followed. The first covered reducing exposure with Unified SASE. The second extended AI-native operations across the full stack, with a guest from HPE’s campus and branch team on hand for questions beyond pure security. The third looked at how network access control can help secure emerging AI infrastructure, including AI agents connecting to the network. The final session, on fighting zero-day threats with AI, departed from the usual product demo. Instead of a web UI, it showed a SecOps practitioner reaching HPE firewall capabilities through their own tooling and chatbots. Adjali described this as the new reality, because customers increasingly want native access to security systems so they can build them into the workflows they already use.

Personnel: Madani Adjali

HPE Security Reducing Exposure in the AI Era with Unified SASE

Watch on YouTube
Watch on Vimeo

Ram Krishnan of HPE Networking demonstrates how the Unified SASE orchestrator brings SD-WAN connectivity, on-premises firewalling, and cloud security into a single management interface. The session covers intent-based networking and security policy, SSE connectors embedded in EdgeConnect gateways for zero trust access, secure web gateway protection for remote users, and an AI copilot for configuration hardening and troubleshooting. Krishnan, a product manager, presented the live demo at Security Field Day 16.

Krishnan started with connectivity. Default business intent overlays turn application priorities into tunnels, routing, QoS, shaping, and steering as soon as a device is onboarded. Bonding policy combines broadband and LTE links into one logical tunnel and chooses a path for each packet. The same intent model drives the global firewall policy. In one example, an IoT device’s DNS query was blocked for matching a suspicious domain even though a rule permitted DNS. The biggest change is that the SSE connector, formerly a separate access connector, now runs inside every EdgeConnect gateway, which turns an SD-WAN fleet into a set of ZTNA connectors. Connectors make outbound connections to the cloud, which brokers access. A contractor reached a private web server from an ordinary Brave browser without a VPN or an inbound firewall opening. For managed laptops, an agent adds posture checks and SSL-inspected URL filtering, which the demo used to block a gambling site.

The AI copilot compares live configuration against best-practice guides and labels settings secure, insecure, or needing attention. Krishnan said it currently advises rather than acts. One-click quarantine or hardening is the vision, but he doubted enterprises are ready for it yet. Delegates welcomed the unified security logs, which combine appliance and cloud events and let operators pivot between user and application views. One delegate called the change a game changer compared with the visibility of the earlier platform. On deployment, the cloud service is pure SaaS and keeps each region’s data in place to meet GDPR requirements. Administrators can still pin applications to US region connectors for traveling users if they accept the added latency.

Personnel: Ram Krishnan

Extending AI-Native Operations Across the Full Stack with HPE

Watch on YouTube
Watch on Vimeo

Ram Krishnan and a colleague from HPE Networking’s product management team show the first integration of EdgeConnect SD-WAN into the Mist cloud. The session demonstrates onboarding, full-stack troubleshooting that correlates wireless, wired, WAN, and security data, and Marvis agentic analysis of intrusion events, followed by a preview of EdgeConnect monitoring coming to Aruba Central. Krishnan, a product manager, co-presented the session at Security Field Day 16 along with Nick Norman.

Mist began as a wireless management platform and later added wired devices; EdgeConnect is the next addition. To onboard, an administrator enters a code from the Mist tenant into the EdgeConnect orchestrator, selects the gateways, and enables the integration. The demo then followed a reported problem at a Kansas City lab site. Marvis actions showed VPN-down events, and service level expectations put wireless at 94 percent, wired at 96 percent, and WAN at 79 percent. Within the WAN, application health was the weakest at 42 percent, and nearly all of that came from application disconnects affecting Okta, Dropbox, G Suite, and YouTube. Impacted clients from the wireless and wired sides appeared in the same view. The site’s intrusion detection events, 99 minor and one major, had been ignored as recommended and did not affect users. Across the whole organization, a Marvis agentic query turned the raw signatures into plain language. It reported roughly 14,000 events in 24 hours from a single host that had been beaconing DNS queries for a week, and it recommended isolating the device immediately.

The presenters said one-click quarantine is not available yet, and the Mist integration currently covers day-two monitoring, with configuration coming later. A delegate pressed for links from Mist back to the orchestrator so an admin could act on a recommendation such as updating an IDP policy without switching tabs, and the team acknowledged the request. Similar EdgeConnect site health, device health, network, event, and alerting views are expected in Aruba Central by mid-next year. Krishnan concluded that correlating LAN, WAN, and security in one view lets operators replace finger-pointing between teams with evidence that shows exactly where to troubleshoot.

Personnel: Nick Norman, Ram Krishnan

HPE Securing Emerging AI Infrastructure with Central NAC

Watch on YouTube
Watch on Vimeo

Mathew George of HPE Networking shows how Aruba Central and its cloud-based Central NAC service support a zero trust approach for complex device estates. Using a fictitious manufacturer, the session covers AI-powered client profiling, tag-based detection of unexpected generative AI traffic, certificate-based authentication policies drawing on identity and endpoint systems, and automatic containment through forced reauthentication. George, a technical marketing engineer focused on NAC and zero trust, presented at Security Field Day 16.

George described weakly secured IoT devices as a growing risk now that attackers use AI to find and hijack them for botnets. Client Insights classifies devices from DHCP, user-agent, and flow telemetry sent by Central-managed access points, gateways, and switches. It draws on a data lake covering almost 3 billion devices. At a Dallas manufacturing site, deep packet inspection showed two thermostats sending traffic to OpenAI. George created a tag for the generative AI application category. Central reclassified the tenant in about two minutes, and Central NAC forced reauthentication, which moved the thermostats into a restricted role. Policies can also authenticate known camera vendors and return attributes to third-party switches, including Juniper. Corporate access requires EAP-TLS and supports no username-and-password methods. Policies can check certificate issuers, identity provider groups, and compliance data from systems such as Intune, Jamf, and CrowdStrike.

Delegates pressed for a clearer explanation of why a role changed, which matters when a help desk takes a call. George showed how to compare matching rules over time and said logging could improve. For hospitals full of legacy devices, he described layering MAC authentication with profiling, MAC registration, and multi-PSK. A 30-day behavioral baseline also flags anomalies such as unusual uploads within about four hours. Central NAC does not perform posture checks or HIPAA compliance checks itself. It ingests that data from third parties, and its integration list is growing, with five added in the past year, compared with roughly 150 for the on-premises ClearPass product. Client Insights profiling can already feed ClearPass, and fingerprints are anonymized and shared across tenants. George acknowledged that classification still relies on DPI and URL filtering, so Central cannot yet tell agentic traffic apart from ordinary generative AI use.

Personnel: Mathew George

HPE Fighting AI with AI: Defending Against Zero-Day Threats

Watch on YouTube
Watch on Vimeo

Pradeep Hattiangadi and Naveen Toopran of HPE Networking demonstrate the adaptive threat defense framework for SRX firewalls, driven entirely from a third-party AI assistant. Using skills built on the Junos MCP server, the Juniper Secure Analytics MCP server, and Security Director Cloud APIs, they validate policy, tie AI application activity to user identity, and automatically contain a data exfiltration attempt. Hattiangadi, a technical marketing engineer for the SRX platforms, and Toopran, a product manager for SASE and security, presented at Security Field Day 16.

Hattiangadi played a SecOps administrator at a fictitious firm whose HR group was suspected of being targeted. From an assistant such as GitHub Copilot, he checked connectivity to the firewall, Security Director Cloud, and JSA. He then validated the HR group’s policy posture, found a missing enforcement rule, and applied the fix with a single confirmation. Security Director Cloud recognizes changes pushed directly to the firewall and does not overwrite them. Under the framework, users start on a baseline policy and HR uploads to sanctioned AI apps are monitored by new SRX data loss prevention capabilities. Repeated sensitive uploads within a set window raise a user’s risk and add controls. A detected reverse-connection exfiltration attempt moves the user into quarantine, with selective access left open so IT can fix the laptop. In the demo, one recruiter worked normally while Toopran found ChatGPT blocked. The assistant then built a timeline from logs filtered to each user’s IP, which showed the high-risk uploads and the threat that led to quarantine. A colleague on vacation showed no activity, which confirmed that nobody had borrowed her identity.

The team said the skills will be open sourced and work with any agent. The demo itself ran on an open-source model, while HPE fine-tunes its own back-end agents. DLP covers chat prompts, uploads, and downloads, and policies can be as granular as allowing uploads only to specific sanctioned apps. Security intelligence comes from ATP Cloud, and escalation feeds expire on a configurable timer, after which users return to normal access. A delegate argued that blocked users need a clear explanation, and the team pointed to a customizable block page. They framed the result as one closed loop in which an AI assistant configures, validates, investigates, and mitigates.

Personnel: Naveen Toopran, Pradeep Hattiangadi