Autonomous
NOC
5-Agent AI Platform for Network Operations. From syslog to fix in 16–20 seconds. Human-in-the-loop, not human-in-the-way.
Eduard Dulharu, CTO — vExpertAI GmbH (CCIE)
90 Minutes. One Decision.
Eight focused segments, each building the case for autonomous network operations.
0–10 min
The Problem
Alert fatigue, 3% automation, DORA is live
10–20 min
Why Now
DORA enforcement, NIS2, €100M/day exposure
20–35 min
Live Demo
5 agents, real routers, 16-second E2E
35–45 min
Architecture
ACP / A2A / MCP stack, fine-tuned models
45–60 min
ROI
€309K savings, 226% ROI, 3.7 month payback
60–75 min
Partnership
3 offers, revenue model, pilot scope
75–90 min
Client Fit
Projecting into your clients' environments
90+ min
Next Steps
Name a client, agree a 3-week follow-up
Three Questions Every NOC Director Dreads
Ask these to any enterprise NOC director. The answers are the business case.
How many alerts does a NOC with 1,000 devices receive per day?
2,000 – 10,000
At TotalEnergies scale: 100,000/day. 70% are false positives.
What % of network operations is fully automated today?
< 3%
After decades of Ansible, Terraform, playbooks — 97% is still human labor.
Were your banking clients DORA-compliant on January 17, 2025?
Very few.
Automated network incident detection is mandatory. The deadline has passed.
The Compliance Clock Is Running
This is not a 'nice to have' conversation. It is a compliance crisis with a named deadline and a daily financial penalty.
- Enforced since January 17, 2025
- 4-hour window to report major incidents
- Automated detection is mandatory
- Penalty: 1% of daily turnover per day
- For a €10B bank: €100M/day exposure
- Boursorama, BNP, SG — all in scope
- ACPR & Banque de France as enforcer
- 18 sectors including energy, banking, health
- TotalEnergies, Nexans, Adecco in scope
- 24h initial / 72h final incident report
- Sales cycle = 3–6 months
- Start now = ready before enforcement
- ANSSI as French national authority
- SecNumCloud sovereign deployment available
5-Agent Autonomous NOC
AI diagnoses, generates, verifies. Human approves or rejects. One decision.
End-to-End Pipeline
Human-in-the-loop, not human-in-the-way
AI diagnoses, generates, verifies. Human approves or rejects. One decision.
Specialist beats generalist
5 fine-tuned 7-8B models. Each domain-expert. OSPF, BGP, Security, Interface, Design.
No unverified fix reaches a human
3-pass Digital Twin gate. Graph sim → FRR clone → Confidence score. Tested before shown.
5-Layer Protocol-Compliant Stack
Every layer uses an industry-standard protocol. Click any layer to explore its components.
How We Guarantee Safe Fixes
The LLM can be wrong. Every proposed fix is tested in an isolated clone before a human ever sees it. A bad fix never reaches the approval queue.
Digital Twin Validation Flow
Live Network vs. Isolated Digital Twin — step-by-step animated walkthrough
What You Are About to See
Three real-world scenarios on live Cisco CSR1000v routers. Run each simulation to see the AI pipeline in action.
OSPF Hello Timer Mismatch
Stability Agent · Qwen-2.5-7B
EXECUTION TIMELINE
Misconfigure hello timer on R1
neighbor down event triggered
AI collects live OSPF data via MCP
show ip ospf neighbor · show run
Diagnoses timer mismatch
hello 10s vs 40s dead timer conflict
Proposes fix
no ip ospf hello-interval
Digital Twin validates
OSPF adjacency restored to FULL
Card sent to human approval
gate score 1.0 — safe to apply
Product 1 — scanner.vexpertai.com
Select any vendor (Cisco, Juniper, Palo Alto, Fortinet), enter platform + version + features, and get a CVE list, DORA/PCI compliance gaps, and AI-proposed remediation in ~30 seconds.
HOW IT WORKS
ROI — The Numbers
400 incidents/month baseline. Conservative estimate. From go-live.
NOC Labor Math — France
CNS Revenue Model (5 clients)
Three Offers on the Table
Choose the engagement model that fits CNS's timeline and risk appetite.
Paid Pilot
- scanner.vexpertai.com + AI NOC together
- DORA compliance story for financial clients
- Milestone payments — pay for what's delivered
- Discovery → Deploy → Shadow → Live mode
- Target: Boursorama, TotalEnergies, Nexans
- Ask: Name one client. Agree a joint call date.
Co-Development Partnership
- Joint DORA/NIS2 compliance module
- AI SOC beta — CNS shapes the product
- French-sovereign, no US vendor can match
- CNS becomes first partner in production
- Formal MOU + revenue-sharing model
- Ask: Agree 3-week follow-up for formal terms.
AI Champion Program
- Covers all 3 products: scanner, NOC, SOC
- CNS-branded certification program
- 4 months, live system as hands-on lab
- Year 2: train-the-trainer, CNS keeps 100%
- Target: 2–3 consultants per client team
- Ask: Schedule Track 1 for May 2026.
Projecting Into Your Client Environments
Three CNS clients with immediate fit. Pain mapped to solution. Deployment timeline indicated.
Boursorama
Banking (SG Group) · DORA regulated
MTTR 4–8 hours. DORA requires 4-hour reporting. Every day is a compliance liability.
scanner.vexpertai.com generates the ICT risk register. AI NOC cuts MTTR to minutes. DORA Article 17+18 satisfied on day one.
TotalEnergies
Energy · Global estate · NIS2 scope
100K alerts/day. BGP instability between trading systems. Compliance documentation manual.
AI NOC handles routing protocol diagnosis autonomously. Audit trail is the compliance artifact. SecNumCloud deployment available.
Nexans
Manufacturing · Global supply chain
35+ countries, mixed-vendor gear, no unified NOC visibility. Security policy drift across acquisitions.
Vendor-agnostic platform. Cisco + others. Security agent handles ACL drift. Champion program trains local IT teams.
All deployments: on-premise or OVHcloud SecNumCloud · Vendor-agnostic · Zero config data leaves client perimeter
Handling the Hard Questions
Every objection has been heard. Every answer is grounded in architecture.
AI hallucinations are dangerous
The LLM cannot SSH to routers — it can only PROPOSE. 3 gates before any human sees it: confidence scorer → graph simulation → FRR container clone. Safer than your L1 engineer at 3am.
We already have Dynatrace / Splunk
We integrate with them. We add the reasoning layer on top. Not a replacement — an orchestrator. Your existing stack stays. We make it intelligent.
How is this different from Cisco AI?
Cisco requires all-Cisco gear. 90% of enterprises are mixed-vendor. We're vendor-agnostic. And Cisco sends your config to their cloud — we run 100% on-premise.
Data sovereignty / ANSSI compliance?
Zero data leaves client perimeter. OVHcloud SecNumCloud deployment available. AWS and Azure are NOT SecNumCloud certified — we are the only credible sovereign answer.
What if the pilot fails?
Fixed scope, fixed price, success criteria in the contract. Milestone payments — you only pay for what's delivered. Risk is bounded by design.
The timing isn't right
DORA is already enforced. NIS2 enforcement starts 2027 — 18 months away. Sales cycle is 3–6 months. Start now or you're in the crisis window.
AI SOC — Co-Development Opportunity
25–30% to production. 9 sprints · ~9 months. CNS shapes what AI SOC looks like in production.
5 Autonomous Security Agents
Triage Agent
4-track ML engine. Eliminates noise before it reaches humans. Sub-30s detection.
Investigation Agent
Evidence-grounded root cause. Pulls from SIEM, EDR, network flows. Every verdict requires citations.
Security Agent
Detects AI-generated threats via behavioural ML, malware analysis, semantic phishing + TLS fingerprinting.
Hunt Agent
Proactive threat hunting across network graph. Connects dots across hosts, users, and time.
Remediation Agent
Human approval gate + pre-registered rollback. Every action reversible. Nothing touches production unvalidated.
The CNS Opportunity — Offer 2
Two Things Before We Leave
Name One Client
Not a signed contract. A name and a date for a joint technical scoping call. 10-week pilot, fixed scope, milestone payments.
Agree a 3-Week Follow-Up
Formal co-development partnership terms. Revenue-sharing model. MOU scope. DORA/NIS2 compliance module joint IP.
"Two things before we leave. First — name one client for the 10-week pilot. Not a signed contract today. A name and a date for a joint call. Second — agree a 3-week follow-up where we present the formal co-development terms. Can we agree on both today?"