Nepean Networks, a Fusion Broadband company, is attempting to solve the "visibility vs. decision" gap by automating the investigative phase of network anomaly detection. The company has launched Illuminate IQ, a managed network intelligence platform designed specifically for Managed Service Providers (MSPs) to investigate unusual network behavior. Rather than merely flagging traffic changes, the agentless platform aims to deliver completed findings to engineers, including evidence-based conclusions regarding devices that lack endpoint security coverage. This strategic shift targets the operational burden of manual investigation in complex, heterogeneous enterprise environments.
Automating Investigation via Illuminate IQ
The platform distinguishes itself from traditional Deep Packet Inspection (DPI) and standard monitoring by focusing on the "why" behind traffic shifts. While DPI identifies applications and destinations, Illuminate IQ is designed to examine device history, destination context, live threat intelligence, and peer behavior across a fleet. The system tests various explanations for anomalies, separates known facts from suspicions, and returns a finding accompanied by suggested next actions. This approach is intended to serve as an advisory layer that works alongside existing firewall, endpoint, identity, and SIEM platforms. By automating the initial investigative work, the platform seeks to transform raw visibility into actionable intelligence for human decision-makers.
Addressing the Endpoint Security Gap
A critical technical driver for Illuminate IQ is the visibility gap created by unmanaged devices. In a documented customer scenario involving 47 devices, only 12 possessed endpoint agents, leaving 35 devices—including payment terminals, cameras, printers, and VoIP handsets—without endpoint security or useful logs. The platform utilizes fleet comparison to identify outliers; a device may appear normal against its own history but can be flagged when compared to similar devices across independent networks. In one instance, the platform identified CCTV cameras uploading fragmented data via proprietary protocols to a high-risk country, escalating the activity as suspected firmware-driven data exfiltration. Currently, the technology has completed over 370,000 AI investigations across 5 million network anomalies in production.
Key Takeaways
- Illuminate IQ provides agentless investigation for devices lacking endpoint security, such as printers, cameras, and embedded systems.
- The platform has processed over 370,000 AI investigations across 5 million network anomalies in Australia, South Africa, the United States, and Canada.
- Illuminate IQ is available as a standalone sensor or on Nepean Networks and Fusion Broadband SD-WAN nodes, managed through Antares.
TechInsyte's Take
In our view, Nepean Networks is targeting a specific, high-friction pain point for MSPs: the "alert fatigue" caused by high-volume, low-context telemetry. By positioning Illuminate IQ as an investigative layer rather than a mere monitoring tool, the company is testing whether automated "pre-investigation" can effectively scale security operations without requiring a massive increase in headcount. The focus on unmanaged IoT and embedded devices is particularly strategic, as these assets represent a growing, blind-spot-heavy attack surface in enterprise IT. If the platform can consistently reduce the time between anomaly detection and human decision-making, it could become a vital component of the modern managed security stack.
Questions & Answers
How does Illuminate IQ differ from standard Deep Packet Inspection (DPI)?
While DPI identifies specific applications and destinations within traffic, Illuminate IQ investigates the underlying cause of behavior changes by analyzing device history, peer behavior, and threat intelligence to provide a completed finding.
Can Illuminate IQ monitor devices that do not have endpoint security installed?
Yes. The platform is agentless and specifically designed to provide visibility and investigation for devices like printers, VoIP handsets, and cameras that cannot run endpoint security agents.
What is the role of the human engineer in the Illuminate IQ workflow?
The platform is designed to be advisory; it automates the investigative work and provides evidence and suggested actions, but the final decision and response remain under the control of the human engineer.
Where is Illuminate IQ currently deployed and how is it managed?
The platform is currently in production across Australia, South Africa, the United States, and Canada, and it is managed through the Antares platform.
Source: Nepean Networks
