Ask an AI model to write a decoder for a medical device protocol. In seconds, it can produce code that looks convincing and may even run. But does it correctly identify the manufacturer, model, and firmware of devices communicating across a hospital network? That requires real evidence and validation.
Now imagine two teams with access to the same advanced AI. One starts with public documentation. The other has years of observed device traffic, verified profiles, protocol knowledge, and corrections from production deployments. The AI may be identical. The results are unlikely to be.
That is our thesis at ORDR: AI, data, and domain expertise work together. Access to AI alone is not a shortcut to dependable device classification.
What makes device classification difficult
Identifying a laptop or printer is relatively straightforward. Hospitals, factories, and utilities are different. Devices use proprietary protocols, old firmware, undocumented variations, and sometimes provide only limited passive signals.
ORDR classification engineers decode protocols, investigate unknown devices, distinguish observed attributes from inferred ones, maintain profiles as equipment changes, and determine how to collect additional evidence safely. The hard part is not just producing code; it is interpreting incomplete signals and validating an identity.
How ORDR uses AI today
- Faster: Draft protocol decoders, summarize vendor specifications, and cluster unfamiliar devices to accelerate investigation.
- Better: Detect subtle differences between models, identify inconsistent rules, and flag classification drift.
- More scalable: Automate repetitive maintenance so engineering effort can focus on difficult cases and deeper coverage.
These gains are meaningful precisely because AI operates on an established foundation of device intelligence—not a blank slate.
The three-legged stool
AI algorithms decode, correlate, cluster, and infer. Their capabilities are advancing rapidly and becoming accessible to everyone.
Domain expertise captures how clinical and industrial equipment actually behaves, which protocol fields are trustworthy, and which actions are safe. That knowledge lives in engineers, validated rules, and increasingly in models and automated workflows.
Data provides the evidence: representative traffic, verified profiles, unusual behaviors, and historical corrections collected across real environments.
Each leg strengthens the others. Expertise produces reliable data; data grounds AI; AI uncovers patterns and accelerates the growth and validation of device knowledge. The result is a continuously improving classification system.
Why AI alone does not close the gap
- Missing evidence: No model can directly observe a data field if it is absent from traffic. It can infer from other signals, but should reflect the uncertainty.
- Real-world variation: A decoder built from a specification must still withstand legacy firmware, vendor quirks, and undocumented behavior.
- Trustworthy identity: Similar devices can produce similar traffic. Verified reference data helps distinguish a plausible label from a defensible classification.
- Operational safety: Additional probing in hospitals and industrial settings must respect device-specific constraints.
- Continuous change: New models and firmware require fresh observations, corrections, and ongoing validation.
These are not arguments against AI. They explain why the quality of the evidence and knowledge available to AI determines the quality of its results.
Why ORDR is positioned to lead
ORDR built packet-level device classification capabilities long before generative AI became widespread. Years of deployments and vertical expertise across healthcare, manufacturing, finance, retail, transportation, and critical infrastructure have produced a substantial body of device profiles, observed behaviors, protocol knowledge, and validation experience.
That foundation lets ORDR apply AI to extend device coverage, distinguish manufacturer/model/firmware where evidence permits, separate observed from inferred attributes, test new decoders against real traffic, and incorporate field feedback into ongoing improvements.
Classification starts with discovery. ORDR extracts device data directly from more than 2,300 network infrastructure systems, including switches, routers, and firewalls, giving the classification engine a complete, continuously updated view of what is connected and where.
That evidence is matched against a curated library of more than 10 million device profiles that grows every day. ORDR then correlates it with information collected from more than 250 security and IT tools, and applies the combined data to prioritize the devices and risks that matter most.
A capable model can be licensed. A diverse, carefully validated body of real-world device intelligence takes years to build. As models improve, that foundation becomes more valuable—not less.
Where AI is going
Device classification will move from AI-assisted engineering toward increasingly autonomous discovery and validation. Systems will propose identities for unfamiliar devices, generate and test protocol hypotheses, detect drift, and learn from verified corrections. More domain knowledge will be encoded into models and automated workflows.
We welcome that progress. ORDR engineers can spend less time on repetitive decoding and more time on complex cases, validation architecture, safety, and expanding the intelligence behind the platform. The objective is not to preserve old workflows; it is to make trustworthy classification broader, deeper, and more adaptive.
As the same powerful AI becomes available to more vendors, the differentiator will be the quality of their data, accumulated knowledge, and feedback loops. AI amplifies those assets; it does not create years of validated field experience overnight.
The next shift is already around the corner. With the advent of micro LLMs, small, specialized models that run efficiently close to the network, feeding device-profile knowledge directly into AI-driven classification is becoming practical. Model architectures will be widely available, but the data used to train and ground them will not. Whoever owns the richest, most validated device data will win.
The real question
Can AI perform an increasing share of classification engineering? Absolutely. But can a team armed only with advanced AI, without years of curated device data and domain expertise, immediately reproduce a mature, reliable classification engine? No.
ORDR is not betting against AI. We are combining rapidly advancing AI with the device intelligence and validation foundation we have spent years building. That is how we intend to deliver faster, more accurate, and increasingly autonomous classification at scale.
To learn more about ORDR device intelligence, request a demo (opens in a new tab).