network security operators

Abstract: AI-assisted cyber situational awareness triggers machine-generated reasoning traces (step-by-step justifications for anomaly classifications) that a human operator is expected to review. Because cyber signals and their traces arrive faster than any operator can process, human review is the limiting constraint on oversight. The standard approach is to identify the riskiest cyber events for review using model-side signals such as confidence or uncertainty. That framing ignores the operator's cognitive capacity which varies sharply with the operational environment. We propose an alternative where the system's environmental and connectivity telemetry serves as an available, non-invasive proxy for operator load. That same telemetry determines whether the human-AI partnership can reach the broader collective for support. In a maritime platform, environmental and connectivity attributes including depth, number of active communications paths, density of the tracked contact picture, and operational tempo all carry this signal. Need for operator oversight becomes a decision that materializes as a combination of both risk and environment-derived operator capacity. We present a reference architecture for a connectedness-aware oversight engine, demonstrating everyday use cases alongside its intended incorporation into the submarine cyber-defense toolkit. Two themes emerge: 1) the operator's environmental state is itself a connectedness measurement, and 2) connectedness drives the cognitive load and defines a collective boundary in human-AI cyber operations.

Abstract: Self-hosted large language model (LLM) serving is emerging as a distinct category of Internet service, but we still know little about how these deployments appear and change on the public Internet. We present a 365-day longitudinal measurement of exposed Ollama endpoints (port 11434) from February 2025 to February 2026, combining daily active probing with GeoIP/ASN enrichment, PTR and port-443 host observations, and survival analysis. Across 362 observation days and approximately 4.8 million IP$\times$day observations, 26.4% of the 152,137 cumulative IPs appear for a single day; across five selected CVEs, only 0.43-2.90% of below-fix IPs upgraded in place; the top five countries/regions account for over 70% of weighted observations; and cloud and hosting providers dominate the top ASNs. These results characterize exposed Ollama as a structural exposure surface: persistent, growing, and heavily concentrated. At the same time, old versions, common model choices, cloud and hosting ASNs, PTR categories, and TLS certificate patterns remain visible across the year, indicating recurring insecure deployment practices in cloud infrastructure and the potential reach of provider-level mitigation.