DDI for AI-Driven Operations: Key Use Cases

AI is playing an increasingly prominent role in network operations and security. In our last blog, we explored why trusted network knowledge is the foundation for AI-driven NetOps. This follow-up explores how teams can put that trusted network knowledge to work. Based on a customer survey, it examines three complementary use cases around DDI for AI-driven operations: AI assistants accessing DDI context, AI assistance within daily DDI operations, and governed agentic workflows. 

Key Takeaways

• Trusted network knowledge is the foundation for useful AI-driven operations. AI needs reliable context about infrastructure, assets, relationships, ownership, policy, and history, and DDI, as part of a broader Network Source of Truth, can provide it to AI assistants and agents.
• Investigation and troubleshooting are the leading use cases. Troubleshooting (63%) was the most valued query for enterprise AI assistants, while DNS/DHCP anomaly detection (68%) topped the list of proactive capabilities, showing that teams prioritize detecting issues early, understanding their causes, and resolving them faster.
• AI-driven operations must remain governed and verifiable. Most surveyed customers (59%) want AI to analyze, recommend, or propose changes that humans review, only 4.5% favor extensive automation, and direct access to raw DDI data (55%) was the most requested way to verify AI insights.

What Do Teams Want AI to Improve First?

It’s easy to fall into the trap of investing in AI for its own sake, but among surveyed EfficientIP customers, operational outcomes were the leading priorities. 

Proactive problem prevention and faster incident resolution topped the list, selected by 59% of customers, followed by reduced toil, manual work, and configuration errors at 56%. Better network performance and lower security risk were the next most common priorities.

Taken together, the results show a clear focus on reducing workloads and taking a more proactive approach to managing the network. Teams want to spot problems before users notice them, spend less time piecing together evidence by hand, and work from operational data they can rely on. The goal is to make every change better informed and leave performance and security in a stronger position.

How Can AI Assistants Use Trusted DDI Context to Investigate?

The first and most direct use case we explored connects the enterprise AI assistants teams already use to their DDI platform. Giving trusted network context makes it easier to answer network questions without manually digging through records. A Model Context Protocol (MCP) server is one effective way to do this, giving the assistant access to DNS zones and records, IP allocations, DHCP leases, and the ownership details behind them.

Troubleshooting was the most valued query we saw, selected by 63% of customers, with threat investigation and audit reporting close behind. An engineer might ask why an application keeps generating NXDOMAIN failures, for example, and get an answer grounded in real records rather than guesswork.

While easier access to DDI data is beneficial, the real value comes from giving AI tools trusted context to support investigations across both network and security workflows.

What Does Embedded AI Assistance Look Like Day to Day?

The second use case moves AI inside the DDI platform itself, so help sits where operators configure and troubleshoot the network. There are two main kinds of support AI can offer here.

First, reactive assistance responds to what an operator asks for. Documentation Q&As were the most popular use case we saw, followed by guided configuration and API help. This approach is helpful for tasks such as preparing the subnet and DHCP recommendations needed to support additional users, or asking for guidance on configuring a policy.

Proactive assistance meanwhile goes further by raising issues before anyone thinks to look. Anomaly detection in DNS and DHCP behavior was the most popular use case here (68%), followed by root-cause assistance, while capacity planning and drift detection also attracted interest.

With either approach, assistants can do far more than answer simple queries, adding value by applying operational knowledge to specific configurations, investigations, or decisions.

How Can AI Help Teams Move from Investigation to Action?

Next, AI’s role can move beyond explaining a problem to recommending a course of action and even carrying it out once approved. That means correlating evidence, identifying likely causes, drafting remediation steps, and validating changes before they go ahead.

Automated root-cause analysis with remediation recommendations was the leading scenario, selected by 51% of customers. One respondent described how much more involved agentic AI can be than a simple command like ‘delete an obsolete DNS record.’

Instead, their process included identifying dangling CNAME records and the applications that depend on them, preparing the change request, notifying support teams and seeking approval, then removing the records with a way to restore them before closing the change.

This approach doesn’t replace the initial command but orchestrates a range of activities around it into a controlled operational workflow.

Why Data Quality Connects All AI Use Cases

AI is only as useful as the network knowledge behind it, and when respondents described their own workflows in open answers, data quality, reconciliation, and cleanup came up more than any other theme.

Some of the most common issues include stale or orphaned DNS records, conflicting IP allocations, and IPAM drifting out of step with CMDBs, spreadsheets, and fast-changing cloud resources. AI is well placed to tackle these problems with its ability to rapidly analyze data sets. Comparing assets found through discovery, along with their IP and MAC addresses, against what IPAM says should be there gives AI the evidence it needs to flag and prioritize discrepancies quickly.

The result is a two-way relationship in which trusted network knowledge makes AI more useful, and AI in turn helps maintain that knowledge. It is also why having a reliable Network Source of Truth (NSoT) matters so much.

For DNS Security Teams, AI Is About Context as Much as Detection

For DNS security teams, spotting a suspicious query is only the starting point. The real work is understanding what it means, and teams want AI to build that picture for them.

An ideal workflow identifies which clients are involved, links them to assets and owners through IPAM, checks which policy applies, assesses the scope, and recommends a response.

An example query might be asking which internal clients had queried a newly identified malicious domain in the past 24 hours, and who owns those devices.

Security posture and compliance was another area of high interest, with teams wanting help spotting assets that lack required security tags or show unusual DNS traffic.

Ultimately, AI’s value in DNS security lies in turning signals into contextual intelligence teams can act on.

Why Trust and Control Are Part of the Architecture

Across every use case, respondents were clear that AI’s speed should not come at the expense of operational control.

Most respondents (59%) preferred AI analysis and recommendations, or proposed changes that a human reviews and carries out, while only 4.5% would accept extensive automation for routine operations. Trust also depends on being able to check the work, and direct access to raw DDI data for verifying AI conclusions was the most requested safeguard (55%).

It’s clear most teams want to see the evidence and how an AI reached its decision and know what the tool can access and change, as well as checking the outcome first and roll back if needed. Human oversight is not a brake on AI-driven operations, but rather is part of what makes them workable in production.

What Is the Practical Value of DDI for AI-Driven Operations?

As AI takes on a greater role in network and security operations, the quality of the data and context it relies on becomes critical. DDI provides the trusted network knowledge AI needs to investigate faster, make better-informed decisions, and support governed operational actions. The real opportunity is not automation for its own sake, but faster, more effective operations, reduced manual effort, and greater agility—with the confidence and control to scale AI-driven operations.