BOOK SIX · CHAPTER 7
Five Minutes at the Camera
What a broad shutdown costs.
When you can't tell which device is the problem, you're left with one move. Shut everything down.
INDEPENDENT EVIDENCE
On July 25, 2025, the city of Saint Paul, Minnesota, detected attackers inside its systems. Within days, the mayor declared a local emergency and the governor called in the National Guard's cyber protection team. The city shut down much of its network to contain the attack, and city services were disrupted. The Guard's cyber team stayed for 17 days. A ransomware gang called Interlock later took credit. The city refused to pay.
Officials have not said how the attackers got in. Nothing in the public record ties Saint Paul to a camera or a door. It belongs here for one reason: it shows what a broad shutdown costs a government that has to keep serving the public.
ANONYMOUS GOVERNMENT ACCOUNT · REAL ATTACK
Five minutes.
That's how long someone outside spent trying to break into a government network through its cameras.
They wanted a way in. The cameras looked like one.
A Findavi appliance was already on that network, listening. It caught the attempt and sent the security team one recommendation: block the connection.
A person read it and said yes. Findavi blocked it.
Then it checked two things. Is the way in shut? Yes. Are the cameras still recording? Yes.
The attacker never got past the cameras. The cameras never stopped watching.
Confirmed by NetOps IQ’s CTO. Published with customer approval. Agency and location withheld.
Seven steps. Two checks.
Every Findavi action follows the same seven steps.
1. Spot. See behavior that doesn't fit the device.
2. Check the rules. Is this action allowed for this device, at this time?
3. Ask. If a person must approve, send one clear recommendation and wait.
4. Act. Block the device, isolate a port or push a configuration change, for supported devices only.
5. Check security. Test the path again. Is it closed?
6. Check service. Is the device still doing its job?
7. Record. Keep the finding, the approval, the action and both results in one place.
You decide how much Findavi does on its own
Observe. Findavi finds problems and recommends fixes. It changes nothing.
Approve. Findavi proposes the fix. A person says yes before it runs. That's the mode the cameras above were in.
Autonomous. Findavi acts on its own, within limits your team set in advance.
You choose the mode for each device and each action. Your team can stop or switch off any Findavi agent at any time. With a person's approval, Findavi can restore a device's previous settings. Every action is recorded.