From Adversaries to Allies: Bridge the NetOps-SecOps Gap with Network Observability

@ema_research
| @ema_research
From Adversaries to Allies:
Bridge the NetOps/SecOps Gap
with Network Observability
Shamus McGillicuddy
VP of Research
Network Infrastructure and Operations
Enterprise Management Associates (EMA)
Daniel Smallwood
Software Senior Sales Engineer
LiveAction, a BlueCat Company

@ema_research
| @ema_research 2
Watch the On-Demand Webinar
• From Adversaries to Allies: Bridge the NetOps-SecOps Gap with
Network Observability On-Demand Webinar:
https://info.enterprisemanagement.com/bridge-the-netops-secops-
gap-with-network-observability-ss
© 2025 Enterprise Management Associates, Inc.

@ema_research
| @ema_research
@ema_research
| @ema_research
Featured Speakers
Shamus is a Vice President of Research at EMA,
where he leads the network infrastructure and
operations practice. He has nearly two decades of
experience in the IT industry. His research focuses on
all aspects of managing enterprise networks,
including network automation, AIOps-driven network
operations, multi-cloud networking, and WAN
transformation.
Daniel is a Senior Solutions Engineer with LiveAction
Software, a BlueCat Networks company. For over 20
years, Daniel has been a dedicated and versatile
Security engineer with a background in systems
engineering, information security, IT, and operations.
© 2025 Enterprise Management Associates, Inc. 3
Shamus McGillicuddy
VP of Research
Network Infrastructure and Operations
Enterprise Management Associates (EMA)
Daniel Smallwood
Software Senior Sales Engineer
LiveAction, a BlueCat Company

@ema_research
| @ema_research
NetSecOps
Partnerships are
Expanding

@ema_research
| @ema_research
@ema_research
| @ema_research
NetSecOps Alignment is Expanding
Source: EMA, ”NetSecOps: Examining How Network and Security Teams Collaborate for a Better Digital Future,” January 2024
Many network and security silos are collapsing
Collaboration between network and
security teams is intensifying

@ema_research
| @ema_research
@ema_research
| @ema_research
Poll Question 1
Over the last two years have you seen an increase or reduction in
collaboration between your organization’s networking and
security teams?
• Increased collaboration
• Reduced collaboration
• No change

@ema_research
| @ema_research
@ema_research
| @ema_research
Why are These Teams Coming Together?
Technologies and initiatives most responsible for collaboration:
40% IT/network automation strategy
31% Hybrid cloud
29% Secure access service edge
28% Internet of Things/operational technology
28% Multi-cloud architecture
24% Remote/Hybrid work
Business issues that
encourage collaboration:
30% IT labor issues/skills gaps
29% New regulatory
requirements
27% Recent cybersecurity
incidents
25% Budget challenges

@ema_research
| @ema_research
@ema_research
| @ema_research
Security Teams Need Network Data
96% say the security team’s
need to analyze network data
is driving collaboration
Subject matter experts
perceive this driver more than
management
Network data is a
bigger driver if an
organization has
experienced recent
cybersecurity
incidents
Concerns about
data quality rise
with this need for
network data

@ema_research
| @ema_research
@ema_research
| @ema_research
Packets are a Particular Focus
How valuable is it for your security team to have
access to full packet data associated with the traffic
that traverses your organization’s network?
Top use cases:
40% Investigating alerts from endpoint
security tools
35% Investigating alerts from network
security tools
33% Investigating alerts from SIEM/SOAR/XDR
30% Investigating data exfiltration – more
common in NOCs and in the midmarket
(1k to <5k people)
28% Investigating indicators of compromise
Network engineering and cybersecurity teams
are more likely to see the importance of packets

@ema_research
| @ema_research
Network
Observability and
Collaboration

@ema_research
| @ema_research
@ema_research
| @ema_research
89% of Network Teams Say Their Observability Solutions Provide Security Insights
Tools with valuable security insights correlate with
successful NetSecOps collaboration
Warning sign: IT middle management and executives
perceive more value than subject matter experts
How valuable are the security insights that your network
performance monitoring tools provide?
Insights of interest:
52% Network detection and response
43% Health/performance reporting on network security
infrastructure
40% Correlations of performance issues with indicators of
compromise
31% Inventory assessments
30% Forensic analysis of incidents

@ema_research
| @ema_research
@ema_research
| @ema_research
IT Pros Believe a Shared Monitoring Tool Across Network and Security Teams is
Valuable
Perceived value is higher when
NetSecOps collaboration is driven
by adoption of:
Secure access service edge
Public cloud, especially multi-cloud
If your network and security personnel adopted a shared tool for
network performance monitoring and network security monitoring, do
you think such a tool would be valuable?

@ema_research
| @ema_research
@ema_research
| @ema_research
Poll Question 2
Is your organization interested in adopting a shared network
monitoring tool that is used by both your networking and security
teams?
• Yes
• No
• We already have one

@ema_research
| @ema_research
@ema_research
| @ema_research
Potential Impacts of Shared Observability Tools
Faster incident response/problem resolution
Greater network coverage
Cost-efficiency
Proactive problem detection
Optimized data management
Collaboration enablement
Collaboration enablement has more
value when network and security
teams are siloed
Successful NetSecOps collaborators
focus on better data management
42%
40%
36%
36%
36%
32%

@ema_research
| @ema_research
@ema_research
| @ema_research
92% Perceive Barriers to Shared Observability
36% Security risk
27% Training requirements
26% Conflicts over budget/shared costs
26% Access control complexity
25% Contention over usage or access
24% Cultural resistance
22% Conflicts over tool strategy/selection
Perception gap about
challenges
IT executives (16%) and middle
managers (17%) more likely
than subject matter experts
(2%) to report no barriers

@ema_research
| @ema_research
NetSecOps
Outcomes and Best
Practices

@ema_research
| @ema_research
@ema_research
| @ema_research
Only 45% Report NetSecOps Collaboration is Completely Successful
Top Overall Challenges to NetSecOps Partnership

@ema_research
| @ema_research
@ema_research
| @ema_research
The Payoff: Top Benefits of NetSecOps Collaboration
43% Reduced security risk
40% Operational efficiency
40% Faster resolution of network and application trouble
39% Faster detection/resolution of security issues
39% Cost savings
35% Network resilience

@ema_research
| @ema_research
19
Executive buy-in is essential
Drive formalized best practices
Consolidate middle management
Expand budgets
Partial convergence is a half measure
that doesn’t work
Establish deep visibility into cloud traffic
Focus on optimizing
data management
across network and
security teams
Adopt network observability tools that provide:
Full packet visibility
Strong security insights
Application-layer intelligence (both app performance and
app security)
NetSecOps Best Practices

NetSecOps
Real-World Examples of Data Sharing Between NetOps & SecOps
Daniel Smallwood – LiveAction/BlueCat

DNS Data Sharing Boosts Both Teams
• Problem: DNS Attribution
• Security teams needed endpoint-level DNS data for threat hunting
• NetOps controlled DNS logs but were hesitant to expose production Active
Directory (AD) data
• Solution:
• NetOps enabled debug logging and provided read-only access to logs
• Risk was high due to production AD environment
• Impact:
• SecOps built a database to track IoCs (Indicators of Compromise) to endpoints
• Enabled User Behavior Analytics (UBA) around DNS activity
• SecOps detected anomalies in DNS operations, proactively informing NetOps

NetOps Leverages SecOps PCAP to
Uncover Layer 1 Issues
• Problem:
• Perimeter equipment showed unexplained performance issues
• SecOps noticed network anomalies in their logs
• Solution:
• Retrieved packet capture (PCAP) from a security device monitoring the
segment
• Impact:
• Analysis revealed excessive CSMA/CD jamming signals
(1010101010101010)
• Determined segment length exceeded IEEE 802.3 limits
• Led to targeted physical infrastructure corrections

VIP Account Lockout Investigation
• Problem:
• A VIP’s account repeatedly locked out, causing frustration
• NetOps suspected a systemic issue and sought SecOps help
• Solution:
• SecOps used behavioral data and tooling to identify the endpoint causing the
issue
• Found a forgotten laptop running with expired credentials, triggering lockouts at
intervals
• SecOps pinpointed the laptop’s location for NetOps to address
• Impact:
• NetOps resolved the issue, restoring their credibility with the VIP
• SecOps enhanced account lockout detection as part of their security
monitoring

@ema_research
| @ema_research
@ema_research
| @ema_research
Learn more about how LiveAction Software, a BlueCat company,
can help your organization!
Contact us at
sales@liveaction.com

From Adversaries to Allies: Bridge the NetOps-SecOps Gap with Network Observability

More Related Content

Similar to From Adversaries to Allies: Bridge the NetOps-SecOps Gap with Network Observability

More from Enterprise Management Associates

Recently uploaded

From Adversaries to Allies: Bridge the NetOps-SecOps Gap with Network Observability