Skip to main content

Exploring the Convergence of Observability and Security - Part 8: Getting There

Pete Goldin
APMdigest

With input from industry experts — both analysts and vendors — this is the final installment of the 8-part blog series exploring the convergence of observability and security.

Start with: Exploring the Convergence of Observability and Security - Part 1

Start with: Exploring the Convergence of Observability and Security - Part 2: Logs, Metrics and Traces

Start with: Exploring the Convergence of Observability and Security - Part 3: Tools

Start with: Exploring the Convergence of Observability and Security - Part 4: Dashboards

Start with: Exploring the Convergence of Observability and Security - Part 5: Teams

Start with: Exploring the Convergence of Observability and Security - Part 6: Challenges

Start with: Exploring the Convergence of Observability and Security - Part 7: Advantages

So, has this blog series exploring the convergence of observability and security encouraged you to move your IT department in this direction? If this is the case, the experts offer a few tips:

Set the agenda from the top

Shamus McGillicuddy, VP of Research, Network Infrastructure and Operations, at Enterprise Management Associates (EMA): "CIOs and CISOs have to set the agenda. They need to make it clear from the top that these groups need to converge or collaborate. Most technical personnel believe that their leaders are only doing a so-so job on this. It starts by mandating that teams adopt formalized best practices and policies for how they're going to work together."

Use the player or download the MP3 below to listen to EMA-APMdigest Podcast Episode 2 — Shamus McGillicuddy talks about Network Observability, the convergence of observability and security, and more.

Click here for a direct MP3 download of Episode 2 - Part 1

Communicate

Asaf Yigal, CTO of Logz.io: "At the end of the day, it is all about communication. If you are employing a shared platform for observability and security, where and how do you take the available information and turn that into meaningful actions? The new channels that need to be established to communicate something like Kubernetes security across Dev, Sec and Ops, are a good place to start."

Yigal adds: "When a security issue is found, who is able to mitigate that risk? Who understands the impact of the related service on critical business ops? And who can or should prioritize response? These are the questions that need to be considered and refined as we move forward. It's always an iterative process and ideally an agile approach. The success of this is always going to revolve around clear lines of communication."

Collaborate

Gregg Ostrowski, CTO Adviser at Cisco AppDynamics: "Successfully merging security and observability will require technologists to shift their culture. Security, developer and ITOps teams may be used to operating in silos, but they will need to collaborate as one team when combining security and observability strategies."

Kirsten Newcomer, Director, Cloud and DevSecOps Strategy at Red Hat: "The best advice I can offer is that it's important to work to collaborate across teams during evaluation of such solutions. Especially if those teams have traditionally been silo'd."

Esteban Gutierrez, CISO & VP, Information Security at New Relic: "My effectiveness as a cybersecurity leader is wholly dependent on the effectiveness of my team. With that in mind I coach my teams to hold as a key principle that their first job is relationship management. The investments we make in cybersecurity controls, policies, procedures can have a profound impact on the ability for all employees in a company to do their work, deliver on business commitment, and corporate goals. When we partner with them as collaborators for how we spend our investments, we see much greater buy-in and much greater value from those investments because that collaboration allows us to truly meet the needs of the business with greater trust and security."

Foster a culture of shared responsibility

Roger Floren, Principal Product Manager at Red Hat: "Aim for a culture of shared responsibility for both security and performance and have training- and knowledge-sharing days."

Build a culture of continuous transformation

Colin Fallwell, Field CTO of Sumo Logic: "Build communities of practice and build a culture that embraces continuous transformation. Find variability and stomp it out by mapping the value streams, consistently measuring the processes that enable them and continuously improving them."

Reorganize Middle Management

Shamus McGillicuddy from EMA: "It may also require some reorganization or convergence of groups. More likely it may require some reorganization of middle management, since middle managers are going to resist these changes (They want to protect their power)."

Develop Security Talent within DevOps

Prashant Prahlad, VP of Cloud Security Products at Datadog: "For companies that want to converge security and operations, they should start by developing security talent within DevOps teams through training — it is a career growth opportunity and will help with retention."

Prahlad adds: "Teams should also ensure that the security bar is as high (if not higher) with teams converged as it was when the security function was centralized. Finally, the DevOps team members who become security experts should represent the team for any and all security-related matters. This will allow them to evangelize the approach externally."

Shift Left

Colin Fallwell of Sumo Logic: "Shift left security into the assembly line of developing, building, testing, and shipping software."

Buddy Brewer, Chief Product Officer at Mezmo: "To move forward, organizations need to start by incorporating security processes into their software development lifecycle. They should establish new processes with security, developer, and ITOps teams working together with the same data."

Amit Shah, Director of Product Marketing at Dynatrace: Organizations are struggling to achieve the mindset shift required to maximize the impact of DevSecOps approaches. It's not enough to simply make developers responsible for security in pre-production. They must also be empowered to ensure their applications continue to run securely in production. To achieve this, organizations need technologies that can connect development and runtime security to eliminate blind spots and improve governance throughout the software delivery lifecycle.

Provide Support and Resources

Joe Byrne, VP of Technology Strategy and CTO Adviser at Cisco AppDynamics: "Organizations should be certain their technologists are prepared for the cultural shift by offering them the support and resources needed to expand their skillset and operate effectively as an integrated team."

Find Tools that integrate

Adam Hert, Director of Product at Riverbed: "IT teams don't have to find a single solution that does all this in once — you simply won't find a strong SecOps and observability tool all in one package. When you shop around for tools separately, make sure the tools integrate properly. And, most importantly, make sure all teams can get the data they need from the observability tool."

Use a Single Platform

Ajit Sancheti, GM, Falcon LogScale at CrowdStrike: "For organizations looking to pursue an observability and security approach, we highly recommend that they consider a single platform to meet their security and observability needs. Also, during the process of selecting a single vendor for observability and security, they should make sure the vendor addresses their performance, scale, latency and budget requirements. Most importantly, organizations should ensure that their roadmap and vision aligns to the needs of the various teams that will be using the product, including DevOps, ITOps and SecOps."

Avoid Vendor lock-in

Colin Fallwell of Sumo Logic: "Invest in vendors that you can opt into, and don't lock you in with proprietary methods of telemetry collection."

Use an Enterprise Telemetry Pipeline

Buddy Brewer of Mezmo: "Organizations should consider tools such as enterprise telemetry pipelines that bring all data together, transform data, and route it to the right teams to break down the silos and create a true single source of truth for all teams."

Use AI and Automation

Amit Shah of Dynatrace: "Enlist trusted AI and extensive automation to minimize the manual effort of vulnerability management and free developers to focus on the tasks that are core to their role, unlocking the true potential of DevSecOps."

Share budgets

Shamus McGillicuddy from EMA: "IT leaders need to make it clear that these groups can and should share budgets on investments that help them work together (converged tools, better data collection engines, etc.)."

Don't be Frupid

Take the 2023 SRE Survey

Leo Vasiliou, Director of Product Marketing at Catchpoint: "Don't be frupid (portmanteau of frugal and stupid) when evaluating capabilities. They are the gateway to positive business outcomes, which are more valuable than dollar cost on a piece of paper will indicate."

Conclusion

After exploring the convergence of observability and security, my final question to the experts was: What is the timeframe for convergence?

"Talking about timeframes is a very easy way to be wrong," Mike Loukides, VP of Emerging Tech Content at O'Reilly Media answered. "I'm sure complete convergence has already happened for some organizations on the leading edge. And some organizations will never make it. Lately, I've been quoting Eben Hewitt (CIO, Hyatt) a lot: 'No technology has succeeded until it's become a cargo cult.' On the trailing edge, we'll see a lot of companies that claim convergence between operations and security, but have only renamed their old processes. That will be dangerous."

"The great news is that as I speak to IT leaders, they are already converging on the notion of bringing their NetOps, SecOps and even DevOps teams together," says Chaim Mazal, Chief Security Officer at Gigamon. "Many clearly see the immediate advantages of gaining deep observability across their hybrid and multi-cloud infrastructure and understand the critical importance of delivering defense in depth. I fully expect this trend will accelerate in the coming year, faster than any of us might anticipate."

"The combination of security and observability is quickly gaining momentum, and as organizations continue to expand, it will become a standard in no time," says Gregg Ostrowski from Cisco AppDynamics.

Amit Shah of Dynatrace cites research showing 88% of CIOs say the convergence of observability and security practices will be critical to building a DevSecOps culture, and 90% say increasing the use of AIOps will be key to scaling up these practices. The convergence of observability and security is already an essential practice, however, the proliferation of the cloud will only increase its necessity.

On the other hand, Adam Hert of Riverbed warns that convergence is going to take a long time. "It is happening now but will take several years to achieve complete convergence. We have been talking about this for the past 15-20 years and the industry is still working through it."

Buddy Brewer from Mezmo responds, "It may take years as they are likely sitting on mountains of data, hundreds of data sources and observability and security platforms, and dozens of cross-functional use cases to have a unified approach. On the other hand, SMBs where many times the CIO and CISO are the same person, can transition much faster as they are more agile and can adjust quickly to the convergence."

"As for the timeframe, it's already happening," Fallwell of Sumo Logic reiterates. "As data convergence continues to accelerate, schemas will continue to standardize, and Artificial Intelligence, Machine Learning, and Machine Reasoning will continue to accelerate. As with just about every technology, there is always the promise of a better tomorrow."

Pete Goldin is Editor and Publisher of APMdigest

The Latest

The rise of hybrid cloud environments, the explosion of IoT devices, the proliferation of remote work, and advanced cyber threats have created a monitoring challenge that traditional approaches simply cannot meet. IT teams find themselves drowning in a sea of data, struggling to identify critical threats amidst a deluge of alerts, and often reacting to incidents long after they've begun. This is where AI and ML are leveraged ...

Three practices, chaos testing, incident retrospectives, and AIOps-driven monitoring, are transforming platform teams from reactive responders into proactive builders of resilient, self-healing systems. The evolution is not just technical; it's cultural. The modern platform engineer isn't just maintaining infrastructure. They're product owners designing for reliability, observability, and continuous improvement ...

Getting applications into the hands of those who need them quickly and securely has long been the goal of a branch of IT often referred to as End User Computing (EUC). Over recent years, the way applications (and data) have been delivered to these "users" has changed noticeably. Organizations have many more choices available to them now, and there will be more to come ... But how did we get here? Where are we going? Is this all too complicated? ...

On November 18, a single database permission change inside Cloudflare set off a chain of failures that rippled across the Internet. Traffic stalled. Authentication broke. Workers KV returned waves of 5xx errors as systems fell in and out of sync. For nearly three hours, one of the most resilient networks on the planet struggled under the weight of a change no one expected to matter ... Cloudflare recovered quickly, but the deeper lesson reaches far beyond this incident ...

Chris Steffen and Ken Buckler from EMA discuss the Cloudflare outage and what availability means in the technology space ...

Every modern industry is confronting the same challenge: human reaction time is no longer fast enough for real-time decision environments. Across sectors, from financial services to manufacturing to cybersecurity and beyond, the stakes mirror those of autonomous vehicles — systems operating in complex, high-risk environments where milliseconds matter ...

Technology's role in the workplace has expanded rapidly, framing how we work and communicate. Now, with the explosion of new and innovative AI-driven tools, people are struggling to navigate how to work in this new emergent era. And although the majority of these applications are designed to make our lives easier, for many knowledge workers, they've become a source of stress and anxiety. "Technostress" ... describes the feelings of being overwhelmed by constant connectivity and cognitive overload from information and notifications, and it's on the rise ...

People want to be doing more engaging work, yet their day often gets overrun by addressing urgent IT tickets. But thanks to advances in AI "vibe coding," where a user describes what they want in plain English and the AI turns it into working code, IT teams can automate ticketing workflows and offload much of that work. Password resets that used to take 5 minutes per request now get resolved automatically ...

Governments and social platforms face an escalating challenge: hyperrealistic synthetic media now spreads faster than legacy moderation systems can react. From pandemic-related conspiracies to manipulated election content, disinformation has moved beyond "false text" into the realm of convincing audiovisual deception ...

Traditional monitoring often stops at uptime and server health without any integrated insights. Cross-platform observability covers not just infrastructure telemetry but also client-side behavior, distributed service interactions, and the contextual data that connects them. Emerging technologies like OpenTelemetry, eBPF, and AI-driven anomaly detection have made this vision more achievable, but only if organizations ground their observability strategy in well-defined pillars. Here are the five foundational pillars of cross-platform observability that modern engineering teams should focus on for seamless platform performance ...

Exploring the Convergence of Observability and Security - Part 8: Getting There

Pete Goldin
APMdigest

With input from industry experts — both analysts and vendors — this is the final installment of the 8-part blog series exploring the convergence of observability and security.

Start with: Exploring the Convergence of Observability and Security - Part 1

Start with: Exploring the Convergence of Observability and Security - Part 2: Logs, Metrics and Traces

Start with: Exploring the Convergence of Observability and Security - Part 3: Tools

Start with: Exploring the Convergence of Observability and Security - Part 4: Dashboards

Start with: Exploring the Convergence of Observability and Security - Part 5: Teams

Start with: Exploring the Convergence of Observability and Security - Part 6: Challenges

Start with: Exploring the Convergence of Observability and Security - Part 7: Advantages

So, has this blog series exploring the convergence of observability and security encouraged you to move your IT department in this direction? If this is the case, the experts offer a few tips:

Set the agenda from the top

Shamus McGillicuddy, VP of Research, Network Infrastructure and Operations, at Enterprise Management Associates (EMA): "CIOs and CISOs have to set the agenda. They need to make it clear from the top that these groups need to converge or collaborate. Most technical personnel believe that their leaders are only doing a so-so job on this. It starts by mandating that teams adopt formalized best practices and policies for how they're going to work together."

Use the player or download the MP3 below to listen to EMA-APMdigest Podcast Episode 2 — Shamus McGillicuddy talks about Network Observability, the convergence of observability and security, and more.

Click here for a direct MP3 download of Episode 2 - Part 1

Communicate

Asaf Yigal, CTO of Logz.io: "At the end of the day, it is all about communication. If you are employing a shared platform for observability and security, where and how do you take the available information and turn that into meaningful actions? The new channels that need to be established to communicate something like Kubernetes security across Dev, Sec and Ops, are a good place to start."

Yigal adds: "When a security issue is found, who is able to mitigate that risk? Who understands the impact of the related service on critical business ops? And who can or should prioritize response? These are the questions that need to be considered and refined as we move forward. It's always an iterative process and ideally an agile approach. The success of this is always going to revolve around clear lines of communication."

Collaborate

Gregg Ostrowski, CTO Adviser at Cisco AppDynamics: "Successfully merging security and observability will require technologists to shift their culture. Security, developer and ITOps teams may be used to operating in silos, but they will need to collaborate as one team when combining security and observability strategies."

Kirsten Newcomer, Director, Cloud and DevSecOps Strategy at Red Hat: "The best advice I can offer is that it's important to work to collaborate across teams during evaluation of such solutions. Especially if those teams have traditionally been silo'd."

Esteban Gutierrez, CISO & VP, Information Security at New Relic: "My effectiveness as a cybersecurity leader is wholly dependent on the effectiveness of my team. With that in mind I coach my teams to hold as a key principle that their first job is relationship management. The investments we make in cybersecurity controls, policies, procedures can have a profound impact on the ability for all employees in a company to do their work, deliver on business commitment, and corporate goals. When we partner with them as collaborators for how we spend our investments, we see much greater buy-in and much greater value from those investments because that collaboration allows us to truly meet the needs of the business with greater trust and security."

Foster a culture of shared responsibility

Roger Floren, Principal Product Manager at Red Hat: "Aim for a culture of shared responsibility for both security and performance and have training- and knowledge-sharing days."

Build a culture of continuous transformation

Colin Fallwell, Field CTO of Sumo Logic: "Build communities of practice and build a culture that embraces continuous transformation. Find variability and stomp it out by mapping the value streams, consistently measuring the processes that enable them and continuously improving them."

Reorganize Middle Management

Shamus McGillicuddy from EMA: "It may also require some reorganization or convergence of groups. More likely it may require some reorganization of middle management, since middle managers are going to resist these changes (They want to protect their power)."

Develop Security Talent within DevOps

Prashant Prahlad, VP of Cloud Security Products at Datadog: "For companies that want to converge security and operations, they should start by developing security talent within DevOps teams through training — it is a career growth opportunity and will help with retention."

Prahlad adds: "Teams should also ensure that the security bar is as high (if not higher) with teams converged as it was when the security function was centralized. Finally, the DevOps team members who become security experts should represent the team for any and all security-related matters. This will allow them to evangelize the approach externally."

Shift Left

Colin Fallwell of Sumo Logic: "Shift left security into the assembly line of developing, building, testing, and shipping software."

Buddy Brewer, Chief Product Officer at Mezmo: "To move forward, organizations need to start by incorporating security processes into their software development lifecycle. They should establish new processes with security, developer, and ITOps teams working together with the same data."

Amit Shah, Director of Product Marketing at Dynatrace: Organizations are struggling to achieve the mindset shift required to maximize the impact of DevSecOps approaches. It's not enough to simply make developers responsible for security in pre-production. They must also be empowered to ensure their applications continue to run securely in production. To achieve this, organizations need technologies that can connect development and runtime security to eliminate blind spots and improve governance throughout the software delivery lifecycle.

Provide Support and Resources

Joe Byrne, VP of Technology Strategy and CTO Adviser at Cisco AppDynamics: "Organizations should be certain their technologists are prepared for the cultural shift by offering them the support and resources needed to expand their skillset and operate effectively as an integrated team."

Find Tools that integrate

Adam Hert, Director of Product at Riverbed: "IT teams don't have to find a single solution that does all this in once — you simply won't find a strong SecOps and observability tool all in one package. When you shop around for tools separately, make sure the tools integrate properly. And, most importantly, make sure all teams can get the data they need from the observability tool."

Use a Single Platform

Ajit Sancheti, GM, Falcon LogScale at CrowdStrike: "For organizations looking to pursue an observability and security approach, we highly recommend that they consider a single platform to meet their security and observability needs. Also, during the process of selecting a single vendor for observability and security, they should make sure the vendor addresses their performance, scale, latency and budget requirements. Most importantly, organizations should ensure that their roadmap and vision aligns to the needs of the various teams that will be using the product, including DevOps, ITOps and SecOps."

Avoid Vendor lock-in

Colin Fallwell of Sumo Logic: "Invest in vendors that you can opt into, and don't lock you in with proprietary methods of telemetry collection."

Use an Enterprise Telemetry Pipeline

Buddy Brewer of Mezmo: "Organizations should consider tools such as enterprise telemetry pipelines that bring all data together, transform data, and route it to the right teams to break down the silos and create a true single source of truth for all teams."

Use AI and Automation

Amit Shah of Dynatrace: "Enlist trusted AI and extensive automation to minimize the manual effort of vulnerability management and free developers to focus on the tasks that are core to their role, unlocking the true potential of DevSecOps."

Share budgets

Shamus McGillicuddy from EMA: "IT leaders need to make it clear that these groups can and should share budgets on investments that help them work together (converged tools, better data collection engines, etc.)."

Don't be Frupid

Take the 2023 SRE Survey

Leo Vasiliou, Director of Product Marketing at Catchpoint: "Don't be frupid (portmanteau of frugal and stupid) when evaluating capabilities. They are the gateway to positive business outcomes, which are more valuable than dollar cost on a piece of paper will indicate."

Conclusion

After exploring the convergence of observability and security, my final question to the experts was: What is the timeframe for convergence?

"Talking about timeframes is a very easy way to be wrong," Mike Loukides, VP of Emerging Tech Content at O'Reilly Media answered. "I'm sure complete convergence has already happened for some organizations on the leading edge. And some organizations will never make it. Lately, I've been quoting Eben Hewitt (CIO, Hyatt) a lot: 'No technology has succeeded until it's become a cargo cult.' On the trailing edge, we'll see a lot of companies that claim convergence between operations and security, but have only renamed their old processes. That will be dangerous."

"The great news is that as I speak to IT leaders, they are already converging on the notion of bringing their NetOps, SecOps and even DevOps teams together," says Chaim Mazal, Chief Security Officer at Gigamon. "Many clearly see the immediate advantages of gaining deep observability across their hybrid and multi-cloud infrastructure and understand the critical importance of delivering defense in depth. I fully expect this trend will accelerate in the coming year, faster than any of us might anticipate."

"The combination of security and observability is quickly gaining momentum, and as organizations continue to expand, it will become a standard in no time," says Gregg Ostrowski from Cisco AppDynamics.

Amit Shah of Dynatrace cites research showing 88% of CIOs say the convergence of observability and security practices will be critical to building a DevSecOps culture, and 90% say increasing the use of AIOps will be key to scaling up these practices. The convergence of observability and security is already an essential practice, however, the proliferation of the cloud will only increase its necessity.

On the other hand, Adam Hert of Riverbed warns that convergence is going to take a long time. "It is happening now but will take several years to achieve complete convergence. We have been talking about this for the past 15-20 years and the industry is still working through it."

Buddy Brewer from Mezmo responds, "It may take years as they are likely sitting on mountains of data, hundreds of data sources and observability and security platforms, and dozens of cross-functional use cases to have a unified approach. On the other hand, SMBs where many times the CIO and CISO are the same person, can transition much faster as they are more agile and can adjust quickly to the convergence."

"As for the timeframe, it's already happening," Fallwell of Sumo Logic reiterates. "As data convergence continues to accelerate, schemas will continue to standardize, and Artificial Intelligence, Machine Learning, and Machine Reasoning will continue to accelerate. As with just about every technology, there is always the promise of a better tomorrow."

Pete Goldin is Editor and Publisher of APMdigest

The Latest

The rise of hybrid cloud environments, the explosion of IoT devices, the proliferation of remote work, and advanced cyber threats have created a monitoring challenge that traditional approaches simply cannot meet. IT teams find themselves drowning in a sea of data, struggling to identify critical threats amidst a deluge of alerts, and often reacting to incidents long after they've begun. This is where AI and ML are leveraged ...

Three practices, chaos testing, incident retrospectives, and AIOps-driven monitoring, are transforming platform teams from reactive responders into proactive builders of resilient, self-healing systems. The evolution is not just technical; it's cultural. The modern platform engineer isn't just maintaining infrastructure. They're product owners designing for reliability, observability, and continuous improvement ...

Getting applications into the hands of those who need them quickly and securely has long been the goal of a branch of IT often referred to as End User Computing (EUC). Over recent years, the way applications (and data) have been delivered to these "users" has changed noticeably. Organizations have many more choices available to them now, and there will be more to come ... But how did we get here? Where are we going? Is this all too complicated? ...

On November 18, a single database permission change inside Cloudflare set off a chain of failures that rippled across the Internet. Traffic stalled. Authentication broke. Workers KV returned waves of 5xx errors as systems fell in and out of sync. For nearly three hours, one of the most resilient networks on the planet struggled under the weight of a change no one expected to matter ... Cloudflare recovered quickly, but the deeper lesson reaches far beyond this incident ...

Chris Steffen and Ken Buckler from EMA discuss the Cloudflare outage and what availability means in the technology space ...

Every modern industry is confronting the same challenge: human reaction time is no longer fast enough for real-time decision environments. Across sectors, from financial services to manufacturing to cybersecurity and beyond, the stakes mirror those of autonomous vehicles — systems operating in complex, high-risk environments where milliseconds matter ...

Technology's role in the workplace has expanded rapidly, framing how we work and communicate. Now, with the explosion of new and innovative AI-driven tools, people are struggling to navigate how to work in this new emergent era. And although the majority of these applications are designed to make our lives easier, for many knowledge workers, they've become a source of stress and anxiety. "Technostress" ... describes the feelings of being overwhelmed by constant connectivity and cognitive overload from information and notifications, and it's on the rise ...

People want to be doing more engaging work, yet their day often gets overrun by addressing urgent IT tickets. But thanks to advances in AI "vibe coding," where a user describes what they want in plain English and the AI turns it into working code, IT teams can automate ticketing workflows and offload much of that work. Password resets that used to take 5 minutes per request now get resolved automatically ...

Governments and social platforms face an escalating challenge: hyperrealistic synthetic media now spreads faster than legacy moderation systems can react. From pandemic-related conspiracies to manipulated election content, disinformation has moved beyond "false text" into the realm of convincing audiovisual deception ...

Traditional monitoring often stops at uptime and server health without any integrated insights. Cross-platform observability covers not just infrastructure telemetry but also client-side behavior, distributed service interactions, and the contextual data that connects them. Emerging technologies like OpenTelemetry, eBPF, and AI-driven anomaly detection have made this vision more achievable, but only if organizations ground their observability strategy in well-defined pillars. Here are the five foundational pillars of cross-platform observability that modern engineering teams should focus on for seamless platform performance ...