Network engineers tell me that their security colleagues now routinely provide a list of requests and questions to help them better assess and manage risk. Threat trends and SOC pressures help explain why.
Mandiant’s M-Trends 2026 Report finds that adversaries remain undetected on networks longer, often by establishing persistence on edge devices (firewalls, routers, switches and access points) that frequently lack telemetry. Bad actors are also performing more phases of the attack lifecycle from both edge and core network devices. Additionally, nearly a quarter of the cybersecurity leaders who responded to SANS Institute’s 2026 SOC Survey cited a lack of enterprise-wide visibility as the top barrier to effective security operations.
Organizations already have the tools to address visibility gaps, but they are scattered across teams with different priorities. The network team keeps the network running, which requires deep knowledge of the devices on the network and a focus on availability. The security team detects and prevents breaches, hardens those devices and reports to compliance.
We have seen early examples of cross-team collaboration in areas we now consider table stakes, like network segmentation and basic patching. However, broader collaboration is required to paint a complete SecOps picture across today’s complex, modern networks.
As networking and security become increasingly intertwined, I recommend that NetOps teams revisit foundational security concepts and familiarize themselves with emerging concerns. A shared vocabulary ensures everyone is aligned when coordinating efforts to strengthen cyber resilience.
Here are the top areas where NetOps teams should focus their attention.
1. Zero trust (never trust, always verify)
Zero trust can mean different things to different people, but the basic premise is that you assume the network is already breached and that a single boundary isn’t sufficient. Just because someone authenticated and was authorized once doesn’t mean they can act unchecked as they move through the network and access applications and systems. Users (human and nonhuman, such as AI agents) must be reauthenticated and reauthorized at every step, especially given modern, compound attacks that amplify the impact of initial breaches through rapid privilege escalation. When you keep your shields up, you’re always validating that the device or system granting access is still trusted, that the user is still authenticated and that the user still has permission to perform specific actions.
2. Least privilege access
This best practice is a highly effective way to contain the blast radius. Essentially, you limit access for users (human and nonhuman) and applications to only what is required to do their jobs. Titles and seniority don’t dictate access; role-based access controls do. Tracking every privileged session enables audit capabilities that provide insights to accelerate investigation and response. Separation of duties is a complementary concept. Users responsible for operational mechanics (e.g., Salesforce users) don’t get access to the infrastructure (e.g., logs and permissions), and vice versa. Infrastructure users (e.g., network engineers) don’t get access to operational mechanics (e.g., sensitive customer data).
3. Automated patching
The race to patchcritical device flaws has accelerated as AI-driven vulnerability discovery and exploitation intensify. Teams must quickly determine the appropriate device state for their environment and how to achieve it. AI-driven automation can help network engineers prioritize critical flaws and deploy the version that best fits business protocols. The latest vendor version isn’t always the right choice; the goal is to strengthen security while maintaining availability. Testing updates before pushing them into production is essential, yet few organizations have lab environments that replicate every device type, model and version. Testing on a low-risk device is the next best option before broader deployment. In environments with 20,000 devices, even a 0.1% failure rate means a substantial number of devices could experience issues, making rapid rollback essential.
4. Vulnerability management
Patching and compliance checks are the baseline; vulnerability management proactively reduces the attack surface to protect the business. When security hands off a list of CVEs and requests a compliance report, the NetOps team can already be a step ahead. Automatically checking devices weekly, nightly or in real time against critical parameters to verify compliance helps NetOps teams process requests quickly and even pre-empt them by proactively reporting findings and actions taken. Security teams have the evidence required to respond rapidly to audits, with proof of compliance — whether a patch, workaround, configuration change or upgrade was required.
5. AI autonomy
The 2026 SANS | GIAC Cybersecurity Workforce Research Report found that AI is affecting cybersecurity team size and role structures in 74% of organizations surveyed. AI is helping security teams move faster. However, governance lags far behind deployment: only 21% have a comprehensive AI security framework in place, and 7% have no AI policy at all. Include AI capabilities in Zero Trust and least-privilege policies, and keep AI tools updated and free of flaws. Best practice for NetOps is to follow three guiding principles:
- Require transparency into the data sources driving insights.
- Ensure the explainability of recommendations.
- Keep humans in the loop because they are ultimately responsible for outcomes.
Security teams that need help closing the governance gap can apply these concepts to their environments.
Network engineers already have deep visibility into device configurations, vulnerabilities, compliance issues and the network’s operational realities. By adding security context to that expertise, NetOps becomes a valuable resource and closer collaborator with SecOps, helping eliminate visibility gaps, identify risks faster and strengthen cyber resilience.