Strategic Telemetry Management for AI-Ready Infrastructure

0:05

Sandi Meyer: So, for years, network-derived telemetry has been key to monitoring applications, securing infrastructure and keeping digital businesses up and running. But as organizations further embrace hybrid cloud, AI and distributed architectures, that same telemetry is evolving into foundation for trusted intelligence powering security, observability, automation and AI-driven decisions.

So, the challenge is no longer around, you know, collecting the data. We have so much data coming in from so many different sources, but it's ensuring that it's trusted and it's enriched with meaningful context and delivered where and when it's needed so that organizations can make more informed, confident decisions.

So recently I was reading a piece of research from Gartner and they were talking about and predicting rather that by 2029, 60 percent of organizations will be deploying what they call observability or telemetry pipelines. And that's really, you know, as organizations are struggling to manage this, the AI-driven telemetry volumes with greater scale and significantly better cost efficiency.

And so that really prompted me to kind of want to have this conversation with you, Shane, because I do think that we're, we're at this kind of this change, this inflection point in the industry where we, we can talk about strategic telemetry management, right? And so I'm really glad that you're here with me today.

1:42

So joining, joining me, CEO of Gigamon to discuss why strategic telemetry management is really becoming critical to trusted intelligence, digital resilience and AI and how organizations can build future-ready data strategies that deliver measurable business outcomes.

So thank you again for joining me, Shane. This is the first time we've had a little conversation like this. I'm so glad that we're here, looking forward to the conversation. Do you have anything to add to that earlier set up? Any additional trends that you're seeing that you might like to touch on today?

2:20

Shane Buckely: Yeah, sure. First off, really appreciate the opportunity to spend time. We've talked a lot of times just one-on-one sitting, you know, having a coffee or just casually, you know, in the corridor. So, this is a great opportunity for a sharing of views.

I think the industry is at the point of most transformation in any of our careers. So I'm doing this over 35 years in the technology industry, and the change we're seeing over the last two years with the advent of AI is just incredible. All the bets are off the table.

And so when I speak with CIOs and CISOs alike, they have the same challenge. The cost of AI is ballooning, token costs going through the roof. We're seeing this happening all the time. They don't have the budgets. Yet the board and the CEO is demanding them to implement AI at scale. How did they do that? Where did the budget come from?

And so they're struggling to try and identify where budgets can be secured. A lot of times they're looking at, you know, the tool budget, about $34 billion business a year. And so tool bloat has become a top priority for CIOs and CISOs to take some of that spend, reduce it so they can invest in the areas that are absolutely critical. I think that's absolutely number one.

3:27

Number two, I think CIOs and CISOs alike now, along with CEOs and boards, are absolutely terrified by some of the breaches they're seeing and report in the press where AI runs amok and actually can bypass a lot of the security systems and get access to information that is unintended. Like the Hugging Face example, which I know we'll talk about a little bit more during this conversation. And so right now, I think there's a lot of fear at the C-level that people think of FOMO, fear of missing out. They want to be part of the AI journey. They're terrified of the AI journey. They want to invest in it. They don't enough money, but as they invest in this, they're really concerned about security. So you add all that into the mix, it's like, wow, it's a crazy time to be in this industry,

4:08

Sandi: That's for sure. And then you think about, you know, scaling the like scaling hardware to accommodate what's going on, right with the with the increase in AI traffic.

4:16

Shane: Absolutely. And so if you remember just three years ago, even like 2 years ago, SASE companies, software companies were super hot, great stock prices is fantastic for investors to invest in the software and the and the security industry. You look over the last six or nine months, many of the market caps, those companies have totally tanked because the industry is looking at this thinking you have a strong AI headwind here, you're not going to survive, or you have a tailwind, you'll definitely survive.

What's really cool, particularly cool for Gigamon, is that hardware is really cool again. And so, organizations that can demonstrate that they can operate with AI scale are being prized over those that absolutely can't. And so one of the key elements of our secret sauce, as you well know, at Gigamon is our ability to scale linearly to hundreds of gigabits per second. And as you know, we have our GigaSMART^® appliance coming out, which will be quarter of a terabit of capacity for deep observability. And then we've got next generation platforms coming after that.

It's a really exciting time when you're a hardware-assisted software company. But for software-only companies, I don't know. It's going to be a tough gig, that's for sure.

5:21

Sandi: Yep. Yep. No, that's great.

So for years, organizations have focused on collecting telemetry to, as we were talking about supporting individual tools and teams, right? And as AI changes the economics of cybersecurity, like we were talking about making vulnerability discovery faster, cheaper, more scalable. And organizations are frankly just generating so much data. How is the conversation shifting towards this notion of strategic telemetry management, right, as a new way of looking at things, right, instead of a tools-based approach?

6:03

Shane: Yeah, I think there's a number of factors that force here. First off, just look at the sheer traffic volumes. Research shows that over the next by 2030 traffic volumes will increase 900 percent or 9X. That's crazy. And so there has already been been an asymmetry between the performance of the network and the capability of the tool stack for many years. It's one of the reasons why Gigamon does such a great job. Now you multiply, uh, traffic volumes by 9X, you introduce these uh agentic AI platforms that are going to generate 6 to 9 times more traffic themselves than the human traffic inside these networks.

And it's a total game changer because the virtualization of the tool stack, where tool stacks have their own kind of contents, they have their own processing, and they have their own analysis in a very siloed fashion just doesn't work in the AI world. It doesn't work because you need to share content. You need to share information to get better insights. That's how AI works. Even the public models today and so #1 traffic volumes are really changing the dynamics of the tool stack. There's no way people are going to pay linearly more for the tool stack than they have been in the past. Remember, it's a $34 billion market.

#2, I think more importantly, the nature of the telemetry is changing. AI represents an overlay network on top of the traditional network, which where you've got traditional tool stack for application performance, network performance, security, and observability. You bring AI into the mix. Many of those tools are irrelevant because they don't support the native AI protocols, MCP, A2A, ACP, and others that are running the networks today.

So how are you going to manage the environment? How are you going to look at performance? How are you going to actually look at security? How do you know what these agents are doing? We talked earlier on about the Hugging Face, right? The way they found that there was an incident, their network was, they saw ultimately traffic volumes being irregular inside the network. And they're like, hey, there must be something wrong here. None of the tool stack reported anything. The SIEMs weren't giving them information. The SOC didn't tell them anything. They're completely blinded by the fact that AI was using a very clever way to harvest known credentials to actually access information technically, legally, but in a way that actually is ultimately was exfiltrating data shouldn't get access to. So, it's a very hard thing to capture.

So the requirement I think going forward is for organizations to be able to identify telemetry across the board, not just based on MELT, but based on network context as well. And so being able to understand these network protocols, being able to natively understand MCP A2A and the other protocols that makes up these AI networks is becoming incredibly important.

But doing it at scale is really hard. There are many startups out there that are doing MCP gateway technologies. But if you look at many of our customers that operate in terabits per second of performance, how are they going to get these gateways to work if they're just using standard-based hardware? So there has to be a very different approach.

And so the combination of MELT, because MELT is still important along with the network context or network-derived intelligence or what we call deep observability, that combination is critical. But then you have to do something with the information.

So you take that information and then what? So what's the next step? Next step, you've got to integrate it seamlessly into the next generation SIEMs, which is a horizontal data store where all the logs, all the MELT, all other information in the network context are going to be included in the lake going forward. So the AI platforms have good quality data because as we know, bad quality data with AI gives bad quality outputs good quality data on an AI environment creates great insights. So high-quality telemetry creates high-quality insights or trusted telemetry creates trusted insights for customers. That's really what they need.

9:43

Sandi: So it's interesting because I, I mean, we've been talking for a long time about better together of MELT plus network-derived telemetry, right? And it is it. That's why I was speaking about earlier. We do seem to be at this inflection point where you can't do what you need to do without that combination.

But I wanted to to touch on the, the whole the data lake concept, right? And are you, hopefully I'm not throwing you off because I don't think this is actually on the, but, but this is kind of this convergence of, of security operations and network operations and the, and the data that they need collectively to do. Do you see the data lakes as being converged data lakes where you'd have operational data, you'd have, you know, security data and then that layer on top where you can do, you know, whatever your job requires based on that conjoined data.

Shane: One hundred percent.

Cause if you think about logically, AI is the very definition of converged data, even if there are multiple data sources. Take us here at Gigamon. We've instrumented Glean AI as part of our platform, and we have our structured data systems and our unstructured data systems all connected to Glean itself.

Does AI care? No AI is going to go wherever it needs to go to get whatever information it needs in order to make the best quality decision. Heck, and Hugging Face even broke the law to go and harvest credentials outside of the organization to go back into the organization to get the answer that I wanted. It was so determined to get the answer that was the best answer for the prompt. And so at the end of the day, it's all going to be about converged data.

So the concept of a data lake where you store structured unstructured data systems as much as possible makes complete sense. It's the only way for AI to have access to a system where it garner all the information. And it's got this incredible capacity, as we all know, to find the needle in the haystack out of data.

Now, again, if the data quality is poor, it's going to find poor needles in the haystack. It's going to give bad outputs or kind of hallucinations that are not going to be useful for the organization. So the better quality telemetry that the organization has is going to give better quality output.

And that's why you look at the next generation SIEM vendors, many of them are daily vendors. You've got security vendors like Palo Alto Networks, you've got Crowdstrike. Everyone's coming together saying this is the next big thing, creating one horizontal data store where all the information is ingested. AI sits atop and will sift through, you know, petabytes and petabytes of data in nanoseconds in order to provide these insights that customers need to run their infrastructure.

Because the next generation SOC is not going to be housed with hundreds of people sitting in a room. It's going to be hundreds of thousands of agents running in parallel, transferring information across to each other, making observations and insights and then making changes on the fly inside the infrastructure like the Self Healing Network people talk about. That's what our customers want.

They say, hey, the stock of the future is going to be a very small number of people and it's going to be literally hundreds of thousands of agents all sitting across this data store.

Our job is to provide the best possible telemetry to get the best possible outcome. And we know that network traffic is immutable.

One of the problems with network traffic is there's a lot of network traffic now with 9X, the amount of volume coming from the network over the next 10 years, it's totally impractical to send raw packets anywhere. Even the biggest data lakes in the world are going to be swamped traffic. So it's just not valid.

That's where AMI [Gigamon Application Metadata Intelligence] comes into place. Our ability to reduce dramatically the quantity of data, introduce things like sewer cata and other systems to refine exactly what we're seeing to give the best possible input to the data lake, including the end user context, the assets, the prompt, for example, as we connect into MCP gateways or have MCP gateway technology on our own platforms, we're going to have the best possible telemetry. That telemetry will give the AI engines the best possible outcomes for our customers.

13:33

Sandi: No, that's, that's great. And I imagine as part of that, you have to have the conversation about hot and cold storage, right? Because that's a huge issue, right, is where, where are you going to store the data you don't necessarily want, you don't need access to all the data all the time.

13:48

Shane: Exactly. But, you know, these problems are all easily surmountable, the whole concept of hot versus cold, you know, current data versus historic data. One could argue as symmetry hits the data store, if there are sufficient agents running, sufficient prompts in it, why do you need to coheap weeks, weeks or months of data? It's going to find everything it needs to find in the data anyway.

So this concept of holding 6, 9, 12, 18 months, worth of data even in kind of metadata format, that may be old news. If you've already extracted all the relevant information from the data, you don't need it anymore. When we extract the signals from metadata from the packets, we don't need the packets.

Now with AI, you can actually process the data on the fly and probably only store the most important signals that you want. So I think the storage part becomes less of an issue. It's a big issue today because if you look at the traditionally SIEMs work, they ingest literally petabytes of data. The SIEMs are generating 10s of millions of logs a day for most of our customers, and the SOC and the Knockout are going, this is crazy. I'm actually getting nothing because I have everything.

I give the example many times you've heard me say it's like going to the Library of Congress and saying there's one book on the shelf that has all the secrets, universe, but you've got to find it. So we're going to sit down and read every single book. I mean, how long is it going to take? A lifetime or more.

That's not the way this has to work with AI. Right now. AI can look at every single book in the Library of Congress and within a second or two it'll tell you exactly the book, the page and exactly what the content is. So we got to get the content, but we got a good quality telemetry in there to get good quality outputs on AI.

15:16

Sandi: Yeah. No, that's, yeah. I mean, we always talk about, you know, finding a needle in a haystack. I guess finding a book in the Library of Congress is the same idea, same analogy.

15:27

Shane: Yeah.

15:28

Sandi: No, that's good.

So we've talked a lot about managing telemetry, but you know, business leaders really care about outcomes, not the data, as you know. So how does this notion of strategic telemetry management really translate into, you know, cyber resilience, operational agility, AI readiness and better business outcomes?

15:52

Shane: That's a great question. I mean, at the end of the day, like like the data lake and the content and the data lake, be it to kind of melt, be it like network-derived telemetry, it's a means to an end. The question is, do you have the right signals in the data to be able to extract the signals and make business decisions? Whether it's, for example, in a, in a SOC where you have an agentic system looking at potential breaches inside the network, like a hugging face, looking at the signals in the traffic, looking at the pattern changes in network traffic as these agents spin up and actually pull more traffic across the network in a way that's kind of suspicious or maybe not correct. You know, looking at DNS signals, looking at inside encrypted traffic or looking inside AI protocols themselves. And that is how you actually find the signals.

16:40

The next step really is for the business to say, well, well, so what's next? So what's next is the ability then to take these signals and apply them with a series of logic to actually ensure that you can put in the defense mechanism in place for the organization.

16:55

Let me give you an example. Up to the advent of AI hackers and defenders was kind of a one-to-one ratio. You'd humans attacking networks. Now there wasn't a symmetry as you know, because hacker could use anyone involved in this an infinite number of ways going into the infrastructure and security has to defend them all. They're just one way in. So, the odds are that the hackers are going to win. And we've seen that of course, you know, 70 to 80 percent of companies get breached. Now breaches are up 69 percent because of AI, because of course AI now creates this infinite number of vectors and security is still manually trying to protect every way and that's just not going to work.

17:28

So what the business needs, the business needs to ensure that as these hackers using these infinite number of ways to penetrate the infrastructure of the of the network just north-south, but obviously, particularly lateral movement that the system can actually respond to that in turn and actually defend itself in real time using AI.

And so the ability for these next generation security operation centres to actually look at the signals, identify the attack, put in the corrective action, make the changes on the fly and advertise it update the SOC leadership that hey, I'm making these changes because I see this attack happening.

18:02

But you can't rely on humans to respond because it's too late because these these machines are working in machine time. They're not working in human time. And so the business really has to have the infrastructure in place so that when AI identifies the signal as a potential challenge, that there's an ability for the organization to respond in machine time to block it and prevent it from coming in and basically close off the door. If that means a patch on the infrastructure, maybe a vulnerability that's identified, if it's a credential issue inside the network, all those things have to be identified and they have to be automated and healed literally in machine time. That's the big challenge for the organization.

18:38

We're not there yet because there has to be a lot of testing and there has to be a lot of trust in the response systems to make sure that in responding you're not necessarily breaking something inadvertently that causes the network to not perform.

That's a big step.

If you remember back in the old days when IDs systems came out and then software vendors said, hey, we're going to put in IPS, intrusion prevention. How many companies turned on the P in the IDs? Not that many, because those that did often broke the infrastructure.

19:05

We now have the ability for AI to understand the impact of the changes it's making in a way we didn't have in the systems the past. But still it will take some time before these systems are truly self healing. But we have to get there. Otherwise the asymmetry between the attacker and the defender is going to be maintained and that's a problem.

19:23

Sandi: So can you, can you elaborate a bit on the, so that's great examples of on the on the security side, but on the operations side, some of the business outcomes that you would hope to see as a result of organizations really managing telemetry more strategically.

19:40

Shane: Yeah, well, that's a great question.

19:42

I would say telemetry is the signal of potential change. And if you miss the signal, you can potentially have operational challenges. It could be traffic volume increases on certain applications, you know, with AI, you know, and you have agents calling agents, you can have, you know, massive traffic spikes with very short notice.

And if the system internally isn't able to respond to that and have the ability to scale up and scale out the capacity of servers, for example, whether using like Kubernetes, OpenShift on an on-prem environment or using public cloud infrastructure, that all has to be able to dynamically scale in order to respond to the changes in demand.

That's a tough thing to do.

And so organizations have to think through, you know, how much am I going to buy in terms of capacity? How much am I going to allocate? These systems to enable me to respond to the change in demand that's internally happening in the infrastructure. What happens if that increase in demand gives rise to massive increase in latency and application performance. What does AIOps do then?

How do you resolve the issue of performance?

Where is the bottleneck?

How is it a traffic routing issue?

Is it capacity issues?

Is a server issues?

Is a storage issue hot versus cold?

All these factors come into play in terms of how does the infrastructure respond to these massive changes in in traffic because unlike, you know, humans, you know, logging in and doing their work, that's more linear. When these machines spin up, they can go from zero to Infinity in nanoseconds. And so the ability for the network to be able to respond to that and be able to have that dynamic scaling and being able to deal with things like latency and performance is very, very difficult.

We don't have those tools today. Those tools have to be developed.

21:16

Sandi: Yeah. No, that's great. That's great. Great context. So well, thank you, Shane. I think this has been a really interesting conversation and I'm really glad we had the opportunity to do it and hopefully we will be able to do it again soon.