As organisations invest in AI infrastructure, faster networks and increasingly autonomous systems, AI observability is becoming increasingly important. The growing volume of network traffic and AI-generated data is making it more challenging and costly to maintain visibility across complex environments.
Recent industry research highlights the rising cost of AI observability, as organisations struggle to balance monitoring expenses with the need for reliable infrastructure and security intelligence.
For security teams, this creates a growing challenge. As data centres move towards 400G and 800G, maintaining effective AI observability and network visibility is essential for identifying unusual behaviour, detecting potential threats and supporting investigations. Network Detection and Response (NDR) can play an important role in turning high volumes of network activity into actionable security intelligence.
The Rising Cost of Observability
According to the Splunk State of Observability 2026 report, published on 20 October, 57% of respondents said their telemetry costs had exceeded the cost of the infrastructure being monitored. The research, based on a survey of 2,050 IT operations and engineering professionals across 10 countries, also found that 60% experienced greater operational strain from unexpected billing spikes than from consistently high costs.
Meanwhile, 55% said they were unable to control AI costs accurately. These findings highlight the growing financial pressure associated with monitoring modern digital infrastructure, particularly as AI workloads become more distributed and unpredictable.
For organisations managing high-performance data centres, the challenge is not simply collecting more information. It is ensuring that the information collected provides meaningful operational and security value.
When Monitoring Costs Become a Security Concern
Observability is often discussed in terms of application performance, infrastructure availability and operational efficiency. However, the same underlying visibility can also play an important role in cybersecurity.
Security teams depend on reliable evidence to understand suspicious communications, identify unusual behaviour and investigate incidents. If organisations reduce monitoring coverage or retain less information to manage costs, they may also reduce the evidence available during an investigation. This does not mean that higher observability spending automatically delivers better security. Collecting large volumes of data without sufficient context can create additional complexity. The more important consideration is whether organisations can consistently access the information that matters.
For network security, that includes understanding which systems are communicating, how traffic patterns change, where unusual connections originate and whether activity is consistent with expected behaviour. These requirements become increasingly important as AI workloads and automated systems generate more activity across enterprise and data-centre networks.
AI Agents Are Adding Another Layer of Complexity
The Cisco Splunk research also reveals how difficult organisations are finding it to monitor autonomous AI. Although 87% of respondents said monitoring AI was a priority, 56% reported being unable to measure important AI workload metrics such as the quality of large language model responses.
The report also found that 83% were concerned about unintended consequences from AI agents. As organisations deploy agents capable of accessing applications, using tools and communicating with external services, security teams need to understand more than whether the underlying infrastructure is performing correctly.
They also need to investigate unexpected behaviour. An AI agent may operate through legitimate applications and authorised connections while generating unusual communication patterns or accessing services in ways that were not anticipated. Application logs, identity controls and AI-specific monitoring all contribute to understanding these activities. Network Detection and Response (NDR) adds another perspective by analysing communications and behavioural changes across the network. This independent network evidence can be particularly valuable when investigating activity involving multiple applications, services or autonomous systems.
Why Network Visibility Matters at 400G and 800G
The challenge becomes more demanding as data-centre infrastructure moves towards 400G and 800G networking. Higher network speeds support the growing demands of AI computing, distributed workloads and high-performance applications. However, they also increase the volume of traffic that security monitoring systems must process.
Traditional approaches that rely on limited samples of network activity may struggle to provide the completeness of evidence required for certain investigations. For security teams, the objective is to maintain meaningful visibility while avoiding unnecessary processing and storage overhead.
Telesoft’s IntSOC platform is designed to support network observability and threat detection in demanding high-speed environments. IntSOC 400 combines unsampled traffic processing with Layer-7 session enrichment, transforming network communications into intelligence that can support behavioural analysis and security investigations. This distinction matters. Processing traffic without sampling is not the same as storing every packet indefinitely. By extracting relevant session information and network context, security platforms can provide evidence for investigation without necessarily requiring every raw packet to be retained.
As organisations plan for 800G infrastructure, maintaining this relationship between network performance, security visibility and efficient data handling will become increasingly important.
Turning Network Data into Actionable Security Intelligence
The volume of network information available to security teams is only part of the challenge. The other is making that information useful. Network observability becomes more valuable when security teams can move from individual connections to a wider understanding of behaviour. For example, an investigation may involve identifying an unusual destination, examining changes in communication frequency, reviewing session-level information and correlating that evidence with other security alerts. Rather than treating each event in isolation, analysts need sufficient context to understand how activity relates to the wider environment.
This is where NDR and AI-assisted investigation can work together. IntSOC combines network-derived intelligence with behavioural analytics and investigation capabilities to help security teams identify suspicious activity and prioritise potential threats. Agentic AI can further support investigation workflows, including evidence correlation, alert triage and threat hunting, while analysts retain oversight of decisions and response actions. The effectiveness of these workflows depends on the quality of the evidence available.
As network environments become faster and more automated, turning high-volume traffic into useful security context will be increasingly important.
IntSOC security dashboard showing analysed incidents and their classifications, helping security teams understand and prioritise network threats.
Observability and Security Are Becoming More Closely Connected
Another significant finding from the Cisco Splunk report is the growing relationship between observability and cybersecurity teams. The research found that 81% of respondents said monitoring AI workloads had increased collaboration between observability and security teams. It also reported that 84% were sharing data across these functions, compared with 74% in the previous year.
This reflects a broader change in how organisations approach monitoring. Operational performance, application behaviour, AI governance and security investigations increasingly depend on overlapping sources of information.
For data-centre operators, the ability to extract useful network intelligence can support multiple teams without requiring them to work from entirely separate views of infrastructure activity. However, network observability and AI-agent observability are not interchangeable. Network data can reveal communications and behavioural patterns, while understanding an agent’s decisions may also require application-level traces, model telemetry and identity information.
Combining these perspectives offers a more complete picture.
Maintaining Visibility Without Losing Control of Costs
The latest research highlights a growing challenge for organisations investing in AI and high-performance infrastructure. Monitoring is becoming more important at precisely the point when the cost and complexity of collecting telemetry are increasing. The answer is not necessarily to collect everything or to reduce monitoring indiscriminately.
Instead, organisations need to consider which information is essential for performance management, threat detection and investigation, and how that information can be processed and retained efficiently. For network security teams, this means maintaining access to reliable evidence of communications and behavioural changes, even as traffic volumes increase.
For data centres moving towards 400G and 800G, security visibility needs to be considered alongside network performance and infrastructure planning. The cost of observability is becoming a significant business consideration. But the consequences of losing visibility during a security investigation can be equally important.As AI infrastructure continues to scale, the objective should be clear: maintain the network intelligence needed to detect and investigate threats, while ensuring that monitoring remains operationally sustainable.
See IntSOC in Action
Telesoft IntSOC combines high-speed network observability, Network Detection and Response and AI-assisted investigation to help security teams understand activity across demanding network environments.
Discover how IntSOC 400 transforms high-speed network traffic into actionable security intelligence.
Explore Telesoft IntSOC | Book a technical demonstration
Go Back
