Making forensic observability the norm for network devices
Despite the progress being made, there are still misconceptions about observability.
Doesn’t this help attackers?
No. One common concern is that exposing additional telemetry or forensic interfaces will provide attackers with more opportunities to exploit a system. However, well-designed observability features improve security rather than weaken it. Structured logging, authenticated collection mechanisms, and clearly defined forensic interfaces are safer than forcing investigators to rely on undocumented behavior or vulnerability research. Security engineering should assume that defenders will need to investigate systems under pressure and design for that reality from the outset.
Won’t customers hate it?
No. Another frequently cited concern is that customers may react negatively to increased transparency. However, experience suggests the opposite. Organizations responsible for operating critical infrastructure consistently ask vendors for better visibility into the systems they deploy. Clear telemetry and forensic capabilities build trust because they allow operators to verify what their systems are doing and respond effectively when something goes wrong.
Isn’t it too difficult?
No. There is a belief that implementing forensic observability is too difficult. Although it does require careful engineering, the examples emerging from industry demonstrate that it is achievable. Vendors that prioritize observability early in the design process find that it becomes a natural part of their platform rather than an afterthought bolted on in response to incidents.
Source: UK NCSC (Cyber) (29 July 2026)
