Fragmented Tooling Is Becoming a Barrier to AI-Native Operations
As enterprises accelerate cloud-native and AI-driven application delivery, observability is no longer simply about dashboards and monitoring. Modern environments generate enormous volumes of telemetry, infrastructure events, application traces, and security signals that must be interpreted and acted on in real time.
At the same time, organizations are struggling with operational fragmentation. theCUBE Research data shows that 75% of organizations use between six and fifteen observability tools across their environments, while 54% favor moving toward more unified operational platforms to reduce complexity and improve visibility.
In this episode of AppDevANGLE, I spoke with Martin Mao, SVP and GM of Observability at Palo Alto Networks and previous Co-Founder and CEO of Chronosphere, about the convergence of observability and cybersecurity following Palo Alto Networks’ acquisition of Chronosphere.
The discussion explored how observability is evolving from passive monitoring into autonomous operational remediation, why AI agents are becoming central to incident response, and how telemetry pipelines are emerging as foundational infrastructure for both security and operational intelligence.
Observability Is Moving Beyond Monitoring
Historically, observability platforms focused primarily on visibility. Teams collected logs, traces, and metrics to understand system behavior and diagnose incidents after problems occurred.
That model is beginning to shift. “The observability industry is moving from just detection… into actually taking action and ultimately remediating the issue as well,” said Martin Mao, SVP and GM of Observability at Palo Alto Networks.
As distributed systems become more dynamic and AI workloads increase operational complexity, organizations can no longer rely solely on human-driven incident analysis. Mean time to remediation has become just as important as mean time to detection.
Chronosphere had already begun moving in this direction prior to the acquisition through its AI-guided troubleshooting capabilities.
“We were already working on an AI agent-driven way to automatically detect the root cause of a particular issue,” Mao explained.
The Palo Alto integration expands that concept further by connecting observability insights directly into automated remediation workflows. Instead of merely identifying failed deployments or problematic feature flags, AI agents can now take corrective action automatically inside operational environments.
Telemetry Pipelines Are Becoming Strategic Infrastructure
One of the more important themes from the conversation is the growing importance of telemetry pipelines themselves.
As enterprises generate increasing amounts of operational and security data, organizations need ways to collect, normalize, route, redact, and transform telemetry across multiple systems simultaneously.
“The telemetry pipeline is really responsible for collecting all of the event and log data in a particular environment and feeding it both to security backends and observability backends,” Mao said.
This reflects a broader industry shift where telemetry is no longer viewed as isolated operational data. It is becoming shared infrastructure for both security and operational intelligence.
The overlap matters because observability and cybersecurity increasingly rely on the same underlying signals. Infrastructure events, network activity, runtime anomalies, application behavior, and cloud configuration changes are now relevant to both operational resilience and security posture.
Rather than maintaining completely separate operational stacks, organizations are beginning to treat telemetry as a unified data foundation capable of supporting multiple operational domains simultaneously.
AI-Native Infrastructure Requires Autonomous Remediation
The rise of AI workloads is dramatically increasing operational volatility.
Inference systems, GPU clusters, container orchestration layers, feature flags, and distributed application dependencies create environments where failures can propagate rapidly across systems. Traditional operational workflows struggle to keep pace.
“You can imagine things like if we detect that a deployment was bad, is causing issues, or perhaps a feature flag was turned on… those would be things that an observability platform like Chronosphere can detect,” Mao explained.
The key shift is what happens next. Historically, operational staff would manually investigate and remediate those issues. Increasingly, AI-driven operational systems are beginning to automate both detection and remediation.
This changes observability from a passive operational capability into an active control layer.
As AI systems themselves become operational workloads, autonomous remediation becomes increasingly necessary rather than optional. Enterprises are under pressure to reduce downtime, accelerate incident response, and operate increasingly distributed environments without continuously scaling operational headcount.
Security and Observability Are Finally Converging
For years, observability and cybersecurity evolved as adjacent but separate markets.
“There’s been a history of tools that did a little bit of both,” Mao noted, referencing platforms like Splunk and Elastic.
What makes the Palo Alto and Chronosphere combination notable is the scale and completeness of both sides. “This is really the first time in the industry where you have a full cybersecurity platform combined with a full observability platform,” Mao said.
That distinction matters because the convergence is happening at multiple levels simultaneously. Shared telemetry pipelines, AI-driven analysis, operational context, and automated remediation workflows are all beginning to overlap.
At the same time, Mao emphasized that observability and security remain distinct operational disciplines with different users, workflows, and priorities.
“Observability has a particular view of your architecture and application that’s different from the security view,” he explained.
Rather than collapsing everything into a single interface, the industry appears to be moving toward interconnected operational domains powered by shared intelligence and shared telemetry infrastructure.
Consolidation Pressure Is Accelerating
Tool sprawl continues to be one of the largest operational challenges facing enterprise IT teams.
Organizations increasingly want fewer operational platforms, fewer disconnected workflows, and fewer fragmented datasets. The Palo Alto and Chronosphere combination reflects broader market pressure toward consolidation around platforms capable of delivering unified telemetry ingestion, AI-assisted troubleshooting, security integration, automated remediation, and cloud-native scalability.
At the same time, enterprises still require flexibility. Mao acknowledged that organizations will continue using specialized operational views and workflows based on role-specific needs rather than forcing all users into identical tooling experiences.
This balance between consolidation and specialization is likely to define the next phase of observability platform evolution.
Analyst Take
Observability is entering a fundamentally new phase. For the past decade, observability platforms primarily focused on helping humans understand increasingly complex systems. That model no longer scales in AI-native environments where infrastructure volatility, telemetry volume, and operational speed exceed human response capacity.
The industry is now shifting toward autonomous operational systems capable of detecting anomalies, determining root cause, correlating operational and security signals, and initiating remediation automatically.
This also marks one of the clearest examples yet of operational convergence between observability and cybersecurity. The telemetry pipeline itself is becoming strategic infrastructure.
Organizations that continue operating fragmented observability and security stacks will increasingly struggle with operational latency, incomplete visibility, and inefficient remediation workflows.
The next generation of operational platforms will not simply monitor systems. They will actively govern, remediate, and optimize them in real time.
Palo Alto Networks’ acquisition of Chronosphere reflects this broader transition from passive observability toward autonomous operational intelligence.
