A cyber incident can destabilize a government network before IT teams even get the chance to inventory all their users, devices, applications and data.

Brian Chamberlain learned that lesson firsthand years ago during his time at U.S. Fleet Forces Command.

Chamberlain, now business development lead for the federal sector at SolarWinds, was on the watch floor when Iranian adversaries breached the Navy-Marine Corps Intranet. The network had been infiltrated, but the people responsible for responding to the incident didn’t have a live or near-real-time picture of what was connected to the network, who had network access or what on the network had been compromised.

“What I had was a spreadsheet — a printed-out spreadsheet that said these are all of the servers and the server names that belong to each one of the echelons,” he recalled during an interview with Federal News Network for Cyber Leaders Exchange 2026.

Chamberlain started calling people to determine which systems belonged to whom, as precious moments ticked by. While determining which servers to take off the network, one by one, he realized some servers weren’t even on his list.

He described the confusion: “So I can’t make heads or tails, right? I don’t even know what we own. Nobody knows what anybody has.”

For Chamberlain, that experience over a decade ago illustrates a problem that extends well beyond one incident: You can’t command, defend or recover from what you can’t see.

Chamberlain turned to the Greek myth of the Trojan horse to explain what observability should provide. Imagine Troy had a common operational picture of every person inside its walls, including who they were, where they belonged, what they could do and who was responsible for them. A group of interlopers appearing inside the city would be quickly distinguishable.

That’s not to say all newcomers are the enemy. They could be legitimate, like a new contractor that just threw a server online without meaning to. The point is having a singular, reliable baseline at any given time to compare against sudden changes, Chamberlain said.

“That’s what observability or this common operational picture enables you to do. It’s the ability to go, ‘Here’s a known good. Here’s what I know that we have,’ ” he explained. “We have a full, comprehensive picture of it.”

That distinction matters during an incident. If defenders can identify which portion of an environment is affected, they can conduct a more surgical response by keeping unaffected systems operating and concentrating time and effort only on infected areas.

“We don’t want to close the whole entire thing down. Maybe we just want to cordon off a part of the camp where we know these individuals are hanging out,” he said.

That’s the practical value Chamberlain sees in zero trust and in microsegmentation. It limits the blast radius rather than giving an intruder run of the network.

The same visibility problem becomes more consequential when IT connects to operational technology. OT can include the systems controlling elevators, fire suppression, building automation, access controls, power infrastructure and, in some environments, weapons systems. Unlike conventional IT, many OT systems are designed around reliability and continuous operation, so taking them offline to update or inspect them often comes with serious tradeoffs.

That makes the boundary between IT and OT particularly important. The issue, Chamberlain argues, is not simply securing two separate environments. It’s understanding the relationship between them.

“We have to have supremacy of our data,” he said. That means collecting information, protecting it and making sense of it well enough to establish a common operational picture across the cyber battlefield.

Without data supremacy, cyber resilience becomes a speed problem, not just a prevention problem. Chamberlain said that complete visibility is the key to cutting what could be a 90-minute incident to a 9-minute one, simply by having the environment accurately inventoried and mapped beforehand.

He described SolarWinds’ approach to observability as a full-stack view, from the physical layer through the application layer, while separate database observability adds another piece of the picture.

The value is not just having another dashboard, but offering different users the same information, just through the specific lens they need. An executive may need a high-level picture, while a technical operator needs to drill down into a particular system. It’s all there in a single pane of glass, but it can be viewed through various filters.

That capability becomes especially important when the federal workforce is already stretched so thin. Chamberlain’s concern is what happens when every organization, unit or new employee inherits a different collection of tools with different interfaces, capabilities and training requirements. He compares it to giving every soldier a different weapon system and then asking commanders to plan a battle around them.

In that cyber landscape, “what we have is just like chaos on the battlefield. You can’t plan for that,” he said.

Chamberlain acknowledged that specialized units may need specialized capabilities, but problems arise when technology purchases are made without a larger operational strategy or a training pipeline to support them.

That can turn workforce shortages into a visibility problem too, he said. People spend valuable time figuring out the tools they’re tasked with using and stitching together information instead of using that information to do what they were hired to do: Make time-sensitive decisions.

His prescription starts before procurement. Define the operational requirement, determine what the mission demands, then decide what technology can support it.

“Whatever solution you choose, make sure there’s some interoperability and make sure it really starts with an operational requirement and then goes backwards,” Chamberlain advised.

That philosophy also shapes how he views the intersection of visibility and artificial intelligence. AI can help move people out of the repetitive process of turning noise into data, data into information and information into understanding — freeing them to exercise judgment.

However, waiting for a perfect solution carries its own risk.

“We don’t have time to find a 100% solution,” Chamberlain said. “We’ve got to operate on a 70% solution, so that way, how we employ AI is moving ahead of how the enemy is using it to hurt us. They don’t care how many people they kill along the way. They don’t care what kind of destruction they create along the way. And so if we become overly risk averse, then we are going to get outpaced.”

Chamberlain connected that idea to the military decision-making OODA cycle of “observe, orient, decide and act.” If defenders remain stuck in an infinite loop of observing and orienting while an adversary is already acting, they have no chance of getting a handle on the threat, let alone staying ahead of it. The answer, he said, is to give people enough visibility, information and authority to use their judgment.

The thread running through these challenges is fragmentation. Cyber resilience, critical infrastructure security and workforce readiness may look like separate challenges, Chamberlain said, but they’re all supported by the same foundation of knowing what’s in the environment, how the pieces connect, what has changed and who is responsible for responding.

That requires more than buying another tool. It instead requires treating visibility as critical infrastructure, connecting systems, teams and information that have historically operated apart, he said.

“We can’t defend and we can’t leverage what we can’t see,” Chamberlain said. “We need to take some of the same fundamentals of command and control on the physical battlefield, and we really need to apply that same doctrine to IT and cyber. … We’ve done this with zero trust. That is at least a step in the right direction.”

Chamberlain is clear this is not a technology problem. The technology exists, he said. “This is a leadership problem.”

He believes agency leaders need to apply the same command and control principles used elsewhere in the military to the cyber and OT environments that now connect nearly every other part of the mission.

“We’ve already done this. We’ve done this before. It’s just the battlefield has changed.”

Cheat sheet for gaining enterprisewide observability

SolarWinds’ Brian Chamberlain offers a 6-phase framework for turning fragmented visibility into an operational capability:

• The environment: Know what IT and OT assets exist, how they connect and who is responsible for them.
• The baseline: Establish a “known good” picture so deviations can be identified and investigated.
• The boundaries: Understand where IT and OT responsibilities meet and make sure someone is responsible for monitoring it where it’s most vulnerable — the seam.
• The mission: Start with operational requirements, then determine what technology is needed to support them.
• The response: Build primary, alternate and contingency plans so a compromised capability does not automatically become a mission failure.
• The workforce: Make sure employees have the training and institutional knowledge to use the tools they inherit.

Discover more articles and videos now on our Cyber Leaders Exchange 2026 event page.

Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.