Seeing what others miss: A conversation with Gigamon COO Gareth Maclachlan

The attack surface has transformed. You've got workloads distributed across on-premises infrastructure, public cloud, private cloud, and edge environments. And now, AI is both something organizations are deploying and something attackers are exploiting. Our response has been to go deeper with the Deep Observability Pipeline: real-time, network-derived telemetry enriched with application-level context across every layer of the hybrid environment. We serve more than 4,000 customers globally, including over 80% of the Fortune 100 and hundreds of government organizations. The challenge is universal, and the need for visibility has never been greater.

One of the newest dimensions is AI governance itself. We launched AI Traffic Intelligence to give security teams visibility into generative AI and large language model (LLM) traffic across more than 40 AI engines. Shadow AI is one of the fastest-growing risk vectors right now, and most organizations have zero visibility into it. We're changing that.

Honestly, our customers brought us there. We kept hearing that teams loved the quality of our network telemetry but needed a platform that could ingest it at scale, correlate it across data sources, and surface actionable insights quickly. Elastic came up again and again. Its ability to handle high-volume, high-velocity data — with the speed and searchability security teams need — was exactly the right complement to what Gigamon provides. And the philosophy aligned: open standards, no walled gardens, and meet customers where they are. That's how we think about our ecosystem, too. The recognition of Elastic as our Alliance Partner of the Year wasn't a formality; it reflected a genuinely collaborative relationship at every level.

Gigamon's Application Metadata Intelligence (AMI) captures enriched network metadata at every layer without requiring full packet decryption. That telemetry, normalized to Elastic Common Schema, flows directly into Elastic Security. Elastic ingests it in near real time; correlates it with endpoint data, threat intel, and cloud logs; and puts it in front of analysts in a unified environment. For Zero Trust, specifically, the combination enables continuous policy validation — you're not just setting policy and hoping; you're verifying against live network behavior constantly. The use cases our joint customers value most include lateral movement detection, threat hunting, compliance and encryption audit trails, and now, AI traffic governance.

Before, they had alerts; after, they have answers. It's the difference between looking through a keyhole and an open door: Security teams that were flying partially blind — with good endpoint and cloud log visibility but had a network blind spot — suddenly see the full picture. Investigations that took days now take hours. And in the public sector, especially, the compliance posture shift is significant: Agencies can demonstrate continuous monitoring and enforce Zero Trust with real data, not assumptions.

We're deepening integration around Gigamon Insights — our agentic AI application built on network-derived telemetry. The vision is that Elastic surfaces the detection, and Insights guides the analyst through response, pulling in network context to accelerate the investigation automatically. Longer term, I'm most excited about what this means for the public sector. Government agencies face some of the most sophisticated threats in the world. The Gigamon–Elastic combination gives those agencies a world-class security foundation. And the mission impact of that is real.