The gap between security teams and IT operations has been a persistent issue in enterprises, and it’s only getting worse. These silos breed inefficiency, miscommunication, and ultimately create security vulnerabilities that organizations cannot afford.
Why Do These Silos Exist?
Security and IT operations often operate with conflicting priorities. Security teams focus on minimizing risk, enforcing strict policies, and ensuring compliance. Meanwhile, IT operations prioritize uptime, performance, and end-user experience. The friction between these objectives leads to roadblocks, inefficiencies, and—more often than not—hostility between teams.
1. Different Goals, Different Metrics
Security teams are measured by how well they prevent incidents, while IT operations are judged on system availability and performance. This creates tension when security initiatives slow down deployments or impact system performance.
2. Lack of Shared Tools and Communication
Security teams use SIEMs, EDR solutions, and compliance dashboards, while IT operations rely on monitoring tools, ITSM platforms, and infrastructure automation. Without shared tools or integrated workflows, collaboration is clunky at best and non-existent at worst.
3. Resistance to Change
Operations teams are often frustrated when security measures introduce friction into their workflows. Security teams, in turn, grow frustrated when IT operations delay security initiatives for the sake of “business continuity.” This results in passive-aggressive decision-making or, worse, outright ignoring security directives.
Security Defines Needs, IT Operations Implements
Security should define their needs for tools, policies, and controls to maintain a strong security posture. However, it is IT operations’ responsibility to determine what works best within the existing architecture. Security tools must integrate seamlessly into the broader IT ecosystem rather than being imposed without architectural consideration. Security and operations must work together to ensure that security measures enhance, rather than hinder, IT functionality.
The Consequences of These Silos
The separation between security and operations is more than just an internal headache—it’s a direct risk to the business. Here’s what happens when these silos persist:
- Unpatched Systems: Operations delays patching due to uptime concerns, leaving known vulnerabilities exposed.
- Shadow IT and Workarounds: If security is too restrictive, IT teams find ways around policies, leading to uncontrolled risks.
- Incident Response Chaos: In the event of a breach, security and IT teams often lack a cohesive response plan, leading to confusion and wasted time.
- Compliance Failures: Without alignment, organizations risk falling out of compliance, leading to regulatory fines and legal repercussions.
- Lack of Accountability in Identity and Access Management (IAM): Security teams often fail to enforce strict IAM policies, leaving gaps in authentication and authorization that attackers can exploit.
- Choosing Poor Security Tools for Comfort Instead of Architecture Needs: Security teams sometimes push for tools that they are comfortable using, rather than selecting solutions that integrate effectively with IT infrastructure, creating inefficiencies and additional risks.
- Increased Costs from Poor Tool Alignment: Failure to utilize existing tools within the stack leads to unnecessary expenditures on redundant solutions. Instead of streamlining security and operations, these choices add complexity, strain IT budgets, and create inefficiencies that impact both security and business operations.
Real-World Examples of Costly Silos
Several high-profile security breaches have been exacerbated by the divide between security and IT operations:
- Equifax (2017): IT operations failed to implement patches promptly after security identified the vulnerability. Security did not establish a strong follow-through process to ensure compliance, and operations lacked urgency in applying the critical fix.
- Target (2013): Attackers gained access through a third-party HVAC vendor. Security had monitoring tools in place but failed to escalate alerts, while IT operations did not enforce proper network segmentation.
- Colonial Pipeline (2021): A compromised VPN account with no multi-factor authentication led to a major operational shutdown. Security should have enforced MFA policies, but IT operations failed to validate the enforcement of access controls.
- Marriott (2018): A lack of integration between security and IT operations delayed detection of a breach that exposed 500 million customer records. IT operations failed to modernize outdated security detection methods, while security teams did not conduct proactive threat hunting.
Breaking Down the Silos
1. Leadership Must Mandate Collaboration
Security and IT operations must have shared objectives that align with business goals. Leadership needs to break the cycle by integrating these teams into joint initiatives and ensuring that KPIs reflect shared success rather than isolated victories.
2. Shared Tools and Data
Security and IT operations should have access to the same data sets, dashboards, and automation tools. If security is identifying threats, operations should be able to act on that information in real-time.
3. Security-Embedded Operations
Instead of treating security as a gatekeeper, embed security into IT operations. This means security engineers should be part of DevOps, infrastructure, and endpoint management teams, ensuring security isn’t an afterthought.
4. Automate and Streamline Security Processes
Too often, security is seen as an inhibitor rather than an enabler. By automating security tasks—such as patching, compliance reporting, and threat mitigation—IT operations can maintain efficiency while maintaining security posture.
5. Continuous Communication and Training
Security and IT operations need to talk—regularly. Whether it’s through shared incident response drills, cross-team training, or recurring strategy meetings, breaking down silos requires an ongoing effort, not just a one-time initiative.
Final Thoughts
The divide between security and IT operations isn’t just an inconvenience; it’s a fundamental flaw in modern IT strategy. Organizations that fail to address this disconnect are setting themselves up for security breaches, operational failures, and compliance nightmares. The solution isn’t more red tape—it’s a cultural shift towards collaboration, integration, and shared accountability.
Until leadership forces change, these silos will continue to be an anchor dragging down security, operations, and ultimately, the entire business.
The Author
William Tooley is a seasoned security engineer at Novacoast with two decades’ worth of expertise, specializing in Microsoft Technologies and Information Security.