No window, no warning: why security has to live in every layer

Because of the role I play at HPE, I spend a lot of time with research partners and customers across both private and public sectors. While conversations vary, three topics surface almost every time: quantum computing, AI and, more recently, sovereignty.  The floor that all three stand on is security. 

The Security Conversation Has Changed

For most of my career, security operated on a predictable rhythm. A vulnerability was found, a patch was built, and it was deployed in a window that could last as long as a month.  We saw firsthand through Project Glasswing, an Anthropic initiative that gives a select group of organizations access to its Claude Mythos Preview AI model, that the distance between a vulnerability being theorized and being exploited has collapsed. The rhythm is gone. The window has closed.

HPE has always approached security as a design priority rather than a feature that gets layered on later. What has changed is the speed at which those practices must operate. We continue to strengthen our secure development lifecycle, expand role-based training, and embed security into engineering tools. And a patch nobody can install isn’t really a patch, so we’ve leaned on techniques we first built for uptime, like live migration and live upgrades, to get fixes into production without waiting for a traditional maintenance window. I’m old enough to have worked in groups that called themselves “mission critical.” Today, everything is mission critical: compute, storage, networking, the management layer, and the workloads that run on it. Security can no longer exist on the periphery. It has become a fundamental property of modern infrastructure.

Security Is Becoming Infrastructure

HPE isn't the first company that comes to mind when people think of "security vendor," and I understand why. We're not a pure-play security company. But the truth is security has always shaped how we design infrastructure, and a lot of that work is easy to miss because it is built into the infrastructure rather than added alongside it.

Our recent acquisitions have made that work harder to miss. Juniper brought us a full networking security stack, including firewalls, zero trust enforcement, and AI-driven operations that extend from the data center to the branch. Axis Security gave us the edge services behind our SASE offering. Zerto added the recovery side of the equation, restoring operations when prevention is not enough. Morpheus and OpsRamp brought policy, visibility, and control across virtual machines, containers, and bare metal. Each one strengthened a different layer. Add them to the security already built across compute, storage, networking, and management, and you begin to see the larger picture. There is no single answer. Security has to be built into every layer.

The Next Era of Cybersecurity

That broader shift, from security as a collection of add-on products to security as an architectural foundation, is the theme we’ll explore  throughout Cybersecurity Awareness Month and beyond. You can expect exciting product announcements, technology deep dives, customer case studies and more.

• Week 1: Protecting critical infrastructure. Where the consequences of getting this wrong stop being an IT problem.
• Week 2: Data and cyber resilience. Successful attacks are inevitable, so prevention is not a strategy on its own. Recovery has to be engineered into the IT estate.
• Week 3: Agentic security. Autonomous agents need controls, visibility, alerting, and response at every level. Given their challenges, a “defense in depth” approach is required.
• Week 4: The network as a security control and a security sensor. The network sees everything. It should also be doing something about it.
• Week 5: Post-quantum cryptography and what Glasswing taught us. Two different clocks, both already running and re-drawing the threat landscape.
• Week 6: Sovereignty. Local control of critical workloads, and why security is a prerequisite for it.

If there’s one takeaway, it’s this: the era of treating security as a standalone technology discipline is over. AI, sovereignty requirements, and emerging technologies like quantum computing are changing the assumptions organizations have relied on for decades.