Senior Director, EMEA Marketing
Spend any time with senior infrastructure and IT leaders right now and one conversation keeps coming up. The business wants AI, and increasingly it wants agentic AI: systems that don’t just recommend an action but take it. Boards have seen the productivity numbers. Competitors are announcing pilots. The pressure to move is real.
At the same time, those same leaders own the risk register. They answer to regulators, auditors, and, when something goes wrong, the front page. So the conversation usually ends in the same place: a compromise. Move fast enough to keep the business happy, govern enough to sleep at night, and accept that somewhere in the middle there will be a degree of risk you just have to live with.
Which raises an uncomfortable question. How much risk is acceptable? An occasional outage? A misconfiguration that briefly exposes something it shouldn’t? If the overall business benefit is big enough, is that simply the price of progress?
We don’t think it has to be. But to see why, it helps to be honest about where the risk actually comes from.
Gartner has framed this year’s conference around a shift that most I&O teams already feel: AI agents beginning to drive mission-critical infrastructure and operations tasks directly. Change requests, troubleshooting, remediation, policy updates. Work that used to pass through several pairs of human hands is starting to be proposed, and in some cases executed, by software.
For most enterprises, the network is where that ambition gets tested. It is the connective tissue between every cloud, data centre, branch, and application. It is also, for most organisations, the part of the estate that is least well understood as a whole. Knowledge lives in diagrams that are out of date, in a CMDB that is partly right, in monitoring tools that show what traffic did rather than what it could do, and in the heads of a handful of experienced engineers.
Now give an AI agent that picture and ask it to make a change. It will reason confidently over incomplete data, at machine speed. Most of the time it will probably be fine. But “most of the time” is exactly the compromise leaders are being asked to accept.
And we should be realistic about what the downside looks like. Outages are painful, but at least you know they’ve happened. Exposure is worse. A firewall rule that is slightly too broad, a route that leaks between segments, a path that quietly opens from the internet towards something sensitive. These don’t announce themselves. They sit there until an auditor, a penetration tester or an attacker finds them.
Software engineering went through a version of this debate years ago. Teams wanted to release faster; operations wanted stability. The answer wasn’t to pick a point on the spectrum and hope. It was automated testing and continuous integration: every change verified before it ships. Teams didn’t ship faster despite the tests. They shipped faster because of them.
Network and infrastructure operations have never really had that layer. Changes are peer-reviewed, scheduled into windows, and pushed with a rollback plan, which is sensible but slow, and it doesn’t scale to a world where an agent can propose fifty changes before lunch.
What’s needed is a verification layer: a way to test any change, whether it comes from a person or an agent, against an accurate model of how the entire network behaves, before it touches production. For that to work, the model has to be:
• Complete. Every vendor, every device, on-premises and across multiple clouds, not a sample.
• Exhaustive. Able to calculate every path traffic could take, not only the ones it happened to take yesterday.
• Current. Built from live configuration and state, not last quarter’s documentation.
• Queryable by machines as well as people, so agents can ask questions of it rather than guess.
That is what a network digital twin is. It is also what turns AI governance from a committee into a check.
With a digital twin underneath them, agents stop working from assumptions. They ask the model: What can reach this application? What breaks if this link fails? What happens if I change this policy? The answers are calculated from the network as it really is.
Just as importantly, every proposed change can be tested against the rules that matter to the business before it is applied. Payment systems are never reachable from the internet. Production and development stay separate. Critical services keep a redundant path. If a change would violate one of those intents, it is caught in the model, not discovered in production.
The result isn’t slower AI adoption with more sign-offs. It is faster adoption with fewer surprises, because the guardrails are built into how work gets done.
For organisations across EMEA, the question “can you prove it?” isn’t hypothetical. DORA now requires financial entities to manage ICT risk and demonstrate operational resilience to their supervisors. NIS2 has extended similar expectations across energy, transport, health, digital infrastructure and public administration. And digital sovereignty, another of this year’s conference themes, has moved from policy discussion to procurement requirement.
Sovereignty is usually discussed as a cloud decision: which provider, which region, which legal entity. But a statement like “our customer data stays in the EU” is really a statement about the network. It is a claim about every path that data could take, including the ones nobody intended. You can’t prove that from a contract or a diagram. You can prove it from a model that calculates every possible path.
This is where the compromise falls away. The same verification layer that makes agentic AI safe to deploy also produces the evidence that regulators and auditors are asking for. Governance stops being the brake on transformation and becomes the proof that it is under control.
Zero risk has never been on the table, and anyone who promises it should be treated with suspicion. But there is a big difference between known risk and unknown risk. Leaders can make sensible decisions about risk they can see and measure. What they can’t accept, and shouldn’t be asked to, is exposure they don’t know exists, created by changes nobody could fully verify.
The real choice isn’t between moving fast and staying safe. It is between running AI on top of assumptions and running it on top of verified truth about your network. Get that foundation right and speed and governance stop pulling against each other.
Forward Networks will be at the Gartner IT Infrastructure, Operations & Cloud Strategies Conference at ExCeL London on 16–17 November, at booth 519 in the Networks and Security Village. If you’re attending, come and see the Forward digital twin: asking questions of a complex, multi-vendor network and verifying proposed changes before they go anywhere near production.
Better still, bring us a question you can’t easily answer about your own network today. Can you prove what can reach your most sensitive systems? Do you know where our biggest exploitable vulnerability is today? We’ll show you how to answer it.
Not in London? You can see the same thing in a personalised demo, or get in touch with the team.
