2026 Strategic Roadmap for Enterprise Networking
17 October 2025 - ID G00837707 - 22 min read
By Karen Brown, Andrew Lerner, and 2 more
Agentic NetOps, AI infrastructure, zero-trust and cloud-centric architectures are transforming enterprise network requirements. This creates a challenge for heads of I&O, requiring them to create a secure, adaptable network strategy that will guide better technology investment decisions.
Overview
Key Findings
- Although network operations are largely supported by humans, this will shift in the next three to five years. AI agents will increasingly take over certain network operational tasks, with humans assuming management and policy-setting roles.
- Enterprise customers’ SASE needs are evolving, with increasing demand for added AI traffic management and security, data sovereignty, and postquantum cryptology protection.
- Demand for on-premises AI workloads is growing, driven by open-source AI models, increasing cloud and data transfer costs, and concerns about data privacy and data sovereignty.
- Despite the rapid evolution of AI technology, enterprise network teams lack AI and agentic AI training.
Recommendations
- Pilot AI and agentic AI capabilities to verify their ability to streamline network operations, improve network and applications performance, integrate with existing network infrastructure, and deliver business value.
- Develop a SASE adoption plan that supports secure connectivity, AI traffic, data sovereignty, and PQC — and evaluate vendor roadmaps to guide platform selection.
- Build out dedicated network infrastructure if AI workloads are required on-premises. This will better support performance for both AI and existing workloads.
- Invest in cross-functional training programs to help network teams understand AI and agentic AI compute requirements and how they impact performance, security, and cost.
Strategic Planning Assumptions
- In 2028, more than half of data center switch spending will support AI workloads, which is an increase from less than 30% today.
- By 2030, 45% of customer locations will be served by a coffee shop networking type solution, up from about 15% in 2025.
- By 2030, universal ZTNA will be adopted by 40% of organizations, up from less than 5% in 2025.
Introduction
Enterprise network technology will evolve during the next three to five years, driven by agentic AI, zero-trust security adoption and ongoing cloud innovations. Heads of I&O must therefore adjust their strategies and team skills for network infrastructure and services.
To guide this process, the strategic roadmap in Figure 1 will identify the key enabling network services and infrastructure components, as well as procurement and operational best practices to manage and drive network transformation.
Future State
In the future, enterprise network operations will be less human-operated, with autonomous AI agents increasingly assuming networking tasks with humans in a supervisory role. Zero-trust security will be more consistently applied across all domains, and enterprises will increase reliance on cloud services backed by primarily internet-based connectivity.
This future-state network roadmap is a vision of how the strategy for enterprise WAN, campus, and data center networks will evolve to meet organizations’ changing business objectives. Meanwhile, this strategy will address budget realities, existing infrastructure, network security needs, and legacy organizational culture. The biggest difference from the current state of enterprise networking will be described in the following sections.
Agentic NetOps Is Critical
Within three years, we expect network teams will be increasingly using and relying on autonomous AI agents. We believe enterprise use of agentic AI will be the most prominent, noticeable, and impactful change to networking within this time frame. For example, we predict that by 2030, 50% of organizations will use agentic NetOps with minimal human involvement, up from nearly 0% in 2025.
Enterprise personnel will interact with these agents via existing communications channels, such as Slack and Teams, and via a conversational interface. For example, in MS Teams, you’ll be able to send an instant message to @networkhelper and say, “Hey, can you help me troubleshoot the Des Moines branch? They’re complaining of slowness.” The agent will have capabilities akin to a network technician or entry-level network analyst.
We expect vendors to deliver agentic NetOps software capabilities either:
- Integrated as part of network and security vendor offerings.
- Offered via multivendor, over-the-top solutions that integrate with network and security vendor offerings.
- Implemented by managed network service (MNS) providers as part of their service delivery platforms.
We expect enterprises will use agents to help reduce reliance on vendor- and technology-specific skills needed to manage and operate the network infrastructure. In addition, agents will help to improve network and application performance to enhance the end-user application experience in support of the organization.
Agents will also drive new insights that weren’t previously available with manual efforts due to complexity and time limitations. The speed and faster responses will result in a better end-user experience and maintain security by responding to threats in near real time. Agents will also accelerate the detection and resolution of network incidents in near real time while reducing false positives.
SASE Offerings Will Expand and Diversify
In this future state, SASE will continue to be the preferred technology to manage secure remote user and branch network connectivity. However, multiple emerging enterprise requirements will drive demand for new SASE features.
- AI-security and traffic management: Gartner predicts that by 2028, one-third of user interactions with GenAI will invoke autonomous AI agents to complete tasks, and much of this traffic will occur outside SASE visibility and control. For AI agent traffic occurring within an organization’s in-house AI applications environment, the resulting unpredictable network traffic patterns will require additional SASE network management capabilities.
- Data sovereignty: Geopolitics is likely to influence enterprise customer requirements for data traffic and storage within specific geographic boundaries (see How to Evaluate Sovereign Hosting Options to Reduce Geopolitical Risk). SASE products, in turn, will need to develop geographic management controls for network traffic and security.
- Postquantum cryptography (PQC): SASE products will need to include encryption methods using modern cryptographic algorithms that can resist quantum computer attacks capable of breaking classical cryptography. This will prevent the “harvest now, decrypt later” threat. (see Best Practices for Quantum-Safe Networks).
To manage these more diverse requirements, network and security teams will more often collaborate to assess and select vendors.
Compute Resources Are Increasingly On-Premises and AI-Centric
AI and modernization will continue to drive enterprise data center and compute strategy. Demand for on-premises AI workloads will continue, driven by growing open-source AI models and frameworks, rising cloud and data transfer costs, and growing concerns for data privacy and data sovereignty. Resources supporting AI applications will be housed not in a single data center but distributed across company headquarters, colocation facilities, and edge locations, in part to distribute AI compute’s significant electrical power consumption. Connections between AI compute locations will increasingly be high-quality, with minimal latency and packet loss.
AI also will continue to influence operations within these data centers. To support individual AI systems, enterprises will increasingly invest strategically in scale-up AI fabrics (SAIF) that provide high-bandwidth, low-latency physical network interconnectivity and enhanced memory interaction between nearby AI processors. For multiple AI systems, some enterprises will build out Ethernet data center switch fabrics that will supply 800 Gbps or greater connections between graphic processing units (GPUs) with no packet loss.
Use of Ethernet rather than InfiniBand in AI switch fabrics will help reduce investment costs. At the same time, data center support teams increasingly collaborate with network and cloud teams, and they will be trained (leveraging online and vendor resources) to support this AI-centric network infrastructure.
For non-AI applications and workloads, enterprises will continue to modernize support infrastructure and services for hybrid on-premesis and cloud environments. The emphasis will be on consistent, reliable, high-quality connectivity, with greater flexibility to move workloads between these environments to better serve enterprise business needs.
WAN Is Optimized for Cloud and AI
Enterprises’ increased reliance on public cloud services and growing AI adoption will reshape WAN infrastructure and services, driving more efficient connectivity and management options to support business-critical applications and compute resources.
Most enterprises will continue to rely primarily on internet-based connectivity for cloud services. However, they will selectively invest in private connectivity such as MPLS, Ethernet, and wavelength to support latency or security-sensitive cloud applications and workloads. They also will selectively invest in cloud hub, software-defined cloud interconnect (SDCI), and network providers’ carrier-based cloud interconnect (CBCI) services that offer connections to multiple CSPs in centralized data centers or colocation facilities.
Meanwhile, enterprise AI and agentic AI adoption will generate demand for connectivity not only to the cloud but between clouds — for example, to connect an AI LLM in one cloud to an AI agent-powered application in another. In response, a subset of enterprises will turn to multicloud connect services operated by cloud hub, SDCI, and CBCI providers. CSPs also will launch cross-cloud integration framework services that supply connectivity between clouds.
To manage WAN topologies, most enterprises will continue to use SD-WAN — often as part of a SASE implementation — to manage traffic flow between enterprise locations and CSPs. However, we expect growth in organizations that adopt a coffee shop networking approach. In this scenario, all enterprise applications are in the cloud, and user traffic is directed over dedicated or broadband internet connections to cloud security and CSP gateways. This results in consistent user access security and applications performance via less expensive, lightweight SD-WAN or even no SD-WAN overlay (see Reference Architecture Brief: Modern Office Network Design for a Coffee Shop-Style User Experience).
To capitalize on enterprises’ need to streamline WAN management, NSPs and managed network providers will enhance their managed network services with cloud connectivity and security offerings. However, agentic NetOps capabilities built into network infrastructure and security vendor offerings and available via multivendor, over-the-top products will allow organizations better ability to self-manage their WANs, lessening demand for managed services (see Why Agentic NetOps Will Move Enterprises Away From Managed Network Services).
Most enterprises will continue to purchase network infrastructure and seek fixed-price network services. A smaller subset of enterprises will switch to equipment vendors and network service providers’ network-as-a-service (NaaS; see Note 1) offerings that typically include dynamic scaling up and down of network resources, leased equipment, and consumption-based or subscription pricing. However, adoption will be limited due to lack of consistent features, overpromised flexibility (often supporting ability to scale up capacity but more limited ability to scale down), insufficient cost predictability, and overall higher pricing compared to traditional delivery models.
Network, cloud hub, and SDCI providers also will increasingly offer additional options for cloud connectivity usage-based port and bandwidth options along with fixed bandwidth and port pricing options. This, too, will see limited uptake among enterprises due to lack of price predictability.
Campus LANs Are More Automated and Consistently Secure
Enterprise campus networking will shift in response to three interrelated trends: the rise of autonomous operations, NaaS models, and software-driven innovation.
Campus LANs will increasingly operate with minimal manual intervention, enabled by campus infrastructure and operations software (CIOS) and emerging capabilities like agentic NetOps. These innovations automate operational workflows, support multivendor integration, and deliver autonomous, policy-driven network behavior.
Enterprises will pursue hands-off operations through two primary paths. Many will adopt a DIY approach, investing in CIOS and retaining the resources to operate it themselves. Others — especially those with limited operational capacity — will turn to emerging NaaS offerings, where vendors provide LAN hardware, software/cloud platforms, and either co-managed or fully managed services. These models often include self-management portals and consumption-based pricing based on square footage that help streamline costs and reduce underutilization.
Wireless-first architectures will dominate, supporting IT, IoT, and OT devices across Wi-Fi, public cellular, and private mobile networks (see How to Enhance Local Wireless Network Connectivity). Wi-Fi 7 adoption will be driven primarily by life cycle alignment and investment protection, while private 5G will serve performance-sensitive use cases in sectors such as manufacturing and transportation.
Security architectures will consolidate. Universal zero-trust network access (UZTNA) will increasingly replace coarse-grained controls like NAC with fine-grained, context-aware access policies. UZTNA supports both on-premises and remote users, enabling consistent, location-independent access control across campus, branch, and cloud environments.
Zero-Trust Concepts Infiltrate Network Designs
As enterprises adopt UZTNA in campus LAN environments, I&O and security teams are expanding zero-trust principles across all domains — especially at the destinations in cloud and data center environments. In this future state, zero-trust networking (ZTN) becomes a unified operating model, enforcing identity-first access, least-privilege controls, and adaptive policy across user-to-application and workload-to-workload traffic.
A full ZTN infrastructure meets the following three requirements:
- Access to the network is granted only after identity is authenticated and authorized.
- Network access is restricted only to necessary resources.
- Network access is continuously adjusted in near-real time, based on risk derived from identity and context.
Scaling ZTN requires I&O to lead operational execution. This includes integrating zero trust into cloud environments, where policy enforcement must span multicloud and hybrid architectures, and into data centers, where legacy workloads require secure enclaves and compensating controls. Application segmentation must also evolve, using label-based policies and telemetry to enforce least-privilege access.
Gartner estimates that by 2028, 30% of organizations will abandon zero trust programs due to complexity, cultural resistance, and lack of operational ownership.1 To avoid this outcome, I&O must treat zero trust as a continuous discipline embedded in infrastructure strategy and operational workflows (see Best Practices for I&O to Operationalize Zero-Trust Networking).
Current State
Agentic NetOps Is Immature or Nonexistent
To date, the use of AI in networking has been limited. Many vendors have released AI network assistants that aid with troubleshooting or traditional tasks, but their autonomous AI agent upgrades are limited. AI agents so far have added some incremental value but haven’t improved networking operations substantially.
However, a new emerging technology called agentic NetOps offers much more promise. Vendors are in the very early stages of designing and delivering software that leverages goal-driven, autonomous AI agents, with capabilities such as memory, planning, sensing, tooling, and policy guardrails, that have been granted rights by the organization to operate network tasks and processes independently. AI agents may work independently or as part of a system to communicate autonomously with other AI agents, devices, and tools. This allows them to manage network infrastructure life cycle management with minimal to no human involvement.
Network Security Implementations Are Suboptimal
Organizations often rely on SD-WAN, CASB, SWG, ZTNA, and firewall products from different vendors, which leads to administrative inefficiency, hampers business agility, and can reduce cybersecurity. We estimate that 15-30% of our clients have adopted SASE, which helps to address this issue.
The majority of SASE adoption to date has been dual-vendor, typically integrating SD-WAN with SSE. Going forward, we are seeing ample demand for unified SASE platforms, which eliminates the need to swivel between two vendor management consoles. It also reduces multivendor management and integration required in dual-vendor implementations. We also see an increasing desire from clients for distributed and flexible policy enforcement, including local and enterprise-owned offerings to address increasing sovereignty performance and/or geopolitical challenges.
Further, most existing SASE implementations have limited capabilities to address nonhuman identity associated with AI agents. Lastly we don’t see the implementation of quantum-safe algorithms in most SASE implementations to date.
Compute Resources Are in Data Centers and the Public Cloud
Enterprise applications are primarily hosted in centralized corporate data centers (including colocation facilities) or in public cloud environments. There is limited ability to shift resources between these environments. Meanwhile, AI compute resources, while growing, are mostly in cloud environments and constitute a small percentage of overall workloads in corporate data centers or colocation facilities.
WANs Are Difficult to Manage and Perform Inconsistently
Enterprises manage a mix of internet and private WAN connections with inefficient connectivity topologies. Most enterprises have adopted SD-WAN, but deployments may be overly complicated based on the organization’s actual networking needs. SASE, meanwhile, still favors dual-vendor deployments, resulting in less efficient network and security integration and more complicated vendor contract management.
Cloud connectivity strategy often is fragmented, with investment based on reactive, individual link upgrades that result in inefficient network designs with greater contract management burdens. Wireline WAN connectivity services usually include more limited pricing options, typically offering unlimited data usage at set port data speeds and fixed or burst access data speeds.
Network providers’ NaaS alternatives are not uniform and often are confusing enterprise customers. More importantly, while they offer some upfront cost reductions, they often do not result in long-term cost savings. Therefore, most enterprises purchase network infrastructure equipment, resulting in high upfront costs and requiring significant expense when this equipment must be replaced.
Campus LAN Management Is Manual and Inconsistently Secured
Enterprise campus LANs include a mix of wired and wireless connectivity managed in-house or outsourced to managed network providers. MNS providers have automated a portion of their workflows, but enterprises that self-manage still rely primarily on manual processes that require significant staff resources. This makes it difficult and time-consuming to modify to meet changing user connectivity needs. Security varies by location, ranging from network access control (NAC) in corporate locations and ZTNA for remote users, making it difficult to manage consistent access policy.
Network, Security and Cloud Teams Are Siloed
In many enterprises, the traditional network, security and cloud organizational silos still exist. As a result, network investment decisions are not always aligned with network security priorities, and vice versa. Meanwhile, cloud development teams are not always consulted by network teams that are assessing cloud networking infrastructure or services investments. Therefore, network investments can be misaligned with the organization’s security and cloud applications needs.
Organizations Do Not Prioritize Key Technology Skills Acquisition
Organizations’ network technical enrichment programs often focus on certifications to support current network operations. Rarely do they offer enrichment programs that expose network teams to important new technologies, such as AI and agentic AI. Similarly, new hires are primarily selected for their traditional technical skills to support current operations and are rarely required to have new technology training or skills.
Remote Access and Corporate Access Are Secured Separately
Although many enterprises have shifted back to in-office work, they have maintained remote work options on a limited basis. However, remote and in-office user access often is secured separately. While many enterprises have transitioned from products based on legacy virtual private network (VPN) to ZTNA, many corporate offices still rely on traditional NAC security. This creates uneven security policy control and inconsistent user experience for workers who split their time between remote and in-office work.
Gap Analysis and Interdependencies
Enterprise networking can better meet organizational business needs by becoming more integrated, cross-platform-aware and responsive. To do so, several gaps must be closed:
- Limited AI knowledge: AI technology development is rapidly expanding but still in a formative stage, and most I&O organizations have limited knowledge or experience applying it to their operations.
- Reliable and trusted AI agents: Agentic AI technology is early-stage. The accuracy and reliability of autonomous agents in carrying out network tasks is not proven, making investment justification difficult.
- Enterprise network strategy doesn’t align with security and cloud needs: Enterprises’ procurement of services and infrastructure across the WAN, LAN, cloud, and security domains is rarely coordinated, despite cross-functional interdependencies.
- SASE products are immature: Dual vendor implementations are common. Dual vendor and SASE platform offerings also lack AI traffic control, data sovereignty, and PqC features.
- Organization structures limit coordination between network, security, and cloud teams: Network, security, and cloud teams operate independently, with limited cross-team coordination.
- Enterprise network investment focuses on refresh and/or immediate needs: Enterprise network investments target individual infrastructure or service upgrades to meet an acute, immediate need, resulting in inconsistent performance.
- Siloed on-premises and cloud compute resources: Enterprises must maintain legacy applications hosted on-premises while separately managing newer applications hosted in cloud environments.
- LAN still includes wired and wireless connectivity with inconsistent security: LAN and campus network functions are not “wireless-first,” which limits flexibility. While UZTNA adoption is growing, access control in many campus LANs is still based on a mix of ZTNA and NAC, leading to inconsistent security across all users and devices.
- Inconsistent user security and applications experience across all devices and locations: When users move between devices and locations, there is no way to guarantee consistent security, applications performance or access to corporate digital assets.
- NaaS and usage based pricing models are more available but do not offer cost savings: WAN network services and infrastructure vendors are increasingly offering NaaS options as well as usage-based pricing models. However, these options rarely offer enterprises long-term cost savings compared to traditional services and fixed usage pricing models.
Migration Plan
Based on the gap analysis, we propose the following migration plan for enterprise networking. This will require multiple steps, prioritized by near-term, midterm and longer-term actions (see Figure 2).
Higher Priority
Pilot and adopt emerging AI-enabled capabilities:
- Test and validate AI and agentic AI technology via pilots to verify its value-added benefits, as well as ease of integration with existing network IT service management (ITSM) operations.
- Test AI functionality (including AI agents) in a proof of concept (POC) to validate capabilities and verify recommendations before moving to production.
- To support AI and GenAI clusters in the data center, build out a dedicated SAIF network to connect GPUs within a single AI system and Ethernet to connect multiple AI systems.
- Shift network budget allocation to agentic AI software and away from hardware and MNS offerings.
- When refreshing/renewing network equipment, use agentic NetOps capabilities as a primary differentiator.
- Allocate innovation time for personnel to investigate and pilot agentic NetOps solutions.
- Prefer agentic NetOps software that allows integration with existing systems via a conversational UI (i.e., Teams, Slack) versus having to interface with yet another console.
Transition to unified SASE offerings to modernize secure branch and remote user connectivity.
- Engage network and security teams to evaluate and consolidate existing networking and security contracts to minimize duplicate spend.
- Develop a roadmap for the organization to identify if new SASE capabilities are required to determine if you should wait, procure point solutions or change vendors.
- Invest in short-term point solutions to address current gaps in SASE capabilities for AI traffic control, data sovereignty and PQC, and require existing vendors to provide their roadmaps to add these capabilities.
Medium Priority
Drive increased collaboration and integration between networking, data center, and security teams, particularly when planning or deploying ZTN technologies:
- Require security and network teams to participate in the RFP/RFI process for SSE and SASE investments.
- Modernize identity infrastructure with identity access management life cycle process, consolidate identity resources, deploy phishing-resistent MFA, and secure machine identities.
- Create a zero-trust center of excellence. Ensure I&O teams are trained on zero-trust principles and have clear processes for managing exceptions and scaling operations.
Cultivate skills in new technologies, such as AI and cloud networking, for new and existing staff by creating a talent program in coordination with HR:
- Invest in personnel in key operational areas such as network automation, monitoring, and data centers.
- Assign dedicated teams to accelerate innovation, while legacy teams continue current operations. Migrate legacy resources to support new technologies are adopted and implemented.
- Shift hiring and training focus toward technologies including automation, AI, and agentic AI.
Set aside 10% of I&O staff time per week for new technology training and testing, including pilots of AI products and agentic AI tools. These evaluations must focus on delivering business value, such as improved efficiency, management, or cost reduction.
- Change network team performance evaluations to include business-oriented goals, such as faster service delivery, improved network availability and response, and reduced operating expenses. This will motivate team members to explore and use automation, AI, and agentic AI tools.
Lower Priority
Support core and edge compute resources by investing in enhanced connectivity products and services:
- To support compute resources in multicloud environments, strategically deploy cloud onramp solutions such as cloud hubs and software-defined cloud interconnect (SDCI).
- To serve compute resources across all locations, require strong connection SLAs, including high availability with low latency, packet loss, and jitter.
To improve enterprise LAN management and security, transition to hand-off operations and UZTNA:
- Focus investments on infrastructure that includes automated AI processes that provide better visibility, monitoring, and change management to meet user connectivity needs.
- Transition to UZTNA to provide consistent security including access control for all users, devices and locations.
- Invest in Wi-Fi 7 for longer product support compared to Wi-Fi 5/Wi-Fi 6 models.
- Selectively invest in private 5G if there is a need for larger coverage areas and device densities, improved performance, resilience, and low-latency performance.
Acronym Key and Glossary Terms
| AI | Artificial Intelligence |
| API | Application Programming Interface |
| CASB | Cloud Access Security Broker |
| CBCI | Carrier-Based Cloud Interconnect |
| CIOS | Campus Infrastructure and Operations Software |
| CSP | Cloud Service Provider |
| GPU | Graphics Processing Unit |
| HMF | Hybrid Mesh Firewall |
| ITSM | IT Service Management |
| LAN | Local-Area Network |
| MCNS | Multicloud Networking Software |
| MFA | Multi-Factor Authentication |
| MNS | Managed Network Services |
| NAC | Network Access Control |
| NaaS | Network-as-a-Service |
| NetOps | Network Operations |
| POC | Proof of Concept |
| PQC | Post-Quantum Cryptography |
| RFP | Request for Proposal |
| RFI | Request for Information |
| SAIF | Scale-Up AI Fabric |
| SASE | Secure Access Service Edge |
| SD-WAN | Software-Defined Wide-Area Network |
| SDCI | Software-Defined Cloud Interconnect |
| SLA | Service-Level Agreement |
| SSE | Security Service Edge |
| SWG | Secure Web Gateway |
| UZTNA | Universal Zero Trust Network Access |
| VPN | Virtual Private Network |
| WAN | Wide-Area Network |
| ZTNA | Zero Trust Network Access |
| ZTN | Zero Trust Networking |
1 2023 Gartner State of Zero-Trust Strategy Adoption Survey. This survey was conducted to understand the current state of zero-trust strategy adoption across the industry and to reduce confusion about the scope and maturity of zero-trust strategies across industries and verticals worldwide. The survey was conducted online from 23 October to 24 November 2023 among 303 respondents from North America (n = 134 in the U.S. and Canada), EMEA (n = 98 in France, Germany and the U.K.) and Asia/Pacific (n = 71 in Australia, India, the Philippines and Singapore). Respondents’ organizations had $500 million or more in 2022 enterprisewide annual revenue, and 2,500 or more employees. Respondents were qualified if their organization had already implemented (fully or partially) or was planning to implement a zero-trust strategy. Respondents were also required to have visibility into the strategies or investment decisions related to zero-trust strategy. Disclaimer: Results of this survey do not represent global findings or the market as a whole, but reflect the sentiments of the respondents and companies surveyed.
Notes: NaaS
NaaS is a standardized and highly automated delivery model for networking functionality. It offers support for dynamic scaling up and down of network resources. The NaaS vendor primarily owns and operates NaaS offerings. Pricing is on a pay-for-use basis, or as a subscription based on usage metrics. Typically, self-service interfaces — including an API and a user portal — are exposed directly to customers (see Hype Cycle for Enterprise Networking, 2025).