Each team comes with what needs to be done, and the teams work together on how to get it done. That sentence is the whole method, and it's harder to run than it reads.
Monday left the two rooms separate on purpose, because that's where most organizations still plan. This piece walks into the network, which is where the separate rooms do the most damage and where putting them together paid off the most for us.
The network has to do its primary job. It moves traffic, it connects people to the applications they need, and nobody thanks it when it works. It's also a major attack vector, and security has to protect it. Both of those facts live inside the same design, and in most organizations two different teams plan them on two different calendars.
Here's how that usually goes. The network team designs for performance and availability, picks the best equipment for that job, and hands off the design. Security takes the finished design and protects it the only way it can at that point, which is by adding tools on top.
Some tools land on the network. A lot of them land on the endpoint, because the endpoint is the one place security can still reach without asking the network team to redesign anything. So the endpoint team inherits agents, and every laptop in the company carries the weight of a planning decision made in a room the endpoint team never entered.
Every one of those choices was right for the team that made it. They chose the best of the best for their need. Nobody chose the thing that would have helped the team next to them, because nobody in either room could see that path.
Best is a word that only works inside one room. Carry a best of breed choice into the next room over and it often turns into somebody else's agent, somebody else's license renewal, somebody else's ticket queue. No planning template has a column for that.
We planned it the other way. For us, it started when the teams were aligned under one leader, and everything changed from there. That alignment should be the catalyst in every organization, and too often it isn't.
One leader matters because the trade between teams stops being a negotiation between peers. When network and security report to different people, every concession is a loss somebody has to explain upward. So nobody concedes. Under one leader, the question changes from whose design wins to which design serves the business, and the person asking it owns the outcome on both sides of the table.
Network, security and the endpoint team sat down as one planning team, and each one came with what it needed. The network needed to do its primary job, and do it faster. Security needed visibility and protection across something that will always be a major attack vector. The endpoint team needed fewer things running on every device.
The how was the shared part, and the how turned out to be the network design itself, which no single team would have reopened on its own. We changed the design, the segmentation and the technology underneath both. We moved the protection plane onto another path. The CDN got faster.
It got fast enough, which was the entire point, because we were never chasing numbers. We were chasing usability and experience.
EDR, SASE, segmentation, OTEL and the SIEM stopped behaving like five purchases owned by whoever happened to buy them. They started working as one design, built for every team at the table at the same time. Once protection lived in the network path, the endpoint team could remove 81% of its security agents. Security got better visibility and better protection during the process, while the agents were coming off, which is the part that sounds wrong until you see it.
The result was a $5M reduction in spend and a 51% increase in attack surface coverage. Users got a better experience out of the same change, in the things they actually notice, which are their device, where they can get access, how usable it is, and whether that access is safe. None of those three would have shown up in any single team's plan, because each one depended on a decision another team had to make.
Think about where that $5M sat before. It sat in approved budgets, inside plans that each passed their own review, in front of a board that believed it was looking at one strategy. The shareholder was already paying it. Nobody had lied, and nobody had looked across the rooms either.
So why doesn't this happen everywhere? I call the reason protectionism. Teams protect their scope, their tools and their budget, and they come by it honestly. Skill alignment builds teams around what they're good at, and then job descriptions, charters and team expectations tell each team which agenda to serve.
None of those documents reward a decision that makes another team's work easier. A network engineer who accepts a design built around a protection path gets no credit for the endpoint agents that came off as a result. A security engineer who gives up an agent he picked and tuned gets asked, reasonably, why coverage should go up when his tool just went away. Every incentive points inward.
Each team brings the what. The how belongs to all of them, and the how is the part protectionism refuses to hand over.
Week 38 argued for writing a team's charter without a tool or a skill in the sentence. That's what skipping it costs. A charter that names the skill tells the team what to defend once it walks into the planning room, and the team defends it, every time.
The myopic focus of engineers is the visible symptom. Engineers are paid to go deep, and deep is exactly what makes a network fast or a detection pipeline accurate. Deep also narrows the view, and somebody has to stand far enough back to see the path that runs through three teams. They never see the path due to the inability to think holistically, and most planning processes never ask them to try.
The wrong version is appealing because every piece of it is defensible. Each team can walk into its own review and show that it bought the strongest product for its requirement, inside its budget, on its timeline. The scorecard comes back green in every room. The cost lands somewhere nobody is measuring, in an extra agent on a laptop, a duplicate license, a blind spot between two tools that each work perfectly.
Shareholders pay for all of it twice. Once for the tools, and again for the risk that sits in the gaps between them.
The right version asks a team to accept a decision that looks worse on its own scorecard and better for the business. The network team gives up some say over the path. Security gives up tools it trusts. The endpoint team gives up the comfort of an agent that at least tells it something.
Each loss is real, and each one is smaller than what the combined design returns.
If you want to run this, start with the what. Have each team write down what it needs from the next planning cycle, in plain terms, before anyone names a product.
A what sounds like a requirement a business owner would recognize, such as faster access to an application or visibility into every path an attacker could take. The moment a product name shows up on the list, it has stopped being a what. Then put those lists in one room and argue about the how together, with the rule that nobody's preferred tool survives the first session by default.
Pick something that does a primary job and is also an attack vector, because that's where the payoff is largest. The network is the obvious first candidate. Identity and the data platform are close behind, for the same reason.
Watch the second order effect. When protection moves into the design, tools start coming out of other places, and the spend that comes out with them is how you fund the next round. Coverage goes up at the same time, which turns the next budget conversation into a very different meeting.
It gets hard the moment a team has to surrender something. For us, the network team pushed back the hardest, since best design should always be the target. When good design prevailed in collaboration, everything changed. Expect it, plan for it, and keep the conversation on the what, because nobody can argue with a requirement they wrote themselves.
Choosing the best of the best for your own need is the easy call, and it's the one every scorecard rewards. It wins your room. The room next door gets the bill. Finding a good solution that helps others is harder, and it usually means losing an argument you could have won in your own room, with your own scorecard behind you. It's also the only version the shareholder believed they were buying.