A computer-implemented method (200, 300, 400) of operating a software-defined network, the method comprising: ranking a plurality of cryptographic primitives according to one or more of security, throughput, and latency; generating a plurality of security profiles by selecting from the ranked cryptographic primitives; for each of a plurality of paths through a data plane: obtaining (S310, S410) specifications of a respective plurality of data plane elements which together form that path; and determining, (S320, S420) based on the specifications, which one or more of the plurality of security profiles that path is capable of complying with; the method further comprising: initialising (S240, S440) the plurality of paths for traffic associated with a category of applications and/or services; selecting (S245, S445) one of the plurality of paths to be an initial operational path; routing (S250, S350, S450) traffic associated with the category of applications and/or services via the initial operational path in compliance with an initial security profile selected from the plurality of security profiles; subsequently obtaining (S260, S360, S460) data indicating that a trigger event has occurred; and, responsive thereto: selecting (S280, S480) a different one of the plurality of paths to be a replacement operational path; selecting a (S370, S470) different one of the plurality of security profiles to be a replacement security profile; and routing (S290, S390, S490) traffic associated with the category of applications and/or services via the replacement operational path in compliance with the replacement security profile. ranking a plurality of cryptographic primitives according to one or more of security, throughput, and latency; generating a plurality of security profiles by selecting from the ranked cryptographic primitives; for each of a plurality of paths through a data plane: obtaining (S310, S410) specifications of a respective plurality of data plane elements which together form that path; and determining, (S320, S420) based on the specifications, which one or more of the plurality of security profiles that path is capable of complying with; obtaining (S310, S410) specifications of a respective plurality of data plane elements which together form that path; and determining, (S320, S420) based on the specifications, which one or more of the plurality of security profiles that path is capable of complying with; the method further comprising: initialising (S240, S440) the plurality of paths for traffic associated with a category of applications and/or services; selecting (S245, S445) one of the plurality of paths to be an initial operational path; routing (S250, S350, S450) traffic associated with the category of applications and/or services via the initial operational path in compliance with an initial security profile selected from the plurality of security profiles; subsequently obtaining (S260, S360, S460) data indicating that a trigger event has occurred; and, initialising (S240, S440) the plurality of paths for traffic associated with a category of applications and/or services; selecting (S245, S445) one of the plurality of paths to be an initial operational path; routing (S250, S350, S450) traffic associated with the category of applications and/or services via the initial operational path in compliance with an initial security profile selected from the plurality of security profiles; subsequently obtaining (S260, S360, S460) data indicating that a trigger event has occurred; and, responsive thereto: selecting (S280, S480) a different one of the plurality of paths to be a replacement operational path; selecting a (S370, S470) different one of the plurality of security profiles to be a replacement security profile; and routing (S290, S390, S490) traffic associated with the category of applications and/or services via the replacement operational path in compliance with the replacement security profile. selecting (S280, S480) a different one of the plurality of paths to be a replacement operational path; selecting a (S370, S470) different one of the plurality of security profiles to be a replacement security profile; and routing (S290, S390, S490) traffic associated with the category of applications and/or services via the replacement operational path in compliance with the replacement security profile.