This is focusing on John Thurloe, who was spymaster to Oliver Cromwell in the interregnum, so a little under a century after Walsingham.

Correspondence was key - both capturing that of others and obfuscating your own. Cyphers were commonly used, broken, and changed by everyone involved. There's a lot on cyphers used by Thurloe and his contemporaries here. Both Walsingham and Thurloe had men in their service skilled at breaking cyphers - in Walsingham's case Thomas Phelippes and in Thurloe's case John Wallis.

This meant a major source of your information was intercepted post. In times of war this could be captured in battle, but in peacetime it would be a matter of covertly getting your grubby hands on someone else's post before them - Phelippes was apparently skilled at concealing a broken seal on a letter. During his spell as spymaster, Thurloe was appointed postmaster and given authority to open and inspect any correspondence.

Contacts were also vital - these could be legitimate ambassadors or nobles in other courts who you corresponded with openly, or spies in a rival camp who you had 'flipped' to your side. Thurloe had Richard Willys, a member of the anti-Cromwell group 'The Sealed Knot', feeding him information. Your own appetite for information and ability to process it would be what makes a great spymaster.

Both spymasters held the authority to have people arrested if they so desired, so 'acting on it' would be simply directing men to bring the suspect to gaol, whether for trial or simply to detain them. The advances of legality meant that Thurloe operated more openly in terms of legal due process than Walsingham. I'm not as sure in my knowledge of Walsingham but he seems a little more devious than Thurloe - using torture as a means to extract confessions, for example.

Sources:

I don't have books on me so this was good as was this

EDIT: Unfinished sentence, whoops.