> Firstly is this code safe?
No.
- you don't check GetModuleFileName for success (I really hope this code goes nowhere near XP, which broke GetModuleFileName)
- len is unnecessarily an int - make it size_t
- len-7 risks potential underflow if the (ab)user can manipulate the name of your program
- strcat risks potential overflow for the same reason.

> Note I know the name of the executable is net.exe
Today maybe, but what if some wally moves your program to C:\x.exe ?

> I got a compiler warning about using strcat saying I should use strcat_s, but I couldn't get that working.
That doesn't tell us much. You need to show your attempt if you want diagnosis as to how you got it wrong.

> Secondly how do I get the correct length of the executable name?
You could use p = strrchr(buff,'\\');
If successful, p will point to the last '\' in buff.



If you just want to get going and ignore issues, then put this on line 1 of your code.
Code:
#define _CRT_SECURE_NO_DEPRECATE