§ Playbook · IT Operations
The AI playbook for IT Operations
IT ops has the clearest AI economics of any function and the widest gap between claimed and actual results. This playbook covers what containment really looks like, what happens to L1, why your ITSM vendor is selling you both the disease and the cure, and a 90-day path that survives contact with reality.
Free · no form, no follow-up sequence
Gartner's verdict on AI in infrastructure and operations: 28% of use cases fully succeed, 20% fail outright, and the rest stall somewhere in the middle. The difference is rarely the model. It is usually the knowledge base nobody wanted to maintain.
28%
of AI use cases in I&O fully succeed; 20% fail outright.
Gartner, April 2026
41.2%
median enterprise automated-resolution rate - against vendor claims of 70-80%.
Zendesk benchmarks, 2026
9,000 → 5,000
Salesforce support headcount after AI took half its interactions.
Benioff / CNBC, September 2025
§ Part one
What actually changes.
The evidenced win in IT ops is boringly specific: high-volume, low-complexity tickets. Password resets, access requests, software provisioning. IBM's AskIT cut calls and chats by 74% - a real number, built over roughly eight years of unglamorous work on knowledge, data and process. Not a 90-day miracle, and not a chatbot bolted onto a mess.
Meanwhile the vendors have made their position clear. ServiceNow is now openly selling the automation of the L1 role, and paid $2.85bn for Moveworks to own the deflection layer. Your ITSM supplier is monetising the elimination of the seats it also charges you for. Worth remembering at renewal.
01
L1 tickets get contained, genuinely
Best-in-class deflection runs at 55-65% for the routine tier. But note the honest median is 41%, and only around 14% of issues reach full self-service resolution. Deflection and resolution are different words because they are different things.
02
Incident response gets an assistant, not a replacement
What works in production: alert correlation, noise reduction, automated timelines, drafted postmortems. Autonomous remediation remains rare, and everyone credible keeps a human in the loop. AIOps promised more for a decade; Gartner quietly retired the category name in 2025.
03
The knowledge base becomes the product
Knowledge quality determines deflection performance more than model choice does. The unfashionable work - articles, ownership, hygiene - is now the highest-leverage engineering in the department.
04
Average ticket difficulty goes up
AI skims the easy tickets, so everything reaching a human is harder. Your L2 and L3 people feel busier, not freer. Plan capacity and morale for that, because the dashboard will insist things improved.
05
Outsourcing gets repriced
HCL's own CEO forecasts 3-5% 'AI deflation' on revenue; clients are reopening outsourcing contracts within 24 months rather than waiting for renewal. If your provider's costs are falling and your invoice is not, you know where the saving went.
06
Autonomy stays on a leash
Agents that touch infrastructure need scoped permissions, approval gates and audit trails - the governed-worker model. Anything else is an outage with a countdown timer.
§ Part two - the honest bit
What it costs you.
The headcount story here is real and public. Salesforce took support from 9,000 people to 5,000 - Benioff's phrase was 'I need less heads'. The US Bureau of Labor Statistics now forecasts computer support roles declining 3% over the decade, explicitly citing automation - the first official forecast to pin an IT occupation decline on AI.
And yet: Gartner predicts half the companies that cut headcount citing AI will be rehiring for similar work under new job titles by 2027. Klarna already did, publicly. The honest plan is neither 'nobody goes' nor 'everyone goes' - it is knowing which tickets a machine resolves before you resize anything.
01
L1 shrinks - after resolution is proven
The routine tier gets smaller. The mistake is sequencing: cut on the vendor's deflection claim and you rediscover the difference between deflected and resolved through your escalation queue, like Klarna did through its NPS.
02
The ITSM licence paradox lands on your budget
Now Assist is priced at a 50-60% uplift plus consumption fees - a premium paid to the platform to reduce the seats you pay the platform for. Do that maths before you sign, and put seat reduction in the same business case.
03
Outsourced contracts need reopening
People-and-time pricing breaks when AI shrinks the team. Reopen the contract this year, or fund your provider's margin expansion out of habit.
04
The remaining humans need a new deal
Harder tickets, incident command, agent supervision, knowledge stewardship - genuinely more senior work. Pay and title should follow, or the people capable of it will do it somewhere else.
05
Some AIOps investment is sunk
If your monitoring platform delivered alert deduplication dressed up as intelligence, say so, stop the roadmap sunk-cost, and put the money into knowledge and automation that resolves things.
06
The vendor count is a warning in itself
Gartner reckons only around 130 of the thousands of 'agentic' vendors are real; the rest are agent-washing. Your procurement process is now a security control.
§ Part three
What good looks like.
Good IT ops on the other side of this measures resolution, not deflection. Machines own the routine tier with proper guardrails; humans own incidents, judgement and the knowledge that feeds the machine. Contracts - internal and external - reflect the new cost of the work rather than the old shape of the team.
01
Containment with an honest denominator
The routine tier runs through AI with resolution measured end-to-end, including the tickets that bounce back. The number reported upward is the one a sceptical auditor would accept.
02
Humans on incidents and judgement
Incident commanders, escalation engineers, agent supervisors and knowledge owners - a smaller team doing distinctly harder work, with the career path and pay to match.
03
Governed agents, scoped blast radius
Named jobs, scoped permissions, approval gates, audit trails and a definition of done. If an agent can touch production, someone can show you exactly what it is allowed to break.
04
Contracts that track the new economics
ITSM licences, outsourcing agreements and internal chargebacks all repriced against what the work now costs - reviewed annually, because the economics will not sit still.
The change, across all five pillars
People
L1 resized only after resolution is proven, with a named senior path for the people who stay.
Processes
Escalation, approval gates and incident command redesigned around the agent, not bolted on after it.
Data
The knowledge base treated as the product - owned, audited, and current enough to trust.
Platforms
ITSM licences and AI uplifts priced against seat reductions, in the same contract.
Partners
Outsourcing agreements reopened to follow the new cost of a ticket, not the old shape of the team.
§ Part four
The first 90 days.
One ticket category, contained properly and measured honestly. IBM took eight years; you are buying the earned patterns, not the timeline - but you still cannot skip the sequence.
Ⅰ
Weeks 1-2
Baseline the ticket reality
Volume, categories, true cost per ticket, current resolution rates - and an honest audit of knowledge-base coverage for your top ten categories. This audit predicts your result better than any vendor demo.
Ⅱ
Weeks 3-6
Contain one category in production
Pick the highest-volume routine category. Fix its knowledge articles first, then stand the agent up with escalation paths and approval gates. Measure resolution, not deflection.
Ⅲ
Weeks 7-10
Verify, then touch the money
Check escalation queues, reopen rates and user satisfaction against the baseline. If it holds, open the commercial conversations: seat counts, the outsourcing contract, the licence uplift.
Ⅳ
Weeks 11-13
Widen, and reshape the team openly
Take the next two categories. Publish the honest role map: what shrinks, what the senior path looks like, who gets trained into knowledge and agent-supervision roles. Before the rumour mill drafts it for you.
The day-90 scorecard · what you should be able to show
§ Part five
The traps, so you can skip them.
Trap 01
Believing the vendor's number
Claimed deflection of 70-80% against a real-world median of 41% is not a rounding error. Ask for resolution rates, reference customers, and the definition of 'resolved'. Watch them flinch.
Trap 02
Cutting before resolving
Headcount reductions based on projected containment are how you end up rehiring at contractor rates with an apology. Klarna has kindly run this experiment for everyone.
Trap 03
Skipping the knowledge work
An agent on top of a stale knowledge base is a very fast way to give wrong answers politely. The boring work is the work.
Trap 04
Paying twice at renewal
Signing the AI uplift while keeping every seat is the vendor's dream outcome. Make seat reduction a condition of the same contract, in writing.
Trap 05
Unscoped agents in production
An agent with broad permissions and no approval gate is an incident report that has not happened yet. Blast radius is a design input, not a lesson.
Trap 06
Forgetting the humans who remain
The team that stays gets harder work and more responsibility. Treat that as a promotion problem to solve, not a productivity gain to bank quietly.
§ Before you go
Six questions worth an honest hour.
Score yourself before someone with a rate card does. If more than two answers are uncomfortable, that is not a crisis - it is an agenda.
The self-assessment
§ Start with the workshop
Book your
Catalyst Workshop.
Bring the strategic change you have been circling. In 1-2 executive days, we will turn it into the first move, the case for it, and the mobilisation plan.