Latest Articles

Headline: The CAB Is Dead — Long Live the CAB: How Change Authorities Are Decentralizing Decision-Making The Traditional CAB In ITIL v3, the Change Advisory Board (CAB) was the main approval body for changes. It was typically a group of stakeholders who met regularly to review and approve changes. While this model ensured thorough review, it could also create bottlenecks and delays. The ITIL 4 Approach ITIL 4 introduces a more flexible Change Authority model with distributed decision-making . This doesn't mean the CAB is gone—but its role has evolved. The modern Change Authority model: Decentralized approvals based on change type and risk Delegated authority to teams for low-risk changes Automated approvals using AI-powered risk assessment CAB focuses on high-impact, business-critical changes only When to Use a CAB The CAB should be reserved for changes with: High business impact Significant risk Complex implementation Need for cross-functional coordination Modernizing the CAB 1. Expand Participation Instead of the same people meeting every time, use a "subject matter expert CAB" approach where participants are selected based on the change being reviewed. 2. Use Technology The modern change authority model uses tools to track workflows, backlogs, implementation, deployments, feedback loops, and collaborative processes . 3. Focus on Business Context The CAB cannot determine whether a change deserves priority over competing requests or whether the maintenance window is appropriate. Change requests should open with a business impact statement before technical details appear. 4. Automate Low-Risk Approvals Use AI-powered risk assessment to automate approvals for low-risk changes. The Evolving Role of the CAB Traditional Role Modern Role Approve all changes Approve only high-risk changes Meet weekly Meet as needed Static membership Flexible membership Focus on technical details Focus on business impact Conclusion The CAB is not dead—it's evolving. The modern CAB focuses on what matters most (high-impact, high-risk changes) and uses technology to speed approvals for everything else. Action Items for Your Organization Define which changes require CAB approval Establish automated approvals for low-risk changes Create a flexible CAB membership model Implement technology for change management Focus CAB on business impact, not just technical details

You Can't Scale VRM with Headcount Alone — AI Agents Are the Force Multiplier The Scaling Challenge Most organizations recognize that increased third-party oversight is necessary, but few have the budget or resources to do so . A common failure mode: teams pour energy into the obvious "critical" vendors while the broader ecosystem remains lightly assessed, inconsistently monitored, and operationally under-controlled . The result: The long tail of vendors will eat you much more quickly than the obvious critical ones . Why Scalability Matters The volume problem: Even a small organization often has many vendors. Handling multiple assessments sometimes overwhelms teams, especially those with limited resources . The resource gap: Most organizations don't have the headcount to assess all vendors at the same level. A scalable approach is essential. The speed problem: If you can't assess vendors quickly, you can't onboard them quickly. Slow onboarding impacts business agility. How to Scale VRM Without Headcount 1. Use AI Agents AI acts as a force multiplier, transforming security teams from evidence collectors into strategic business partners . AI agents can automate nearly the entire vendor lifecycle, from discovery and tiering to SOC2 analysis and breach notifications . 2. Adopt a Risk-Based Approach Focus efforts on third parties that pose the highest risk to the firm, based on factors such as data access, service criticality, operational resiliency and regulatory impact . 3. Implement Continuous Monitoring Continuous monitoring identifies vendor exposure and breaches automatically, without manual effort . 4. Use Automated Questionnaires Industry-standard questionnaires (SIG, CAIQ, VSAQ) can be sent at scale . While questionnaires have limitations, they provide a baseline for all vendors. 5. Leverage Third-Party Data Security rating services provide independent security posture assessments . These can be used for initial screening and ongoing monitoring. The "Triage" Approach Risk-based tiering: Critical vendors: Full assessment, frequent monitoring Moderate vendors: Standard assessment, regular monitoring Low-risk vendors: Light assessment, periodic monitoring The "risk-based approach" is paramount to drive efficiency across the TPRM lifecycle . AI as a Scaling Enabler AI-powered TPRM can: Automate vendor discovery: Find vendors without manual effort Automate tiering: Classify vendors based on risk Automate evidence review: Analyze SOC reports, penetration tests, and certifications  Automate alerts: Notify teams when risks change The result: Organizations can increase coverage without increasing headcount . Example: Scaling with AI Manual process: Identify vendor manually Send questionnaire manually Review evidence manually Assess risk manually Monitor manually Time per vendor: Hours to days AI-powered process: AI identifies vendor automatically AI sends questionnaire automatically AI reviews evidence and compares to baseline AI assesses risk and flags exceptions AI monitors continuously Time per vendor: Minutes Conclusion To scale TPRM programs without increasing headcount, organizations must enhance their use of AI throughout the vendor lifecycle . AI agents act as a force multiplier, enabling coverage of the long tail that would otherwise be impossible. Action Items for Your Organization Implement AI-powered vendor discovery Adopt risk-based tiering Use automated evidence review Implement continuous monitoring Leverage third-party data for initial screening Scale gradually based on risk tier  

Your IT Environment Is Sending Warning Signals — AI Can Read Them Before You Can What Is Predictive Problem Management? Predictive problem management uses historical data and pattern recognition to forecast potential incidents and performance degradations before they occur . Rather than waiting for incidents to happen and then investigating, predictive problem management enables teams to: Detect anomalies before they become incidents Forecast potential failures Take preventive action Avoid service disruptions entirely How Predictive Problem Management Works 1. Data Collection The system continuously collects data from multiple sources: Historical incidents Events and logs Metrics and performance data Change records Configuration data 2. Pattern Recognition Machine learning algorithms identify patterns that historically preceded incidents. These patterns may be: Temporal (certain times or days) Correlational (combinations of events) Threshold-based (values approaching danger zones) Seasonal (patterns that repeat periodically)  3. Predictive Modeling The system builds predictive models that forecast potential incidents. These models learn from: Historical incident data Environmental changes Outcomes of past predictions Expert feedback  4. Early Warning Alerts When the system detects patterns that match known precursors to incidents, it sends early warning alerts. These alerts include: The predicted failure Estimated time to impact Recommended preventive actions Confidence level 5. Proactive Remediation Based on these insights, the AI Agent suggests preventive actions—such as scaling resources, applying patches, or adjusting configurations—to avoid service disruptions . What Can Be Predicted? Predictive problem management can forecast a wide range of issues: Type Example Performance degradation Memory leaks, CPU spikes Resource exhaustion Disk space, network capacity Service outages Infrastructure failures Security events Suspicious patterns Capacity issues Growth exceeding capacity Customization and Refinement IT teams can customize and refine predictive thresholds and preventive workflows through conversational interfaces, ensuring predictions remain relevant as environments evolve . The Business Impact of Predictive Problem Management Benefit Impact Prevention of outages Reduced downtime Faster detection Problems caught before users notice Reduced incident volume Fewer tickets to process Improved reliability Better service stability Protection against outages up to 48 hours faster Early warning capability  Conclusion Predictive problem management transforms IT operations from reactive firefighting to proactive prevention. By forecasting failures before they impact users, organizations can avoid incidents entirely, reduce downtime, and deliver better service. Action Items for Your Organization Assess your current ability to predict failures—what warning signs do you catch? Identify the most common types of failures in your environment Evaluate predictive analytics capabilities in your ITSM platform Start with a pilot on one predictable failure type Measure reduction in incidents after implementing predictive capabilities  

Headline: From Request to Review — The Seven Stages of ITIL Change Enablement The Change Enablement Lifecycle ITIL change enablement follows a structured lifecycle designed to maximize successful changes while managing risk. Stage 1: Request & Evaluation A change request is submitted and evaluated for necessity and impact. Key activities: Submit Request for Change (RFC) Determine if the change is necessary Identify the change type (Standard, Normal, Emergency) Initial assessment of impact Stage 2: Risk Assessment Potential risks are identified and evaluated. Key activities: Identify potential risks Assess likelihood and impact Determine risk mitigation strategies Evaluate change against business priorities Stage 3: Approval The appropriate Change Authority reviews and approves the change. Key activities: CAB review (for Normal changes) Change Manager approval (for Standard changes) ECAB approval (for Emergency changes) Documentation of approval decisions Stage 4: Implementation The change is executed with minimal disruption. Key activities: Execute change according to plan Follow change implementation procedures Coordinate with stakeholders Monitor for issues Stage 5: Testing The change is verified in a controlled environment. Key activities: Test in staging or test environment Validate that the change works as expected Verify no negative impacts Document test results Stage 6: Review The outcomes of the change are evaluated. Key activities: Post-implementation review Determine if the change achieved its objectives Identify lessons learned Document findings Stage 7: Documentation All changes are recorded for traceability. Key activities: Update the change schedule Document the change outcome Update knowledge management Close the change request The Continuous Improvement Loop ITIL's philosophy of continuous improvement applies to change management as well. The mantra: "Great organizations live and breathe the Continuous Improvement mantra and how to navigate the complexities of change management challenges" . Key to this is the Continuous Improvement Register (CIR): Everyone in IT should enter their ideas into the CIR, no matter how bold or small the suggestion. Continuous Improvement managers review suggestions, analyze the best ones, and create change requests for promising improvements . Conclusion The change management lifecycle provides a structured approach to managing changes from request to review. By following each stage, organizations can ensure changes are implemented successfully while minimizing risk. Action Items for Your Organization Map your current change process against the lifecycle Identify gaps in your process Document the workflow in your ITSM platform Train your team on each stage Implement a Continuous Improvement Register  

AI Agents Don't Just Detect Problems — They Predict and Prevent Them Before They Impact Users The Problem with Reactive IT Operations Traditional IT operations largely operate in reactive mode—responding to incidents only after they impact users or services. While this ensures systems stay operational, it often results in recurring issues, as the underlying root causes remain unresolved. This repetitive cycle places a heavy operational burden on IT teams, who spend significant time triaging tickets and fixing surface-level symptoms instead of addressing the core problems . Despite the clear value of proactive problem management, implementing it effectively is not easy. Key challenges include: Limited historical data, which hinders accurate root cause identification Rapidly evolving IT environments that render static rules and models outdated High dependence on expert knowledge, which is difficult to capture and scale Manual, time-consuming processes that delay detection and resolution  How the AI Agent Transforms Problem Management The AI Agent for Proactive Problem Management is designed to tackle these challenges head-on. By continuously mining vast amounts of operational data, it uncovers hidden signatures of recurring problems that might otherwise go unnoticed. Rather than waiting for incidents to occur, the AI Agent generates actionable recommendations aimed at eliminating systemic root causes, helping teams focus on lasting solutions instead of temporary fixes . The AI Agent is not a single monolithic system; it orchestrates a network of specialized agents, each bringing unique intelligence and capabilities to the table : Perception Agents continuously scan historical data, events, metrics, and logs to detect recurring issues and hidden patterns. By correlating signals across incidents, anomalies, and change requests, these agents uncover detailed problem signatures and even build predictive models to anticipate future failures . Reasoning Agents provide analytical depth. They perform root cause analysis to trace problems back to their origins and generate actionable recommendations. Leveraging predictive models, they forecast potential issues and suggest preventive measures before disruptions occur . Internal Control Agents ensure accuracy and compliance. They validate that identified patterns are reliable, predictions are trustworthy, and recommended fixes are safe and aligned with organizational policies . External Augmentation Agents bring human expertise into the loop. Using conversational AI and Large Language Models (LLMs), they interact with domain experts, capturing tacit knowledge and intuition about problem causes and solutions . Action Agents close the loop by translating insights into action. They notify teams about recurring problems, create change requests, and trigger ITSM workflows . Learning Agents keep the AI system adaptive and evolving. They continuously learn from changing environments and expert interactions, making the agent smarter and more effective over time . The Shift from SLAs to XLAs Beyond reducing incidents, this AI-driven approach shifts IT operations toward a ticketless future—moving past traditional Service Level Agreements (SLAs) to focus on Experience Level Agreements (XLAs). By delivering smarter insights and enabling proactive decision-making, the AI Agent fosters truly resilient IT operations that prevent disruptions before they impact users, reducing reliance on reactive tickets and manual interventions . Real-World Use Cases Eliminating recurring issues by targeting root causes: Pattern detection and analysis: The AI Agent continuously analyzes historical incidents to identify recurring patterns linked to systemic problems Root cause identification: Using advanced reasoning models, it pinpoints underlying causes even when they are hidden across multiple data sources Actionable recommendations: The AI Agent generates targeted recommendations to resolve or eliminate root causes  Predicting and preventing future failures: Predictive modeling: The AI Agent leverages historical data and pattern recognition to forecast potential incidents Early warning alerts: It sends timely notifications about likely failures, allowing teams to prepare and act in advance Proactive remediation: Based on these insights, the AI Agent suggests preventive actions—such as scaling resources, applying patches, or adjusting configurations  The Value Proposition Adopting an AI Agent for Proactive Problem Management brings measurable improvements: Fewer recurring incidents: By identifying and eliminating root causes, the AI Agent significantly improves system stability Early warnings for upcoming issues: Predictive analytics provide timely alerts about potential problems Reduced operational load: Automating noise filtering, root cause analysis, and routine workflows frees teams to focus on innovation Better risk management: With data-driven insights into the potential impact of planned changes, teams can make informed decisions  Conclusion: The Ticketless Future The AI Agent for Proactive Problem Management represents a pivotal shift in IT operations—from reacting to incidents to preventing problems before they occur. This evolution creates a resilient, self-healing IT environment that continuously reduces ticket volumes, lowers operational burdens, and accelerates the transformation toward a truly ticketless future . Action Items for Your Organization Assess your current problem management maturity—are you reactive or proactive? Identify your most common recurring incident patterns Evaluate AI agent capabilities for problem management Start with a pilot focused on one recurring problem type Measure the reduction in incident volume and resolution time  

Are You Doing GRC or Just Going Through the Motions? — The GRC Maturity Model The Maturity Model GRC maturity describes how advanced your risk management practice is. Maturity Levels Level 1: Initial/Ad-Hoc Characteristics: No formal risk management Ad-hoc processes Inconsistent execution No ownership Reactive Signs you're at Level 1: Risks are managed informally No risk register No formal assessments Level 2: Repeatable Characteristics: Basic processes exist Some documentation Inconsistent execution Emerging ownership Signs you're at Level 2: Risk register exists but may be incomplete Some formal assessments Some ownership Level 3: Defined Characteristics: Standardized processes Documented workflows Clear ownership Regular assessments Basic reporting Signs you're at Level 3: Risk register is maintained Formal assessments on schedule Clear risk owners Reporting to management Level 4: Managed Characteristics: Process performance measured Proactive improvement Risk-based decision-making Integration with other processes Signs you're at Level 4: KRIs are tracked Continuous monitoring Integration with incident management Board reporting Level 5: Optimizing Characteristics: Continuous improvement AI-driven risk management Predictive analytics Enterprise-wide integration Signs you're at Level 5: AI for risk identification and assessment Predictive risk analytics Fully integrated GRC Autonomous risk management Maturity Assessment Questions Area Question Risk Identification Do you have a formal process? Risk Assessment Do you assess risks regularly? Risk Treatment Do you have treatment plans? Risk Monitoring Do you monitor risks continuously? Ownership Are risks and controls owned? Reporting Do you report to stakeholders? Integration Is GRC integrated with other functions? Building a Roadmap Level 1 → Level 2: Create risk register Define basic process Assign ownership Level 2 → Level 3: Standardize processes Establish regular assessments Define treatment plans Level 3 → Level 4: Implement KRIs Establish continuous monitoring Integrate with other functions Level 4 → Level 5: Implement AI and automation Enable predictive analytics Achieve continuous improvement Conclusion GRC maturity is a journey. Organizations that assess their maturity and build a roadmap for improvement will achieve better risk outcomes and demonstrate the value of GRC. Action Items for Your Organization Assess your current GRC maturity Identify gaps Build a roadmap to the next level Measure progress Celebrate improvements