Latest Articles

Agentic AI Is Coming for Problem Management — Here's How ITIL Roles Are Evolving   What Is Agentic AI? Agentic AI refers to intelligent systems that can act autonomously. These systems can manage tasks without human involvement, challenging the traditional ITIL model which relies heavily on human intervention . In the context of problem management, Agentic AI systems can: ? Analyze patterns in incident data ? Identify underlying problems ? Propose solutions ? Implement preventive measures autonomously The Agentic AI Ecosystem for Problem Management The AI Agent for Proactive Problem Management is not a single monolithic system; it orchestrates a network of specialized agents : ? Perception Agents: Detect anomalies and recurring patterns ? Reasoning Agents: Perform root cause analysis and generate recommendations ? Internal Control Agents: Validate accuracy and compliance ? External Augmentation Agents: Engage human experts ? Action Agents: Trigger ITSM workflows and notifications ? Learning Agents: Adapt and evolve over time  How ITIL Roles Are Evolving The rise of Agentic AI is creating new roles and transforming existing ones: Traditional ITIL Role AI-Augmented Evolution Problem Manager Becomes an orchestrator of AI agents, focusing on validation and exception management rather than manual RCA Root Cause Analyst Focuses on validating AI-generated hypotheses and investigating complex cases that require judgment Knowledge Manager Ensures AI agents have access to authoritative knowledge and validates AI-generated known errors Change Manager Reviews and approves AI-proposed changes, ensuring safety and compliance Emerging Roles: ? AI Service Integration Manager: Ensures AI agents work together effectively ? AI Ethics & Compliance Officer: Ensures AI agents operate within governance boundaries ? AI-Enhanced Process Designer: Designs workflows that optimally combine human and AI capabilities ? Human-AI Collaboration Facilitator: Ensures effective partnership between humans and AI  The Human-AI Partnership Importantly, humans are not removed from the loop—they're elevated into a collaborative role: ? Through External Augmentation Agents and conversational AI interfaces, the system engages domain experts to validate findings, contribute context, and refine workflows ? This symbiotic relationship allows the AI to capture tacit knowledge and improve its predictive accuracy ? Rather than replacing experts, the AI amplifies their impact by scaling their insights across operations  Skills for the AI-Augmented Problem Management Professional Skill Why It Matters AI literacy Understanding how AI agents work and their limitations Data analysis Interpreting AI-generated insights and recommendations Critical thinking Validating AI outputs and identifying when human judgment is needed Collaboration Working effectively with AI agents and across teams Governance Ensuring AI agents operate within appropriate boundaries Conclusion Agentic AI is not replacing problem management professionals—it's transforming their role. The future of problem management is a partnership between human expertise and AI capabilities, where humans focus on strategic oversight and exception handling while AI handles the heavy lifting of pattern detection and analysis.   Action Items for Your Organization ? Assess the current AI capabilities in your problem management toolset ? Identify opportunities for AI augmentation in your existing problem management roles ? Develop AI literacy among problem management teams ? Establish governance for AI agent autonomy ? Define the boundaries between AI-automated and human-directed problem management

Technical Skills Aren't Enough — What Makes a Great Incident Commander in 2026 The Incident Commander Paradox The Incident Commander role is paradoxical: it requires deep technical credibility but rarely involves writing code. It requires authority but operates through influence. It requires calm but operates under extreme pressure. What makes someone an effective Incident Commander? Trait 1: Technical Credibility Without Technical Execution The Incident Commander must understand the technical environment deeply enough to ask the right questions and make good decisions. What This Looks Like Can ask the right questions of the Technical Lead Can understand technical explanations without needing to be in the code Knows which questions to ask and when to push for more detail What It Doesn't Look Like Getting into the code Arguing with the Technical Lead about implementation Being a bottleneck for technical decisions Trait 2: Exceptional Communication Skills The Incident Commander must communicate clearly with diverse audiences: the response team, stakeholders, executives, and external users. What This Looks Like Can explain complex technical issues in business language Can keep stakeholders updated without overwhelming them Can communicate urgency without causing panic Can provide clear, concise status updates What It Doesn't Look Like Jargon-filled updates that no one understands Radio silence when things are uncertain Over-communicating (flooding channels) Trait 3: Decision-Making Under Pressure The Incident Commander must make decisions with imperfect information, under time pressure, and with high stakes. What This Looks Like Can make decisions with 70% of the information Can prioritize competing demands Can make quick decisions and adjust if new information emerges Can make decisions that might be unpopular but are necessary What It Doesn't Look Like Analysis paralysis (waiting for perfect information) Avoiding decisions (hoping the problem will solve itself) Second-guessing decisions (undermining confidence) Trait 4: Situational Awareness The Incident Commander must maintain awareness of the whole situation, not just individual components. What This Looks Like Understands the big picture, not just one component Knows who's working on what Knows what's been tried and what hasn't Knows what the current status is Knows what could go wrong What It Doesn't Look Like Getting lost in technical details Losing track of what others are doing Not knowing what's been attempted Trait 5: Delegation and Empowerment The Incident Commander must delegate tasks effectively and empower the team to execute. What This Looks Like Can identify what needs to be done and who should do it Can trust others to execute without micromanagement Can step back and let the team work Can provide clear direction without being directive What It Doesn't Look Like Micromanaging the technical team Doing everything themselves Not trusting others to execute Building Incident Command Capabilities 1. Identify Potential Incident Commanders Look for people who demonstrate: Technical credibility Strong communication Good judgment Calm under pressure 2. Train Potential Incident Commanders Training should include: Incident command theory Role-playing scenarios Tabletop exercises Shadowing experienced Incident Commanders 3. Practice Incident Command Practice in low-stakes scenarios: Planned maintenance where things don't go to plan Tabletop exercises with non-production incidents Shadowing during real incidents 4. Conduct After-Action Reviews After every significant incident: Review Incident Commander performance Identify areas for improvement Provide constructive feedback The Incident Commander Skills Matrix Skill Novice Proficient Expert Technical understanding Knows the system Understands dependencies Can predict impact Communication Clear updates Tailored to audience Drives stakeholder confidence Decision-making Makes decisions Makes decisions quickly Makes correct decisions consistently Situational awareness Knows team status Knows incident status Predicts next issues Delegation Assigns tasks Empowers others Builds team capability Conclusion: Technical Skills Are the Baseline, Not the Differentiator Technical skills are necessary for Incident Command, but they're not sufficient. The differentiators are communication, decision-making, situational awareness, and delegation. The best Incident Commanders aren't the best engineers. They're the engineers who can lead. Action Items for Your Organization Identify potential Incident Commanders: Look for technical credibility plus leadership skills Train them: Provide formal training, shadowing, and practice opportunities Assess skills: Use a skills matrix to identify development needs Build a bench: Have multiple qualified Incident Commanders Learn from incidents: Review Incident Commander performance in postmortems  

Your AI Agent Has the Keys to the Kingdom — What Happens When It Uses Them Wrong? The Expanding Blast Radius When humans make mistakes, the impact is often limited. A human can only do so much damage before they're stopped—by time constraints, by oversight, by simple human limitations. When AI agents make mistakes, the situation is fundamentally different. AI agents: Operate at machine speed Never sleep Can execute thousands of operations before anyone notices Can impact vast swathes of systems and data The "blast radius" of an AI mistake can be orders of magnitude larger than a human mistake. The Identity Problem Only 22% of organizations have proper identities tied to their AI agents . This isn't a governance gap—it's a governance chasm. Consider: If you don't know which AI agent is acting, how do you audit its actions? If you don't know what permissions an AI agent has, how do you ensure least privilege? If you don't know when an AI agent was created, how do you know when to revoke access? If you can't identify an AI agent, how do you investigate its actions? AI agents require their own identity lifecycle management—separate from human users. The Blast Radius Dimensions Operational Blast Radius AI Action Potential Impact Configuration change System outage across multiple environments Access grant Security breach from unauthorized access Resource scaling Cost overruns from uncontrolled scaling Ticket routing Incidents going to wrong teams, delayed resolution Knowledge management Critical knowledge lost or corrupted Financial Blast Radius AI Action Potential Impact Resource scaling Uncontrolled cloud costs Configuration change Business interruption costs Security incident Breach costs, regulatory fines Incident misrouting SLA breach penalties Reputational Blast Radius AI Action Potential Impact Service outage Customer trust damage Security incident Brand reputation damage Data exposure Privacy violation, trust damage Controlling the Blast Radius 1. Least Privilege for AI AI agents should only have the minimum permissions needed for their tasks. Approach: Define specific roles for AI agents Grant only necessary permissions Regularly review and revoke excess permissions 2. Access Controls for AI AI agents should be subject to the same access controls as humans. Approach: Unique identities for each AI agent Access reviews for AI agents Immediate revocation when AI agents are retired 3. AI Monitoring Monitor what AI agents are doing. Approach: Real-time monitoring of AI actions Anomaly detection for AI behavior Audit logging for all AI actions 4. Kill Switches Build the ability to immediately halt AI operations. Approach: Easy-to-use kill switches Multiple kill switch mechanisms Regular testing of kill switches 5. Human Checkpoints Require human approval for high-stakes AI actions. Approach: Identify high-stakes actions (e.g., production changes) Require human approval Escalate to humans when uncertain The Governance Framework Control Description Purpose Identity Unique identities for AI agents Accountability, auditing Permissions Least privilege for AI Limit blast radius Monitoring Real-time AI behavior monitoring Detect issues early Checkpoints Human approval for high-stakes actions Prevent catastrophic failures Kill switches Ability to halt AI operations Stop incidents immediately Auditing Logging of AI actions Investigate and learn Conclusion: Blast Radius Management Is Essential As AI agents become more autonomous and more powerful, blast radius management becomes essential. Organizations must implement controls to limit what AI agents can do, monitor what they're doing, and stop them when something goes wrong. Your AI agent has the keys to the kingdom. You need to know what it's doing with them. Action Items for Your Organization Audit AI identities: Know what AI agents exist and what they can do Implement least privilege: Grant only necessary permissions Monitor AI behavior: Track what AI agents are doing in real-time Build kill switches: Enable immediate halting of AI operations Establish human checkpoints: Require approval for high-stakes actions Conduct blast radius assessments: Understand the potential impact of AI failures  

Vendor Financial Instability — A Hidden Risk That Can Disrupt Your Operations The Financial Risk Reality Financial risks emerge when vendors cannot perform as stated in a contract, when they face insolvency issues or if they suddenly go out of business . A third-party vendor's financial instability often precedes increased costs, lost revenue, service disruptions and even sudden termination of critical services . Why Financial Risk Matters Service disruptions: If a vendor goes out of business, services may be abruptly terminated. Increased costs: Financial instability may lead to price increases or reduced service quality. Supply chain disruption: Vendor failure can cascade through the supply chain. Hidden liability: Financial problems may lead to legal disputes or contractual failures. Assessing Financial Risk Key areas to evaluate : Financial health of the vendor Payment history and credit ratings Revenue trends and profitability Debt levels and liquidity Management stability Due diligence questions: What is the vendor's financial history?  Has the vendor had financial issues in the past? What is the vendor's business model? What are the vendor's growth prospects? The Impact of Financial Instability Before entering into a business agreement, organizations need to be fully aware of a vendor's history – financial and otherwise . Signs of financial instability: Layoffs or restructuring Delayed payments to suppliers Management turnover Loss of key customers Negative news coverage Managing Financial Risk Pre-Onboarding : Conduct financial due diligence Review financial statements Assess business viability Evaluate management stability Contractual Protection : Define service continuity obligations Include financial performance clauses Define termination triggers Ongoing Monitoring : Monitor financial health continuously Use automated financial data feeds  Track negative news  Conclusion A third-party vendor's financial instability often precedes increased costs, lost revenue, service disruptions and even sudden termination of critical services . Organizations that assess and monitor vendor financial risk will avoid service disruptions and hidden liabilities. Action Items for Your Organization Conduct financial due diligence on vendors Review financial statements and payment history Monitor financial health continuously Include financial performance clauses in contracts Define termination triggers for financial failure  

Cyber GRC Is Moving from Reacting Faster to Predicting Earlier, Governing Smarter, and Connecting Risk Across the Enterprise The New GRC Reality GRC is rapidly becoming AI-first. Organizations are embedding AI across risk identification, assessment, and response to move beyond manual processes and backward-looking analysis . Predictive intelligence, automated controls testing, and real-time risk insights now allow security and risk teams to anticipate threats before they materialize . This marks a fundamental transition: from reacting to cyber incidents to building proactive cyber resilience at scale. AI for GRC vs. GRC for AI The transformation is unfolding across two critical dimensions : Dimension Description AI for GRC How AI redefines how organizations monitor, assess, and respond to risk GRC for AI Governing AI systems themselves as they scale across the enterprise How AI Is Transforming GRC Operations Continuous Control Monitoring AI systems validate control effectiveness by analyzing system logs, configurations, and audit artifacts on an ongoing basis. This shifts assurance from periodic testing to continuous validation . Risk Identification and Prediction By integrating internal telemetry with external threat intelligence, AI-driven models can identify emerging threats before they materialize. This represents a shift from static risk registers to adaptive, real-time risk management . Regulatory Mapping and Compliance Reporting AI systems interpret regulatory texts and map them to internal controls, generating audit-ready narratives and automating compliance documentation . Third-Party Risk Management (TPRM) Agentic AI replaces periodic, questionnaire-driven assessments with continuous monitoring models. AI agents can autonomously retrieve vendor data, validate responses, and correlate external risk signals . The Human Element Human expertise remains central to this model. Risk leaders provide oversight, validate AI-driven recommendations, and apply judgment to ensure decisions align with business priorities and regulatory expectations . What This Means for Your Organization In 2026, Cyber GRC will move from reacting faster to predicting earlier, governing smarter, and connecting risk across the enterprise . Organizations that embrace AI-first GRC will be better positioned to anticipate threats, respond faster, and build lasting cyber resilience. Action Items for Your Organization Assess your current GRC maturity—are you still using manual processes? Identify where AI can automate risk identification, assessment, and response Evaluate AI-enabled GRC platforms Start with a pilot for continuous control monitoring Measure the reduction in manual effort and risk response time  

From PTO to Parental Leave — How AI-Powered HR Service Requests Are Transforming Employee Support The HR Service Challenge HR teams face high volumes of service requests with unique challenges: sensitive data, complex regulations, and multi-step processes. Traditional HR help desk software often cannot scale or support complex requests, leaving teams in reactive mode rather than strategically solving problems . How AI Is Transforming HR Service Delivery IBM's AskHR: A Case Study IBM's AskHR virtual agent demonstrates the power of AI in HR service delivery: Handles over 2.1 million employee conversations annually Achieves a 94% containment rate of common questions Led to a 75% reduction in support tickets since 2016 Contributed to a 40% reduction in HR operational costs over four years Created more than 11.5 million employee interactions in 2024 alone  AskHR currently operates on a two-tier support model: AI handles routine inquiries while human advisors manage more complex needs, driving both efficiency and personalized service . Common HR Service Request Types Request Type AI Capability Human Touch Required? Payroll inquiries Instant answers from integrated systems Complex cases Leave requests Automated submission and approval Exception handling Benefits questions Personalized answers based on employee data Appeals and disputes Onboarding Guided experience across departments New hire exceptions Policy questions Immediate access to current policies Interpretation The ESM Approach to HR SAP SuccessFactors Enterprise Service Management provides : Agentic AI (Joule): Employees get instant answers and guidance Preconfigured HR scenarios: Templates for leave, grievance, time correction Smart case management: AI-guided workflows, classification, and next-step recommendations Native integration: Real-time access to reliable employee information Cross-functional orchestration: Seamless coordination with IT, finance, and other departments Why HR Service Management Matters The Employee Experience Impact When HR services are slow, confusing, or fragmented, it directly impacts employee satisfaction and productivity. As one industry observer noted: "Service management success can be directly linked to how people feel about their interactions with a business (both internally and externally)" . The Efficiency Gain AI-powered HR service management frees HR professionals from routine inquiries, allowing them to focus on strategic work. IBM documented significant productivity gains in domain-specific tasks between 2022 and 2024, with some areas improving by as much as 75% through AI-powered automation . The Future of HR Service Management Key Trends: Conversational AI: Employees interact with AI in natural language Proactive service: AI anticipates needs before employees ask Unified experience: One interface for all HR, IT, and facilities requests Agentic automation: AI takes multi-step actions to resolve requests end to end Cross-functional orchestration: Seamless coordination across departments Conclusion HR service management is a frontier for AI-powered enterprise service management. Organizations that apply ITSM principles to HR — with service catalogs, workflows, SLAs, and AI automation — will deliver faster, more consistent HR service while freeing HR professionals for strategic work. Action Items for Your Organization Assess current HR service delivery — what's fragmented or manual? Identify the most common HR requests Evaluate AI-powered HR service management solutions Build service catalogs for HR requests Integrate HR systems with service management platform Measure containment rate and employee satisfaction