For two decades, security and data resilience have been neighbors who share a fence but rarely a budget. Security kept bad actors out, while resilience brought the business back when they got in. Agentic artificial intelligence is tearing down that fence, yet most organizations haven’t noticed.

Last year, I wrote that Veeam Software Group GmbH’s acquisition of Securiti AI positioned it as the industry’s first AI resiliency company. At VeeamON 2026 in May, the company foreshadowed what that would look like.

At its recent VeeamON Global Launch virtual event, Veeam announced a product: Veeam Intelligent ResOps, or iResOps, with Microsoft 365 as the first generally available workload. Whether you call it AI resiliency or resilience operations, the idea is the same. When software agents act on data at machine speed, you can’t secure what you can’t recover, and you can’t recover what you don’t understand.

Assume failure, assume breach, assume drift

Chief Executive Anand Eswaran (pictured) opened with an example that should make every chief information security officer squirm a little. A company in Spain recently told its regulator that an AI agent, acting largely on its own, breached it by finding a flaw in a live application and modifying personal data and billing records. Eswaran framed the 72-hour disclosure requirement as an engineering problem. “Somebody has to answer three questions: Which records did it change? What did it change them to? And what were they before?”

That’s at the heart of the need to converge these historically separate markets. Ransomware encrypts, and exfiltration steals, but both are detectable events with established playbooks. Modification is different. “You can disclose a theft. You cannot disclose your way out of a modification,” Eswaran said. “You have to reverse it, and you can only reverse what you can identify precisely.”

Eswaran described three eras: backup and recovery, where the rule was to assume failure; cyber resilience, where the rule was to assume breach; and the agentic era, where the rule is to assume drift. All three now apply at once. He also made a distinction I think is underappreciated. Agents are often temporary, but “the data is not temporary, and the data drifts too. It goes stale. It gets reclassified. It gets poisoned.” A perfectly entitled agent can still do real damage by reasoning over the wrong data.

Start at the data, not the agent

Most of the industry’s approach to agent risk starts with the agent: registries, runtime guardrails, and scoped credentials. Those matter, but Eswaran pointed out their limits. “You can govern the agents you choose. You cannot register the ones that you do not know about.”

Veeam argues that the only vantage point that doesn’t require knowing the actor in advance is the data, because every agent eventually touches it. According to Veeam’s Data Trust & Resilience Report 2026, 88% of organizations are using or piloting AI agents, yet only 7% qualify as truly AI-ready, and more than 82% have unknown agents in their environments.

Identity follows the same logic. Eswaran noted that even perfect identity hygiene only restores who can act. It doesn’t restore what has already changed. One function closes the door, and the other must clean up the room, so they can’t remain separate.

A recovery point versus a recovery map

One of the most important points in Eswaran’s keynote was clarifying the difference between a recovery point and a recovery map. “A recovery point tells you what you can restore,” he said. “A recovery map tells you what to restore first, what changed, and what not to bring back.” This distinction is important because recovery is often an “all or nothing” process, which increases cost and time, both of which are precious commodities in the AI era.

The map he referred to is the DataAI Command Graph, brought over from Securiti, which connects data, users, permissions, agents, activity and protection status across live and backup environments. iResOps for Microsoft 365 is an add-on to Veeam Data Cloud for Microsoft 365 that requires no data migration. It discovers Copilot and other agents, shows what sensitive data each can access, flags redundant, obsolete and trivial data, or ROT, and lets teams undo an agent’s changes, file by file.

Rehan Jalil, president of products and technology and former CEO of Securiti, positioned it as an end to the pain caused by fragmented tooling. “Customers don’t want silos of tools with conflicting sources of truth. They want visibility, controls, and resilience in one place,” he said. “You know what is sensitive, what is critical, and what an agent touched. You protect exactly what needs protection, and you restore exactly what broke.” In data sciences, there’s an expression that “good data leads to good insights,” but it’s also true that silos of data lead to fragmented insights, which causes inconsistent insights.

IResOps for Veeam Data Platform and Okta are in private preview, with GitHub, Azure DevOps and Google IAM previews planned for the fourth quarter. Okta is a smart early target because, as Veeam notes, it lacks native point-in-time restore. Developer tools are too. As Jalil put it, “One force push can rewrite main’s history.”

What customers are finding

Veeam said preview customers found that a quarter of a 40-terabyte estate didn’t need to be in production and that there were 25 agents on a single tenant, two of which were actively modifying data.

Robert Davis, director of information technology infrastructure and operations at Construction Resources, a Home Depot company, said organizations need to know where data came from and where it’s going “before people have a case of Copilot gone wild.” He added that ROT is “not just a housekeeping problem; it’s about compliance and legal protection, and it cuts down on Copilot’s hallucinations.”

Steve McIntyre, senior vice president of data protection, analytics and cloud security at Fidelity Investments, put it plainly: “If you have an event, you have to assume that you have to recover the data as well,” and identities must be revalidated so “we’re not just reopening ourselves” to the same attack.

Advice for IT and security pros

• Merge the playbooks. In most companies, security operations and backup teams have their own tools, leaders and tabletop exercises. That worked when incidents moved at human speed and handoffs could happen over a conference bridge. An agent-driven incident doesn’t wait for a handoff. Build a single joint incident playbook that clearly defines who owns detection, who owns scoping the damage, and who owns recovery, and run the exercises together. If the two teams have never worked through a scenario side by side, the first time shouldn’t be during a real event.
• Inventory agents from the data side. Agent registries are useful, but they capture only what you’ve sanctioned. Shadow agents, third-party app registrations and agents built by business users won’t appear there. The more reliable approach is to start with your most sensitive data and work backward to every human and nonhuman identity that can access it. Expect to find agents you didn’t know existed. Veeam’s private preview customers did. Then make this a continuous process rather than a quarterly audit, because the number of agents changes far faster than review cycles.
• Treat ROT as a security issue. Redundant, obsolete and trivial data has long been a storage-cost conversation, so it rarely gets prioritized. In the agentic era, it’s a risk conversation. Exfiltration-focused attackers target stale sensitive data, and outdated documents are a leading cause of bad AI output. Framing cleanup around risk and AI accuracy brings legal, compliance and finance to the table, which is what Davis saw at Construction Resources. His advice on getting started is practical: “Do a few queries with no action plan in mind.”
• Include identity in the recovery plan. Identity systems such as Entra ID, Active Directory and Okta are now the front door for both people and agents, and attackers know it. Many recovery plans still treat identity as a given, which is a mistake. If you restore clean data to an identity environment with a tampered conditional access policy, a disabled MFA setting, or an overprivileged service account, you’ve set up the next attack. Back up identity configurations, compare them against a known-good state, and include them in recovery testing with the same rigor as your applications.
• Test for precision, not just speed. Most recovery tests center on a full encryption event and measure how quickly systems come back online. That’s still important, but it doesn’t reflect what agent-driven incidents look like. Add a scenario in which an authorized agent quietly modified the wrong records over several days. Then see whether your team can answer the regulator’s three questions: which records changed, what they changed to, and what they were before. If the only answer is to roll back everything, you’re trading one business disruption for another.

Final thoughts

The launch of iResOps is what Veeam has been working toward since it closed on Securiti. However, other vendors are musing about this. For example, Microsoft is building agent governance into Microsoft 365. Veeam’s credible angle is that it starts with recovery, with more than 550,000 customers, and adds data security posture management rather than the other way around. As Eswaran said, it has spent 20 years as “the company you call when everything else is broken.”

The risk is the one McIntyre raised. Customers are wary of an “Uber platform” that aims to replace everything, and they’ll favor vendors that ingest context from tools they already own. IResOps will succeed as much on how well it integrates as on how much it consolidates.

The bigger lesson goes beyond Veeam. The resilience question is no longer “Can I recover?” It’s “Can I prove exactly what happened and undo only that?” That’s AI resiliency, and companies that keep security and resilience in separate silos won’t be able to answer it.

For three years, artificial intelligence infrastructure has been dominated by one idea: Bigger is better. Bigger models, bigger clusters, and bigger checks written to a small group of suppliers. At this week’s Open Compute Project Global Summit, Intel Corp. argued that the next phase of AI will look very different and that Intel is well-positioned to benefit.

During his keynote, Nicolas Dubé (pictured), corporate vice president at Intel, framed his OCP keynote around a simple phrase: “Put every prompt in its place.” He shared new details about the Intel GPU D-series, formerly code-named Crescent Island, as well as Xeon rack designs built largely on OCP’s Open Rack v3 spec and open software work.

Underneath is a strategic argument worth attention: Intel believes inference, not training, will define enterprise AI economics and that agentic AI will bring the CPU back to the center of the data center. If that’s right, Intel’s turnaround gets a second engine at exactly the right time.

Not every prompt needs a frontier model

Today, most organizations default to sending every request to a frontier model, whether or not the task warrants it. That’s like hiring a senior law partner to proofread a memo. Intel’s alternative is an orchestration layer that evaluates each request based on the required depth of intelligence, context length, latency, data sensitivity and sovereignty, and cost and energy.

Deep research may justify using a frontier model. Proprietary documents may need to remain within the enterprise. Routine coding, summarization or operational tasks can run on a smaller open model at a small fraction of the cost.

“Open models are expanding the options enterprises have for deploying AI,” said Dubé. “To realize their full potential, organizations need infrastructure that can match different workloads with the right intelligence, compute resources and economics.”

The momentum behind open models has never been stronger. In recent months, I’ve spoken with dozens of companies aggressively shifting to them. Intel cited Vercel AI Gateway data showing that open-weight models’ share of observed token traffic rose from roughly 31% in early July to about 78% by late September. One gateway isn’t the market, but it aligns with what I hear from IT leaders who are uneasy about runaway token bills and about sending sensitive data to someone else’s model.

Crescent Island targets the enterprise middle

The D-series, first disclosed at last year’s OCP Summit, is the hardware embodiment of that thesis. It’s built on the Xe3P architecture and delivers 1.3 petaflops of FP8 compute and 1.5 terabytes per second of memory bandwidth in a 350-watt, air-cooled PCIe form factor. The design supports up to 480 gigabytes of LPDDR5X memory. Intel’s own branded card carries 160 gigabytes, and partners can build higher-capacity cards.

The most interesting decision is the memory choice. Rather than chase Nvidia Corp. and Advanced Micro Devices Inc. with expensive, supply-constrained high-bandwidth memory, Intel chose LPDDR, trading peak bandwidth for capacity and cost. That’s the right trade for inference, where the bottleneck is often fitting the model and its context into memory. Intel says it supports models up to 300 billion parameters on a single card and more than 1 trillion in an eight-GPU system.

Just as important is what it doesn’t require. Most enterprise data centers weren’t built for liquid-cooled racks drawing 100-plus kilowatts. A 350-watt card that fits in a standard air-cooled server lets a company start with a single card, move to an eight-way server, and scale to rack-level systems only when the workload demands it. Inference is becoming the defining AI workload, and enterprises need infrastructure that makes the transition easier and more cost-effective.

Agentic AI is a CPU story

The most underappreciated part of the announcement is the Xeon rack work. Agentic AI turns inference into a multi-step workflow spanning retrieval, reasoning, tool calls, database queries and application execution. Every agent generates tokens and a significant amount of general-purpose work that runs on CPUs.

Intel showcased partner-built Xeon rack designs, many based on ORv3, with select Xeon 6+ configurations scaling beyond 46,000 cores per rack at 133.45 kilowatts. Xeon 6+ with dense, efficient cores targets high-concurrency agent workloads, while Xeon 6 with performance cores handles tasks that depend on single-thread speed. Intel argues that the right metric is no longer core count but how many concurrent agents a rack can sustain at target latency, a useful lens for buyers.

The result is a heterogeneous system: Xeon for orchestration, data processing and tool execution; the D-series for open-model inference; and SambaNova as an optional fast-token engine where speed is the priority. During his presentation, Dubé explained that Intel is tying the system together with a software architecture it’s building with the community, which’s open, downloadable today, and designed to run across the broad silicon.

Fuel for the Lip-Bu Tan rebound

All of this underscores Intel’s turnaround under Chief Executive Lip-Bu Tan, which is moving from hopeful to measurable. In the second quarter, Intel posted $16.1 billion in revenue, up 25% year-over-year, with Data Center and AI revenue up 59%, to $6.3 billion. It marked the seventh consecutive quarter of beating its own guidance. The stock has more than tripled over the past year.

It’s important to understand what’s driving growth. It isn’t Intel winning the graphics processing unit war. It’s the recognition that AI needs many central processing units. At Splunk’s .conf26 in September, Tan said Intel could meet only about half of customer CPU demand, even after Intel had already raised 2026 capital spending to more than $20 billion.

The OCP announcements extend that momentum in two ways. The agentic rack work reinforces the Xeon demand already driving the numbers, positioning Intel as an essential agent infrastructure provider rather than a legacy supplier. And Crescent Island gives Intel an accelerator play where it doesn’t have to beat Nvidia on peak performance. This could be the most practical, power-efficient way to run open models in an existing data center.

That’s the discipline Tan has brought: Stop trying to win every fight and focus on the fights where Intel has a structural advantage. Intel doesn’t need to own frontier training. It needs to own the enterprise middle, a much larger opportunity than most give it credit for.

What IT leaders should do now

The shift from scale to fit doesn’t happen to an organization. It must be planned. Here’s where I’d focus:

• Audit your prompt mix. Most organizations have limited visibility into what their AI spend is buying. Pull a few weeks of usage logs and sort requests by task type: deep reasoning, retrieval-heavy questions, coding help, summarization and classification. In my conversations with IT leaders, I often find that a large share of traffic is routine work a smaller open model could handle at a fraction of the cost. Do this before your next model contract renewal, not after.

• Treat orchestration as a strategic layer, not a feature. Routing based on cost, latency, context length and data sensitivity is where the savings and control come from. Whether you build it or buy it, the orchestration layer should be model-agnostic so that switching providers or bringing a workload in-house is a policy change rather than a re-architecture. It’s also the natural place to enforce governance, such as ensuring that regulated data never leaves your environment.

• Change how you evaluate infrastructure. Peak FLOPS and core counts are vendor metrics, not business metrics. Ask suppliers to demonstrate concurrent agents sustained at a target latency, cost per million tokens and tokens per watt on a model you plan to run. Then run the tests yourself with your own prompts and context lengths. A system that wins a benchmark at short context can look very different at the long contexts that agentic workflows generate.

• Plan for the data center you have. Liquid cooling has its place, but retrofitting facilities is expensive, slow and often constrained by available power. Before committing capital, run a proof of concept using air-cooled PCIe inference in existing racks. Start small, with one card or one server, and scale only when utilization justifies it. For many enterprise workloads, that path will be sufficient, and it is far faster to deploy.

• Don’t overlook the CPU budget. Agentic AI shifts a meaningful share of work to general-purpose compute: tool calls, data retrieval, database queries and code execution. Organizations that size only for accelerators will find their agents bottlenecked elsewhere. Model CPU demand alongside GPU demand, and account for tight supply. Intel itself says it can’t meet all current demand, so lock in capacity early.

• Insist on open standards and open software and hardware. ORv3, PCIe, and the Open Adapter Card, combined with open frameworks and orchestration layers, protect your ability to mix vendors and adapt as the market shifts. Note that OAC, while close, is not a final spec. Until then, PCIe, a proven standard, is a fine option. It’s not PCIe versus OAC but about delivering openness everywhere. Ask every supplier how quickly new open models run on its hardware and whether its optimizations live in mainstream frameworks or in a proprietary stack. Lock-in at the software layer is harder to unwind than at the hardware layer.

Final thoughts

Intel has spent much of the past few years being written off in AI, and for a while that criticism was deserved. The company chased Nvidia on Nvidia’s terms and lost. What’s different now is that Intel is playing a different game, one built around where enterprise AI is heading rather than where it has been.

The bet is that inference will be heterogeneous, that open models will continue to close the gap with proprietary ones, and that agents will make the CPU as important to AI as the GPU. None of those ideas is particularly controversial anymore, and the data increasingly supports all three. What’s still open to debate is whether Intel can execute. Crescent Island needs to ship on time and perform as promised; the software stack needs to keep pace with an open-model ecosystem that evolves weekly; and the company has to fix its supply constraints to capitalize on the Xeon demand it already has.

That’s where the Lip-Bu Tan era differs from what came before. Under Tan, Intel has been more disciplined about where it competes, more candid about what it can deliver, and more focused on customers than on roadmaps. Seven straight quarters of beating guidance don’t happen by accident. If Intel brings that same discipline to the D-series and its agentic Xeon platforms, OCP 2026 may be remembered as the moment Intel stopped trying to catch up in AI and started defining its own lane.

The first phase of AI rewarded scale. The next will reward fit. Intel’s message at OCP is that it understands the difference, and its recent results suggest the market is beginning to believe it.

For most of its history, Cisco Systems Inc. won by building vertically integrated network products and asking customers to buy all of it. The company did very well with that model. Security, meanwhile, was something Cisco sold as a separate product line rather than something that was inherent to its infrastructure. Patching a core switch meant scheduling a maintenance window, crossing your fingers and hoping nothing broke.

Under Chief Product Officer Jeetu Patel, Cisco has moved away from that model and embraced openness. That’s why I found Cisco’s announcements at this week’s Open Compute Project Global Summit in San Jose more interesting for what they reveal about the company than for the products themselves.

As Mike Wheatley outlined in his SiliconANGLE post, Cisco rolled out a new pluggable optics form factor with Nvidia Corp., shipped its first Silicon One G300 systems, introduced the G302 top-of-rack chip and a new out-of-band management platform, and brought its Live Protect runtime security capability to SONiC. His post detailed the announcements, but it’s worth a deeper look at why these matter for artificial intelligence and what they say about a Cisco trying to be both open and secure, neither of which were strengths before Patel.

The network is now in the critical path of AI

During the event’s pre-briefing, Cisco Senior Vice President of Engineering Will Eatherton discussed the problem the company is trying to solve. A few years ago, a large training run used hundreds of graphics processing units. Today, the largest clusters use hundreds of thousands of GPUs. Cisco cited Epoch AI data showing that projects that once fit in one or two buildings now span campuses, metros and regions, largely because that’s where power and real estate are available.

This changes the role of the network. In a traditional data center interconnect, the wide-area network carries many small, independent flows, and a network hiccup affects a single application or user. In large-scale deployments, the network needs to “scale-across” and carry a small number of massive, synchronized flows between accelerators working on the same job.

As Rakesh Chopra, Cisco Fellow and senior vice president of silicon and systems architecture, explained on the call, scale-across puts the long-haul network “directly in line with the workload performance.” If a link slows down, GPUs sit idle, and idle GPUs are the most expensive waste in information technology today.

That’s the context for Cisco’s OCP news. The Ultra-Dense Small Form Factor Pluggable, or USFP (pictured), is the first pluggable module designed for 400-gigabit-per-lane signaling, delivering up to 12.8 Tbps and about four times the bandwidth density of today’s leading modules. The key word is pluggable.

Cisco’s optics team made a fair point on the call: the competing XPO approach requires liquid cooling, which no optic in the industry needs today, and it creates real headaches when handling, replacing and validating modules. Keeping the operational model familiar while doubling the lane rate is the kind of pragmatic engineering that speeds adoption.

Equally important, USFP is being standardized as a multisource agreement with TE Connectivity and Amphenol. Optics is one of the highest cost and supply-chain constraints in AI buildouts, and a multivendor spec should drive higher volumes, greater competition,and lower prices.

Open at every layer is a big shift for Cisco

Cisco used the phrase “open at every layer of the stack” throughout the briefing, and Eatherton was clear that this “is not just a SONiC story.” That spans P4 programmability at the chip level, Nvidia Reference Architecture compliance in systems, OpenZR+ in optics, a choice of SONiC, FBOSS, a custom NOS, NX-OS, or IOS XR, third-party controllers, and the CNCF-governed Cilium ecosystem at the Kubernetes layer.

Eatherton called SONiC a first-class network operating system at Cisco and admitted that is “unusual for Cisco in the context of our 20- or 30-year history.” SONiC was once viewed within Cisco circles as a threat, a way for hyperscalers to commoditize switching. Now Cisco offers community builds, custom builds using its software development kit, and a turnkey Cisco-validated version under the Nexus One controller. Though this may seem inconsistent with Cisco’s past strategy, it aligns with Patel’s commitment to make Cisco unrecognizable from what it was two years ago.

The openness also extends to Cisco. Intelligent Collective Networking, the G300 capability that detects remote congestion and link failures and signals back to the ingress leaf in hardware time, is being standardized by the Internet Engineering Task Force rather than kept proprietary. Five years ago, I’m not sure Cisco would have given away something it considers a competitive advantage.

Why the change? Because the customers driving AI infrastructure spending will not accept lock-in. Hyperscalers have built their own operating systems and controllers, and the more mature neoclouds are now closely examining SONiC. Cisco is betting it can win on silicon, optics, systems engineering and support while letting customers choose what runs on top. Microsoft running Silicon One P200 systems in production and Alibaba deploying its in-house router on the P200 at massive scale suggest that bet is paying off.

Being open doesn’t hurt Cisco; it expands its addressable market. A Cisco that requires its full stack can sell only to customers that want it. A Cisco that is open at every layer can sell silicon to one customer, optics to another, and validated SONiC to a third.

Security that keeps the network running

The announcement I believe is most underappreciated is Live Protect for Cisco SONiC. Cisco cited data showing that the mean time to exploit a vulnerability has dropped from about nine months to roughly 10 hours. Eatherton noted that attackers now feed newly published CVEs into large language models and attempt exploits within hours.

That creates an impossible situation for AI network operators. Patching a switch typically requires a reboot, and rebooting a switch in a fabric running a multiweek training job across thousands of GPUs is not something anyone wants to do on short notice. So operators either risk an outage or a breach.

Live Protect addresses this by applying a “shield,” a compensating control, to the live system at the kernel level without downtime or rebooting. The switch is protected immediately, and the patch can be applied during a planned window. Cisco has had this capability in NX-OS for about a year and is bringing it to Cisco-validated SONiC on Nexus One, with availability targeted for the second quarter of 2027.

There are two important aspects to this. First, it reflects Cisco’s move to build security into the infrastructure rather than bolt it on, a shift the company has long discussed but often struggled to deliver, and now appears to be delivering. Second, it brings Cisco’s security engineering to an open operating system.

One criticism of SONiC has been its lack of enterprise-grade security and support, and closing that gap makes SONiC viable beyond the largest hyperscalers. With line-rate, quantum-resilient encryption built into the P200, Cisco now has a security story for AI infrastructure it simply didn’t have a few years ago.

Final thoughts

AI infrastructure is being built under conditions that punish both lock-in and downtime. Cisco’s OCP announcements address both issues and show that the company understands the AI market won’t be won the way the enterprise campus was.

For infrastructure leaders building AI capacity, my advice is to evaluate the network on job completion time and GPU utilization, not port speeds alone; to require open interfaces at the operating system and controller layers so you keep your options; and to ask every vendor how it will protect production fabrics during the hours between a CVE disclosure and a maintenance window.

For the better part of my 30-year career as an analyst, unified communications has been designed around the person at a desk, bouncing between meetings, chat and email. That made sense when the pandemic pushed everyone onto video.

It makes far less sense when roughly 80% of the global workforce doesn’t sit at a desk at all. In fact, I’ve argued that front-line, non-deskbound workers have been forgotten by most of the UC industry, which is why so many nurses, warehouse workers and others rely on consumer devices and tools.

That’s the gap Mitel Networks Corp. is targeting with Mitel Workforce Experience, which the company recently launched. Mitel WX brings voice, messaging, meetings, contact center and vertical applications into a single client that adapts to the worker’s role rather than the device. Following a pre-briefing I attended with Eric Hanson, Mitel’s executive vice president and chief marketing officer, and Martin Bitzinger, executive vice president of product management, it’s apparent that “toggle tax” across disjointed applications has plagued users for years, so Mitel’s direction addresses a real problem.

Legacy UC is built for everyone, but optimized for no one

Hanson opened with a line that captures the problem with most UC platforms today.

“Many in the industry have attempted to build something that addresses the needs of everyone, but is optimized for no one,” he said. He’s right. The major platforms were built for knowledge workers and then pushed out to everyone else, which is how a nurse or plant technician ends up with a client designed around calendar invites. Those workers live in Epic or a dispatch console, and when something goes wrong, they pick up the phone.

Hanson also made a point I’ve been making for years: Communications was treated as a mature, almost commoditized part of the stack and “wasn’t really deemed to be strategic until it didn’t work.”

Mitel supported its thesis with a Vanson Bourne study it commissioned, which surveyed about 2,000 workers in Canada, France, Germany and the U.K. The study found that 57% of workers waste time switching among an average of seven tools, 79% reach for voice when rapid action is needed, and frontline workers are twice as likely to use unapproved tools.

It’s vendor-funded, so treat it as directional, but it aligns with what I hear from information technology leaders: When the sanctioned tool doesn’t fit the job, workers default to WhatsApp and IT loses control.

Starting over rather than bolting on

One of the more interesting decisions Mitel made was architectural. Mitel WX isn’t a MiCollab refresh or a rebrand of the clients Mitel inherited from Unify. “We basically started with a blank sheet of paper,” Bitzinger said. Only foundational functions, such as voice, are baked into the core client. Everything else is a plugin that administrators enable by role. While this is a longer path to a commercially available product, it will likely lead to greater success down the road because the code is cleaner and purpose-built.

In the demo, a hospital desk worker who also handles contact center queues sees chat and call queues, along with an electronic health record panel, on a single screen. An environmental services worker in the same hospital sees a streamlined view with work group log-in and task completion. A doctor driving in takes calls on a work number via Apple CarPlay or Android Auto. Calls migrate between mobile and desktop rather than being transferred, a small detail that matters when the caller is a patient.

Bitzinger stressed that IT, not the user, owns role design. “It can’t be left up to the user to do all of those things,” he said. That’s the right call. Frontline workers won’t customize their tools, and configurability without governance creates clutter. Administrators manage templated roles in Mitel Central, including across multiple domains common in health systems built through acquisition.

Control is the real product

For Mitel, WX’s competitive differentiation is deployment flexibility. Though every vendor supports public cloud today, Mitel also lets customers use hybrid, private cloud, on-premises, and edge deployments, with the same client built on a common application programming interface for both its CloudLink cloud back end and on-premises Mitel Central. Asked whether a customer could run Mitel WX fully air-gapped, Bitzinger answered: “They can run it completely air-gapped, completely on-prem in their basement if that’s what they prefer.”

The underrated feature is private push notifications. Most mobile UC apps rely on Apple and Google push services to ring a phone. WX can deliver push notifications over the customer’s own network, so calls and alerts still arrive in a hospital running private 5G or on a site that loses its internet connection. For regulated and mission-critical environments, that’s a meaningful differentiator.

Hanson noted that only about 25% of the industry’s 450 million to 500 million seats have moved to the multitenant public cloud and argued that hybrid is increasingly “a deliberate strategy” rather than a way station. With sovereignty pressure building in Europe and resilience concerns everywhere, I agree.

Mitel has a large European install base, and the deployment flexibility will serve it well in that region, where data sovereignty is a major issue, particularly in regulated verticals. I’ve discussed this with Tom Boyle at the NHS, who told me, “I need to ensure our clinicians can make calls regardless of what macro issues happen around the globe, so we will keep our communications system on-prem for the foreseeable future.”

Where the questions remain

The rollout of Mitel WX is phased. Initial availability begins in November, with full platform availability expected in 2027. MiVoice Business support is prioritized, with OpenScape Business and OpenScape Voice for the largest enterprises to follow in the next couple of quarters. OpenScape customers should receive firm dates before planning migrations.

Mitel will release artificial intelligence capabilities after launch. Mitel’s position on AI is that it makes people more capable rather than unnecessary, countering the view that “agents replace everyone,” particularly in contact centers, although I am seeing that opinion start to change. The Mitel AI Services Framework will include MCP support, and the incremental AI in the Elite tier is still to come.

Bitzinger’s view that “voice is the natural UI” for AI makes sense for front-line workers, and Mitel has decades of voice expertise to support this. Now it needs to ship.

The widget model for WX is only as good as its ecosystem. Mitel will build the core integrations itself and rely on services and technology partners for the rest. Bitzinger was candid about the channel, noting that most partners won’t become vertical workflow integrators: “Not for the overwhelming majority of channel partners. No illusions there.” That honesty is welcome, and integration depth will determine how quickly Mitel WX moves beyond early adopters.

Finally, there’s Microsoft Corp. Teams and Zoom Communications Inc. Mitel frames Mitel WX as complementary to both for knowledge workers. That’s sensible given the share those two vendors hold, but it means WX must win on the frontline against health care specialists and the frontline offerings from the big platforms.

Mitel has a real and growing opportunity. Hanson said two large, longtime customers, one in the U.S. and one in France, are already pushing to start migration plans after seeing MWX at Mitel’s User Group. Though the installed base is the “low-hanging fruit,” both Avaya and NEC have large install bases looking to move off those platforms as quickly as they can due to a lack of innovation. Moving a customer off an incumbent can be challenging, but Mitel can offer a “like-for-like” option for businesses that have stayed with a company such as Avaya because moving to the cloud doesn’t support the business.

Advice for IT leaders

• Map communications by role. Inventory your frontline, contact center, and knowledge worker roles and the tools each role uses. That’s the baseline for judging any role-based client.
• Audit your shadow IT. If frontline staff coordinate via consumer messaging apps, you already have a compliance problem.
• Test resilience, not features. Ask how calls and alerts are delivered when the internet path, a cloud region or a push service goes down.
• Get integration specifics in writing. “Integrates with EHR” can mean a deep workflow or a browser tab. Demand to see the integrations you need running on your systems.
• Use the in-place upgrade. Existing Mitel customers should take advantage of the migration path and the dual-run period to pilot Mitel WX with a single high-friction frontline group first.

Final thoughts

For Mitel, the WX strategy makes sense. Rather than chasing only the knowledge worker, where Microsoft and Zoom are entrenched, it targets the underserved frontline majority with a role-aware client, genuine deployment choice and voice at the center. Execution of the platform roadmap, the integration ecosystem and the AI layer will determine whether Mitel WX becomes Mitel’s growth engine or merely a better client for its installed base. Either way, it’s exciting to see UC come to the factory floor and hallways rather than to yet another meeting.

For as long as Cisco Systems Inc. has held its WebexOne event, the show has aimed to drive thought leadership in the collaboration industry. This year, with artificial intelligence on tap, it had its fair share of unified communications and contact center.

But more importantly, it was somewhat of a coming-out party for the “new Cisco,” which consolidated much of its historically sprawling portfolio into a single AI platform, with Webex as the place where people and agents meet.

The “One Cisco” story has been shared at Cisco Live and other events over the past year, but for many Webex buyers, this is their first exposure to it at this depth. President and Chief Product Officer Jeetu Patel opened his keynote by framing the market around five forces: Agents are the new workforce, inference is the new workload, tokens are the new currency, trust is the new catalyst and control is the new moat. The underlying message was consistent with other presentations from Patel: If agents run everywhere, someone has to build and secure the infrastructure beneath them.

“We have moved from the age of chatbots, where we just asked questions of a model and got back answers, to agents that are now conducting tasks and jobs for us almost fully autonomously,” Patel said. “These agents act more like digital workers than like just a software tool.”

In many ways, the more interesting commentary came during the post-keynote analyst Q&A, when Patel explained how Cisco got here. Six years ago, he said, Cisco “looked much more like a holding company than a platform company,” with roughly 250 acquisitions and siloed general managers. Webex Control Hub was the first platform experiment. Cisco Cloud Control, which he said came together in nine months, is now the management plane for everything Cisco sells, alongside Cisco Data Fabric for data and Silicon One for silicon.

“Over time, Meraki as a brand will be gone. Over time, Catalyst as a brand will be gone,” Patel said. “We will all be feature managers, not product managers, because all we’re doing is building features for the platform.” I’ve heard Cisco talk about platforms for years, but this is the first time the org chart, sales compensation and roadmap point in the same direction.

The platform discussion laid the foundation for the following takeaways from the keynote:

1. Context, not the model, is the scarce resource

Every vendor has the same frontier models. What makes an agent useful is context: who’s on the team and what was decided last week. Glean CEO Arvind Jain, who joined Patel onstage, explained that without that knowledge, agents “work like a day-one employee.”

He estimated that 80% of enterprise knowledge is buried in meetings, making Webex more strategic than “meetings software” suggests. That’s why the most important Webex announcements focused on integrations. Claude in Webex, built on Anthropic’s Claude Managed Agents, will let teams analyze data, generate content and act on shared context. A Model Context Protocol integration brings Webex context into OpenAI’s dots personal agent. Users can also invite agents into spaces, meetings and calls. Cisco isn’t trying to own the model. It’s trying to own where the work happens.

While all the collaboration vendors espouse the value of data, Cisco has a unique asset, namely data from Splunk, security and networking, which provides an additional dimension into what users are doing and where they are located.

2. Token budgets will become a line item, and the network will feel it

Citing OpenRouter data, Patel said agent token consumption surpassed human consumption in February and is now five times higher. He also said that an agent consumes 450% more network bandwidth than a human performing the same task and that 60% of global compute this year will be used for inference rather than training.

“The costs of tokens coming down are nowhere near the demand going up,” he said. “So all of us are going to have a human budget as well as a token budget.” Patel told the audience that by the end of this month, every Cisco manager will know their token budget.

Jain called out how unusual that is. “Technology is always supposed to be a fraction of the cost of your labor,” he said. “It cannot be like this forever.” Until that changes, agents that run around the clock reshape information technology cost models and network capacity planning, areas where Cisco has a clear interest.

3. Trust has moved from brake to accelerator

“Historically, in everything we’ve seen in tech, trust has never been a catalyst,” Patel said. “It’s always been an impediment to adoption.” Agents deliver value only when granted access to calendars, email, and credit cards, which requires trust. He compared agents to teenagers: “They’re supremely intelligent. They have no fear of consequences.”

More important is his argument that security and observability are converging because both prompt injection and agent drift appear in telemetry. “You cannot be doing security enforcement through static policy at design time,” he told analysts. “They’re dynamic policies that are enforced at runtime.”

He went further: “He who wins agent security is going to win the security stack.” The proof point is that Webex AI Agents run within Cisco AI Defense guardrails, with live telemetry and observability from Splunk. Cisco can do this natively, while other collaboration vendors will need to partner, which always adds complexity.

4. The office isn’t going away, but it’s being rebuilt

One interesting question in the analyst Q&A asked why a company should invest in offices if agents eventually outnumber people in meetings. During the event, Cisco took several press and analysts to its newly redesigned Austin office to showcase what modern workspaces should look like. Patel said, “Humans are social creatures.”

He noted that 1.4 billion square feet of commercial real estate is up for renewal and that Cisco’s campus and branch business, historically tied to GDP growth, has grown by more than 20% over the past couple of quarters as companies re-equip offices.

If the refresh is done right, the office itself becomes a data source, as at Cisco Austin. “We see the workplace as an intelligent ecosystem, where the office is an active participant in work,” explained Wayne Andrew of Asahi Beverages.

Intelligent Workplace Experiences combines networking, devices, experience assurance, and space data under Cloud Control, with Workplace Designer, Experience Metrics, and Workplace Insights as new components. RoomOS 27 adds an AI Assistant in 32 languages, and the Ceiling Speaker Pro delivers IP-connected audio over a single Ethernet cable.

Openness is almost a new muscle for Cisco. Through a new partnership with Google, Cisco devices now run fully featured Google Meet natively alongside Webex, Microsoft Teams, and Zoom. “If you’ve invested in a competitor of ours, we owe it to you to make sure that you can actually get the most out of that investment,” Patel said. That’s a smart hedge in a platform war Cisco doesn’t need to win. Historically, Cisco wanted the whole pie, which cost it some deals. Under Patel, Cisco understands that a slice of the pie is fine and often better for the customer.

5. Customer experience is about to be intermediated by agents

Patel said fewer than 2% of people use agents as power users today and predicted that number could reach 30% to 40% within 12 to 15 months. Then consumers send their agents to deal with brands. “Not only does your website need to be dexterous at going out and influencing humans,” he said, “they also have to be dexterous in influencing agents.”

Brands will see far more inbound agent traffic and will need their own agents to maintain direct customer relationships. Patel described the goal as “a relationship concierge for every single one of your customers.” Anurag Dhingra, who leads Cisco’s intelligent workplace efforts, described today’s problem: “Every time a customer engages with you, it feels like they’re starting over.”

Dialog, the new agentic harness for the Webex AI Agent platform, is Cisco’s response. Its agents continue working after the conversation ends, carry context across channels, and learn from human agent judgment. It’s the right shift; execution will depend on how well Dialog integrates with the back-end systems where outcomes are finalized.

Final thoughts

Patel told analysts that “the turnaround is complete” and that Cisco’s innovation pace will only accelerate. The platform work supports both claims. The risk is that customers struggle to absorb it all, a challenge Patel acknowledged. Cisco’s financial performance appears to support Patel’s claim, with Cisco’s stock price up over 50% year-to-date and over 70% since WebexOne 2025. The growth in valuation has come on the backs of product innovation, which Cisco has accelerated despite the massive breadth of its offerings.

For IT leaders, I’d focus on four things. First, track token consumption by team now, before agent spend becomes a surprise. Second, treat agents as identities: Inventory them, assign owners and enforce policy at runtime. Third, bring networking, collaboration and facilities to the same table for workplace refreshes, since their budgets are converging. Finally, ask your CX team how the business will respond when a customer’s agent, not the customer, calls in.

That day is closer than most companies think.

Since its founding in 2004, it’s arguable that no network vendor has made better switches than Arista Networks Inc. That was true then and remains true, as its prowess in this area helped it ride the cloud boom and the artificial intelligence wave.

That model is changing as AI scales. Today, ahead of next week’s Open Compute Project Global Summit in San Jose, Arista announced an expansion of its AI network strategy from switches to rack scale.

Arista is launching an open Ethernet rack-scale portfolio covering both scale-up and scale-out AI fabrics, built with a large ecosystem of players such as Advanced Micro Devices Inc., Arm Ltd., Broadcom Inc., d-Matrix Corp., Meta Platforms Inc., Microsoft Corp. and Qualcomm Corp. The lead announcement is Etherlink SU-144, an Ethernet-based scale-up architecture that connects up to 144 accelerators, or XPUs, within a single-hop domain and up to 1,024 XPUs across racks. It is built on the Ethernet for Scale-Up Networking or ESUN initiative.

In the AI era, the network can no longer be thought of as an independent pipe moving data between servers. It has become a tightly integrated, rack-scale backplane, and how well it’s built determines how much value customers get from their compute. That’s a significant shift for a company whose identity has been built on the network as a distinct layer. But the network isn’t disappearing into the compute. Instead, the compute is being built around the network.

What Arista announced

The scale-up piece comes in three physical form factors, each designed for different use cases. During an analyst briefing, Vijay Vusirikala, Arista’s distinguished lead for AI systems and networks, walked through each one.

• Orthogonal chassis. Servers sit in front, and full-height switch cards in the back connect directly, with no backplane or cabling, drawing on Arista’s modular chassis heritage. It supports 100 to 400 kilowatts of liquid cooling. This is the design for vendors focused on training workloads that need the largest possible scale-up domain.
• Cabled backplane. Switches sit in the middle of the rack and connect to servers via copper cable cartridges. It is less dense but more serviceable, and it lets operators split bandwidth between intra-rack and inter-rack connections.
• Cross-rack. A dedicated switch rack connects separate accelerator racks. It is the most flexible design and the fastest to market because it avoids long co-engineering cycles, but it adds interconnect cost and power. “Copper runs out of juice very quickly,” Vusirikala said, so anything beyond two racks needs optics.

On the scale-out side, Arista offers liquid-cooled rack reference designs in eight-, 12- and 16-switch configurations, built around its 7060EX7 switches. Each delivers 102.4 terabits per second, plus fiber patch panels, cooling manifolds, drip trays with active leak detection, rack management controllers and power shelves with battery backup. Integration partners build, test and deliver the configured racks. The fabric supports Ultra Ethernet Consortium specifications, Multipath Reliable Connection resiliency, multi-plane routing and dynamic and cluster load balancing.

Customers can run Arista EOS or an open network operating system on the common Netdi foundation. Arista also said next-generation optics, including its XPO pluggables and open co-packaged and near-packaged optics, will increase rack capacity from 1.6 petabits per second to 6.5 petabits, cutting the data center footprint by nearly half.

Andy Bechtolsheim to present at OCP

The OCP Global Summit runs Oct. 12-15 in San Jose, and Arista will have a fully assembled liquid-cooled rack at its booth. This departs from the traditional engineering story at an Arista booth, focusing less on switching and more on manifolds, leak handling, fiber management and power. According to Arista’s OCP event page, co-founder and industry visionary Andy Bechtolsheim will present at 1 p.m. Oct. 13 on “The Gigawatt AI Data Center Era.”

Why this matters for Arista

Three takeaways emerged from the Arista announcement. First, Arista is targeting the one part of the AI network it hasn’t owned. It leads in scale-out and is pushing into scale-across, but scale-up has mirrored Nvidia’s NVLink market share. Arista was matter-of-fact that this won’t change for Nvidia-based systems anytime soon. “There is no near-term opportunity because that is proprietary,” Vusirikala told me.

The opportunity lies in non-Nvidia accelerators, and a partner list including AMD, Microsoft’s Maia, Qualcomm and d-Matrix shows that market is real. Arista is betting that heterogeneous compute will become the norm. This is wise for Arista, as there is plenty of opportunity for every vendor without trying to disrupt Nvidia’s seemingly undisruptable business.

Second, Arista is making the case for a single network stack across all three fabrics. These have historically been separate networks. Arista wants the same EOS, telemetry and diagnostics, regardless of whether the silicon underneath is shallow-buffer, deep-buffer, or low-latency. That’s a network-centric view rather than a compute-attached one, and it’s Arista’s strongest argument because fault isolation and predictive maintenance now extend into the most performance-sensitive part of the cluster.

Third, this is a reference architecture strategy, not a SKU launch, and it changes how infrastructure is delivered. Arista supplies the switches, software, designs and validation suites, while partners handle rack integration.

During the briefing, Arista Senior Product Line Manager Arihant Jain explained the importance of this. A 16-switch rack configuration can involve 2,000 fibers, and on-site cabling invites bend-radius violations, miswiring, signal-integrity problems, and dead optics. “The whole old approach of spare parts or things assembled at site has to change,” he said. Racks need to be integrated and tested upstream, then rolled into place. Liquid cooling forces the issue because switches, manifolds, and leak responses must be designed together.

Do you shut down a switch or a rack when a leak is detected, and does that decision tie into the building management system? These used to be facilities questions. They are now network questions.

The caution is that Nvidia’s turnkey stack remains Arista’s biggest obstacle and, in some ways, detracts from its Ethernet prowess. When customers buy a complete system, Ethernet doesn’t always come up. Open designs win on choice and economics, but they demand coordination among accelerator vendors, rack integrators and cooling suppliers.

Execution across that ecosystem will determine how quickly these land. Early buyers will be hyperscalers, neoclouds and AI infrastructure providers. Most enterprises will use these architectures through those providers rather than deploy them directly, at least for now.

Advice for network engineers

• Learn liquid cooling now. Arista expects roughly a 50-50 split between air- and liquid-cooled deployments for its current 100-terabit switches next year. Vusirikala said liquid cooling becomes effectively mandatory at 200 terabits per second. Removing fans alone cuts switch power by about 10%. Engineers who understand manifolds, leak detection and thermal design will be in demand.
• Think in racks, not boxes. Acceptance testing, sparing and troubleshooting shift when the rack is the product. Request rack-level validation data.
• Get fluent in scale-up. Scale-up was the server team’s problem. As Ethernet moves into that domain, it becomes the network team’s problem. Study ESUN, UEC, and features such as link-level retry and credit-based flow control.
• Keep optics options open. Arista said its customers are roughly split between next-generation pluggables and open CPO. Decide based on serviceability, power and your operational model.
• Protect operational consistency. One operating model across scale-up, scale-out and scale-across is worth more than a marginal performance gain.
• Question your AI providers. If you consume AI capacity from a neocloud or cloud provider, ask how its scale-up domains are built and how quickly failed racks are isolated. That affects the accelerator time you pay for.

The InfiniBand-versus-Ethernet debate in scale-out is largely settled. Arista is betting that the same economics hold one layer down, inside the rack. The competition is no longer about port speeds. It’s about who can roll in a validated rack and put expensive accelerators to work fastest. As accelerators diversify, the network that ties everything together becomes the platform, and that is precisely where Arista wants to be.

For most of its two-decade history, SailPoint Inc. has been the company that tells enterprises who should have access to what. At Navigate 2026 in Austin this week, it argued that it now needs to be the company that stops the wrong access the moment it happens.

The keynote opened with an orchestra to illustrate the harmony that emerges when discrete components work together. When they don’t, the experience is very different. During his portion of the keynote, Chief Executive Mark McClain (pictured) used this analogy to describe the chaos that ensues when AI agents don’t work together. But this shift is bigger than the keynote’s orchestra analogy suggested.

Governance has always run on a calendar: quarterly certifications, annual audits and reviews that arrive weeks after the fact. Artificial intelligence agents run on tool calls, and they make many of them. SailPoint’s bet is that the identity context it has spent 20 years building enables real-time enforcement, and that runtime-only security tools will struggle without it.

Here are my five thoughts that should matter to security and identity leaders:

The workforce is now mostly not human, and accountability is the problem

McClain opened by noting how quickly the enterprise’s composition has changed. “A few years ago, you knew exactly who was in your orchestra. It was your employees, your contractors, your partners. In short, people,” he said. “But today, there’s an invisible crowd operating right alongside them,” he added, describing service accounts, application programming interface keys and autonomous agents that, according to a study he cited, outnumber human identities 109 to one.

In his keynote, President Matt Mills made a key point. “An agent acts on behalf of a human or another agent that traces back to a human,” he said. “So, the moment you govern human and agent separately, you lose the thread of who’s actually accountable. We treat human and agent identity as one problem. It’s on one graph. It’s under one policy.”

This is a key part of SailPoint’s argument, and it’s why the company evolved Identity Security Cloud into two products, Agentic Fabric and Human Fabric, both built on its Atlas platform. Many newer agent-security startups treat agents as a standalone inventory problem.

But an agent without a human owner is just an orphaned account capable of reasoning. Criteo S.A. Director of Corporate Security Jérôme Robin, a SailPoint customer since 2021, did a great job explaining the problem: “Giving access to an agent for a task means delegating your business responsibility.” He concluded with a point every CISO should heed: “Technology should enforce the model, not replace it.”

Human-speed governance can’t keep up with machine-speed identities

Mills was very matter-of-fact about where legacy governance falls short. “You cannot fight AI-speed threats with human-speed governance,” he said. “Basic monitoring is not security. Simply watching an agent do bad things isn’t security. It’s just a dashboard that reports all your breaches to you.”

The numbers certainly support this thesis. Executive Vice President and Chief Technology Officer Chandra Gnanasambandam said SailPoint sees 75 million to 150 million agentic interactions per day at an average Global 2000 company. He added, “The idea that a security admin is going to review and approve access for a group of autonomous agents making 10,000 tool calls a second isn’t just outdated; it’s a fantasy.”

SailPoint’s fifth annual Horizons of Identity Security report, released at the event, found that 79% of organizations run AI agents in production, yet only 2% use identity security tools to govern them, and just 15% can provision non-human access in real time. CMO Wendy Wu concluded: “You cannot run an AI-speed enterprise with human-speed security.”

SailPoint’s answer is a set of Autonomous Agents: Red agents detect drift, blue agents analyze it and deprovision access, and green agents handle peacetime work, such as certifications. Gnanasambandam said the largest customers have certification campaigns with more than 10 million line items and 95% of those should be automated. The reality is that access reviews were broken for humans long before agents arrived. AI didn’t create the problem; it made it impossible to ignore.

Runtime controls without identity context are blunt instruments

If there was one statement from Gnanasambandam that buyers should focus on, it’s this one, aimed squarely at the runtime-first vendors: “An agent kill switch is supposed to kill the bad agents. If you’re a runtime control platform without context, and the kill switch can’t tell a good agent from a bad one, on what basis will it kill the bad agent?” he asked. “It’ll end up killing both good and bad agents.”

It’s a fair point. A kill switch that shuts down legitimate automation is one the business will make you turn off. The new capabilities support the argument.

Agentic Fabric adds shadow AI discovery, runtime authorization, prompt monitoring with policy-based redaction, and a one-click kill switch. Autonomous Identity Security Posture Management identifies dormant accounts, shadow admins and orphaned access, and acts on them rather than just reporting them. Entro Security, acquired earlier this year, adds credential lineage and exposed-secret discovery, with full integration expected in November.

Mills offered a data point highlighting the problem’s magnitude. In a Fortune 500 proof of concept, SailPoint surfaced more than 10,000 unknown agents within a week. Eric Burnett, director of identity and access management at University of Chicago Medical Center, acknowledged the same blind spot: “We know that there’s a lot of AI out there in our environment that we’re not aware of.”

Runtime vendors counter that identity platforms don’t sit in the traffic path. SailPoint knows this, which is why it’s integrating with network proxies, CrowdStrike Holdings Inc.’s Falcon marketplace, and data security tools such as BigID and Microsoft Purview. Whether context outweighs an inline position is the competitive question in this market, and buyers should test it rather than take either side at its word.

Standing privilege is the real enemy, and the hardest one to kill

“In a near-agentic world, standing privilege is dead,” Gnanasambandam said, noting that 98% of access today is standing privilege and that least privilege has been the goal for decades without ever being operationalized. Of all the news from the event, he called effective privilege the most interesting. Certifications review only directly granted entitlements, but much of a user’s real access comes indirectly through nested groups and service accounts.

“I call this the iceberg problem,” he said. “We got away with it because at human speed, no one knew. But at machine speed, these machines are able to find everything.” SailPoint is now using machine learning to model effective privilege for every identity and feed it into certifications.

The other practical change is conditional just-in-time provisioning for people, service accounts, and agents. Gnanasambandam described an agent that discovers mid-task that it lacks access and, rather than hunting for an exposed admin credential, requests access from its human owner, who grants it briefly and then revokes it. That’s the right thought process, but a partner reality check followed.

“I’m yet to meet one client in my entire career who has least privilege fully employed in their organization,” said Sanjeev Shukla, global lead for identity and trust at Accenture. He added that some tier-one banks that have spent hundreds of millions of dollars still have only about 65% privileged access coverage. Declaring standing privilege dead is easy. For most companies, getting there is a multiyear cleanup.

Stewardship matters as much as the shiny new thing

Mills spent much of his time telling the audience not to believe the hype, including SailPoint’s. He shared a Dallas-based Fortune 500 chief information officer’s description of the cybersecurity market as “full of vendors with big hats and no cattle.” “Demand proof over promise,” Mills said. “Make us and every vendor you meet show you the cattle.” In other words, don’t buy anything until you run a proof of concept and see the solution work.

That’s a great challenge for a vendor executive to make, and the first test is SailPoint’s installed base, much of which still runs IdentityIQ on-premises. The company announced IdentityIQ 9.0, featuring time-based access, a rebuilt foundation, an automated upgrade tool, a rebuilt Human Fabric certification engine, and proactive separation-of-duties checks. “Most vendors ask their customers to choose between a growth story or a stewardship story,” Gnanasambandam said in the announcement. “This is one modernization effort on two fronts.”

He also made two admissions that aren’t often heard on stage. SailPoint’s user experience has lagged its capabilities, and core roadmap items, such as certifications and separation of duties, needed to be pulled forward by two quarters. Agentic AI is the exciting story, but identity programs live or die on the basics, so fixing the blocking and tackling now will help SailPoint long term.

What this means for buyers

SailPoint made the case that identity is where agent accountability must live. Now it must prove it can enforce in real time, not just govern on a schedule. For information technology and security leaders, I’d focus on the following:

• Run discovery first. If one week turned up 10,000 unknown agents at a Fortune 500, assume your inventory is wrong.
• Assign a business owner to every agent. If no one is accountable for an agent’s actions, it shouldn’t have access.
• Test the kill switch in your own environment. Make any vendor, SailPoint included, show how it tells a good agent from a bad one using your data.
• Fix effective privilege for humans. Nested groups and overpermissioned service accounts are what agents inherit.
• Treat zero standing privilege as a program, not a product. Start with just-in-time access for the most sensitive systems, then expand.

McClain told the audience that SailPoint doesn’t write the music; its customers do. But for the first time, SailPoint is promising to stop the band mid-song if someone plays the wrong note. That’s a much harder job, and it’s the one customers should hold the company accountable for.

Every information technology leader I talk to has an artificial intelligence story about customer experience. Almost none has an outcome story.

That gap is now measurable. Talkdesk Inc., in partnership with NewtonX, surveyed 252 director-level-and-above leaders in customer experience, IT, operations and AI strategy at midmarket and enterprise organizations across four regions. The resulting benchmark, The State of Agentic Automation in CX, concludes that IT should reframe how it plans its next CX investment: Adoption is no longer a differentiator, and execution is the new battleground.

The headline numbers make the point. Ninety-eight percent of organizations use some form of AI in customer experience. Generative AI is at 74%, and scripted AI is at 65%. But only 24% use agentic AI, which refers to systems that take a goal, reason through it, and act across systems. And just 15% pair agentic AI with the orchestration required to resolve a customer need end to end. Meanwhile, 81% are piloting or deploying AI agents, yet only 19% have scaled beyond a single use case, and nearly 80% have fewer than 10 AI automations in production.

Pedro Andrade, vice president of AI at Talkdesk, presented the findings in an analyst briefing and outlined the state of the industry. “AI adoption is no longer a question. Now the question is whether organizations can orchestrate all the elements needed to deliver measurable customer outcomes — agents, humans, data, knowledge, workflows, and governance — all in one package.”

That gap carries a dual cost, as Talkdesk describes it in announcing the research: Companies pay for isolated AI tools while still absorbing the operational cost of customer requests those tools never complete. Talkdesk founder and Chief Executive Tiago Paiva calls the result “a false sense of progress,” arguing that widespread deployment masks how few organizations can quantify AI’s impact.

Routing is not resolving

The most useful distinction in the research is between activity that resembles orchestration and true orchestration. Sixty-four percent of organizations run specialized AI agents for functions such as identity verification, billing, or technical support. Yet only 35% have AI that can maintain customer context and act across systems to drive true resolution. If every handoff forces you to rebuild context and memory, you have built a smarter switchboard, not an outcome engine.

“Routing work is not the same as resolving it,” Andrade said. He used a car accident as an example: One event triggers a tow provider, a claim, a repair shop and a rental — multiple departments, multiple systems, one expected outcome. Fifteen percent of companies can automate that journey end to end.

The research organizes this into a five-stage maturity curve with two chasms. The first is the agentic threshold: moving from scripted and generative AI to AI that acts. Fifty-six percent fall below it. The second is the CXA unlock — moving from isolated agents to autonomous cross-system execution. Twenty-nine percent are Agentic Scalers with one of the two capabilities; 15% are CXA Leaders with both.

The spread between those top two tiers is where budget attention should be focused. CXA Leaders are roughly four times more likely than Scalers to report major CSAT or NPS gains — 22% versus 5%. Thirty-eight percent already resolve over 40% of customer issues autonomously, while 60% of Scalers still resolve fewer than 20%.

Leaders are also about twice as likely to run revenue-oriented automations, such as churn prediction (51% vs. 28%) and personalized recommendations (44% vs. 19%). The difference is not in tool count. It is in how much meaningful work the AI is permitted and able to do.

The blockers are infrastructure, not intelligence

This is squarely in IT’s lap. When asked what limits their ability to automate CX, respondents cited compliance (50%), security (48%), disconnected systems (45%), legacy infrastructure (44%), insufficient skills (41%) and unclean or non-unified data (40%). None of the top barriers stems from AI models.

Fragmentation carries a tangible cost. Human agents lose an average of 28% of their time to system switching, data re-entry, and searching for customer context. That climbs to about 35% in the least mature organizations and falls to roughly 25% in the most mature — about 10% of employee capacity reclaimed. Respondents estimate that incomplete context, repeated explanations, and manual escalations affect roughly one in four customer interactions. And 94% of organizations lack AI-assisted knowledge management.

That knowledge gap is the one Andrade said he hears most often in customer meetings: “It’s not about actually having it. It’s more about how I make it ready to be consumed by AI.” Only 64% of CXA Leaders have knowledge embedded in the workflow or AI-assisted — and they are the leaders.

The lesson generalizes. If your environment is too fragmented for humans to work efficiently, it will be too fragmented for AI agents to operate safely.

What IT pros should do

• Audit for resolution, not deployment. Count how many issues close without human intervention and how many require context to be rebuilt at a handoff. Deployed-agent counts are vanity metrics. Ten agents that hand off are worth less than two that resolve.
• Fix data and knowledge before adding agents. Only 2% of organizations report fully unified data. Move from “some integrations” to “mostly integrated” across the systems your top journeys touch, and move knowledge out of static repositories and into the workflow. As Andrade noted, “operationalization” — not launching the first pilot — is the real challenge.
• Pick journeys, not use cases. Choose two or three high-volume journeys that span departments, then map every system, approval, and exception within them. That surfaces compliance and legacy issues while the blast radius is still small.
• Build measurement in from day one. Only 5% of companies can clearly quantify AI’s business impact. Andrade called measurement the report’s biggest miss: knowing what to track, which KPIs matter and having the plumbing to track them. Tie automations to first-contact resolution, autonomous resolution rate, cost per contact and CSAT before go-live, not after.
• Treat agents like employees. Nearly one in five organizations already view AI agents more as labor than as technology, and 99% believe a hybrid workforce is beneficial — yet 52% cite trust in AI decision quality as their top concern, including 46% of the most mature organizations. The most mature are also more than 10 times as likely to run AI and people as a single unified operation. Define escalation paths, QA frameworks, observability and accountability for agents as you would for a new team.
• Skip the generic roadmap. Maturity varies sharply by vertical. Retail leads, with 24% at the leader stage for repeatable, high-volume journeys. Healthcare adopts at market rate but has the most siloed data and the weakest payoff. Financial services have the best-integrated data, yet only 9% are leaders, held back by legacy cores. “CXA roadmaps cannot be generic,” Andrade said. Design yours around your industry’s actual constraints.

Eighty-three percent of organizations expect AI to resolve more issues autonomously within two years. That will happen only when someone has done the unglamorous work of connecting systems, grounding knowledge, and governing autonomy. That someone is IT.

A little over a year after closing the Juniper Networks acquisition, Hewlett Packard Enterprise Co. today used its Networking Investor Day to argue that networking is no longer a supporting act at HPE. It’s the growth engine.

The numbers shown to investors support that. HPE says its combined networking business will grow from $9.3 billion in fiscal 2024 to about $11.3 billion in fiscal 2026, with operating profit rising from $1.6 billion to $2.5 billion over the same period.

The company now expects networking revenue to grow in the high-teens to low-20% range in fiscal 2027, up from the 14% to 17% it guided on its last earnings call. It has set a long-term target of high-teens compound annual growth through fiscal 2029, with operating margins in the mid- to high 20s, according to HPE’s investor day announcement.

“AI is reshaping the technology stack, making the network more strategic,” said Rami Rahim (pictured), executive vice president and general manager of HPE Networking and former Juniper chief executive. Any networking vendor could say the same this year. What differentiates HPE is its product breadth and sales reach, which enable it to act on that, assuming execution holds.

Here are my five takeaways that should matter to investors and information technology leaders.

The integration is ahead of plan

Mergers of this size usually stall over cultural and sales conflicts. HPE has moved faster than most. Rahim said the company merged the sales organizations about six months after closing, under “one catalog, one compensation plan,” and every seller now carries the full portfolio. Cost synergies tell the same story. The original deal target was $450 million, which rose to at least $600 million at close and is now $800 million in annual run-rate savings by the end of fiscal 2028.

What investors should watch next is channel activation. Only about 10% of Aruba and Juniper partners overlap, and on Nov. 1, all 60,000 HPE partners will move to a single program. The cross-sell upside is huge and should move the needle on revenue and margins, but partner transitions are where integrations often slip.

Scale-up networking opens a new market

Data center networking is HPE’s fastest-growing segment, with a target of low to high 50% CAGR through fiscal 2029, compared with a market HPE pegs at 44%. Rahim explained that companies can spend billions on GPUs, but if the network can’t meet performance demands, “those resources are not fully utilized.”

The most important new development is scale-up, which Praveen Jain, senior vice president and general manager of data center, described to investors as connecting graphics processing units within a rack rather than scaling out across racks. Juniper has historically competed in scale-out and scale-across. The AMD Helios rack brings HPE into scale-up. Rahim said Helios represents more than a $1 billion networking opportunity over the next two years, with orders for the networking trays already exceeding $200 million.

At the event, HPE announced a $1.2 billion order from Vultr, its first for Helios. Each rack uses six HPE Juniper Networking QFX5252 scale-up Ethernet switch trays to connect 72 AMD Instinct MI455X GPUs. With HPE’s role in Oracle’s gigawatt-scale AI buildout, the data center story appears credible.

There are caveats. Full-rack deals tie up working capital, and Rahim said fiscal 2027 will be more back-end-loaded than usual as new systems ramp. On neoclouds, though, he was bullish on the opportunity: “Many neoclouds value the simplicity of buying a complete system from a single technology provider.” Juniper alone couldn’t have won the Vultr deal. HPE could.

Jumping into neocloud may make risk-averse investors nervous, as many deals in this space have used creative financing models such as credit swaps and asset-backed purchases. I asked Rahim about this during the analyst Q&A, and he was emphatic that the company has and would walk away from deals if the risk level is too high.

Routing matters again

Routing was long considered a mature, low-growth business. AI has changed that. HPE is targeting low to high 20% growth in routing through fiscal 2029, and AE Natarajan, SVP and GM of routing infrastructure solutions, explained why. With AI, upstream and downstream traffic become similar; the traffic can’t be cached like video, and AI agents generate it constantly. “Digital users don’t fall asleep,” he said.

That plays to Juniper’s MX and PTX platforms and its Trio and Express silicon, but the field is more crowded than it was five years ago. Rahim didn’t dismiss the competition. “We were up against 800-pound gorillas in practically every market opportunity that we wanted to pursue,” he said. He also said growth is “very much unit-based,” not driven by price increases, which is the better kind of growth. Owning its own silicon is the edge here, and HPE will need to keep investing in it.

Self-driving networks lead in campus, security trails but due for a boost

Campus and branch account for roughly half of HPE Networking’s revenue, and HPE expects high-single-digit growth there, compared with about 6% for the market, as customers upgrade to Wi-Fi 7. The differentiator is the self-driving network built on Marvis, Juniper Mist’s AI engine. “Self-driving starts with a very simple philosophy — up is not the same as good,” said Sujai Hajela, executive vice president and general manager of campus and branch.

The strongest endorsement came from a customer. Sajeev Nair, senior director of digital core services at ServiceNow Inc., described his network before consolidation: Each new point product meant “creating another fragmentation in your telemetry that is already fragmented” and “signing up for another control plane that you have to manage.” He said a manual workload that once took 2,000 to 3,000 hours a year now takes fewer than 60 hours.

Rahim said that given competitors’ self-driving claims, “you really have to look under the covers to see how much is actually there.” He was equally clear that Mist and Aruba Central will “never converge into one platform,” even though they now share Marvis, access points and CX switching.

Security is becoming an increasingly important part of HPE’s business, but it will remain a network feature rather than a move into standalone infrastructure. HPE forecasts high-single-digit growth in security and pegs the market at 12%, making it the only category where HPE doesn’t plan to outgrow the market. David Hughes, senior vice president and general manager of SASE and security, made a strong case for using “the network as a sensor” and for extending zero trust to AI agents.

Building security into the network helps customers stay secure. It isn’t a plan to take share from security-first vendors. In fact, I expect many security vendors to remain strong ecosystem partners for HPE.

Supply, not demand, limits growth

One of the day’s most interesting comments came during the Q&A. “Quite frankly, we, including me, underestimated how explosive market growth is,” Rahim said. Third-quarter orders grew 3.5 times faster than revenue, and HPE doubled its networking supply commitments from the prior quarter. His outlook for fiscal 2027 was candid: “Still supply-limited, just less supply-limited.”

That’s a good problem to have, but it’s still a problem. Fiscal 2027 guidance depends on how quickly HPE secures components, not just on the number of deals it wins.

What this means for buyers

For IT leaders, I’d recommend the following regardless of whether you are an HPE customer:

• Lock in supply early. Rahim expects fiscal 2027 to remain supply-limited, and HPE isn’t the only vendor in that position. AI networking supply is tight across the industry. If you have AI data center buildouts or Wi-Fi 7 refreshes planned for 2027, secure delivery dates and allocation commitments in writing now, not when the purchase order goes out. Build some slack into project timelines, and ask your vendor which parts of the order are most at risk.
• Test self-driving claims in production. Rahim is asking customers to “give us a shot,” and he warned that buyers need to “look under the covers” of competitors’ automation claims. Take him up on both. Run a proof-of-concept on a real part of your network, not in a lab, and set success metrics before it starts: fewer trouble tickets, faster mean time to repair, and less time spent on manual work. The ServiceNow numbers are a good benchmark. Hold every vendor, including HPE, to the same test.
• Don’t wait for a single platform. HPE has said Mist and Aruba Central won’t merge. Instead, the two will share Marvis, access points, and switching. That clarity is helpful. Choose based on your deployment: Mist for cloud-only operations, Aruba Central if you need on-premises options. Don’t delay a refresh waiting for a single platform, because one isn’t coming. Ask HPE for a roadmap that shows which features will reach both platforms and when.
• Push for open scale-up. Until now, scale-up networking within the AI rack has largely been a proprietary, single-vendor decision. Helios, with Ethernet scale-up and UALink over Ethernet, offers neocloud and enterprise AI buyers a credible alternative. Even if you don’t buy Advanced Micro Devices, use it as leverage. Press every AI infrastructure vendor on open standards, interoperability and silicon choice so a rack-level decision today doesn’t lock in your architecture for the next decade.
• Retire legacy gear before AI exposes its flaws. Anthropic’s Claude Mythos has changed the math for upgrade cycles. Through Project Glasswing, the model has helped vetted organizations identify more than 10,000 high- or critical-severity vulnerabilities. Switches, routers, access points and firewalls that are end-of-life or running outdated software used to be a problem you could put off. During the industry analyst Q&A, Rahim stated that many of the customers they inventory have equipment that belongs in a museum. This is more common than most realize, especially in operational-technology-heavy environments where change causes disruption. Those switches that create stability are now easy targets because AI can find and exploit flaws faster than any vendor can patch them, and end-of-life gear won’t be patched at all. Inventory everything that’s out of support, replace it as part of the Wi-Fi 7 cycle rather than after it, and use network-level segmentation, as David Hughes described, to contain devices you can’t replace yet.

Final thoughts

When HPE announced the Juniper deal, skeptics asked a fair question: Could a server company run a networking business without slowing it down? Investor Day largely answered that question. The sales teams have merged, and the product roadmap has accelerated rather than stalled. More importantly, HPE is now winning deals, such as the Vultr Helios order, that neither company could have won alone.

Rahim closed by saying the network has “never been more critical to how businesses operate” and to how AI gets built. For the first time in HPE’s history, networking is the business that makes the case for the rest of the company, not the other way around.

The hard part is shifting from strategy to execution. Over the next 12 months, HPE must ramp Helios with more than one anchor customer, move 60,000 partners onto a new program without disrupting the channel, secure enough components to convert a large backlog into revenue, and demonstrate that security can do more than protect existing accounts. None of these is a strategy problem, and that’s the point. HPE has the portfolio, sales reach and demand. If it executes, the targets it set this week will look conservative. If it doesn’t, supply constraints and channel friction will be the reasons.

Either way, the network is no longer a side story at HPE. It’s the main one.

Every major security shift ultimately comes down to one question: Who or what is allowed to do this?

For most of the past two decades, the answer was a person with a username and password. In the artificial intelligence era, the answer increasingly is an agent, and most organizations have no idea how many agents they have, what they can reach, or who is responsible for them.

This is the primary reason identity has become a critical, and some would argue the most important, layer in the AI security stack. Reflecting this, the theme of this year’s SailPoint Technologies Inc.’s Navigate conference is “AI, secured,” which I will be attending on October 5-8 in Austin, TX.

The identity math has changed

A tremendous amount of data supports the identity thesis. As an example, Palo Alto Networks Inc.’s 2026 Identity Security Landscape report found that organizations now manage an average of 109 machine identities for every human identity, and companies expect AI agent identities to grow 85% over the next 12 months. The same research found that more than half of organizations can’t consistently enforce least-privilege access for service accounts across cloud, software-as-a-service and on-premises systems.

SailPoint’s own research is equally telling: Some 97% of AI agents have access to sensitive data, yet only 21% of organizations are highly confident they can manage AI agent security risks. Put those together, and you have an exploding population of highly privileged identities that almost nobody is governing well.

It’s important to note that the risk is real today. On SailPoint’s most recent earnings call, management described a proof-of-concept at a Fortune 500 company that uncovered more than 10,000 previously unknown AI agents and thousands of related risks. Shadow IT took years to spread, while shadow agents are spreading in months. A recent ZK Research data point found that almost half of AI use is on mobile devices, most of which information technology can’t see. As has been the case with every tech transition, if users do not get the experience they want from work tools, they will turn to consumer applications, and that’s happening today with AI.

Why identity, and why now

Much of the industry’s work on agent security has focused on containment: sandboxes, secure runtimes, guardrails, and, increasingly, hardware enforcement. That work is essential, but it doesn’t answer the most basic governance questions. A sandbox can prevent an agent from reaching the internet, but it can’t tell you who created that agent, whose authority it’s acting under, or whether it should still exist. For that, even the most sophisticated runtime must rely on an identity system.

In other words, every layer of agent security depends on the enterprise getting identity right. Containment tells you what an agent can’t do. Identity tells you who the agent is, who owns it, what it’s entitled to, and when that entitlement should end. You need both, but identity is the system of record everything else relies on.

Identity matters more for agents than it ever did for people for three reasons.

First, agents operate at machine speed. A human with excessive privileges might misuse them occasionally. An agent with excessive privileges can exercise them thousands of times an hour, and as the Hugging Face incident this summer showed, it can find paths no one anticipated.

Second, agents accumulate access. People change roles but retain permissions they no longer need; that’s a longstanding identity problem. Agents do the same thing faster, spawning sub-agents, borrowing credentials and combining permissions in ways no single policy anticipated.

Third, agents undermine accountability. When something goes wrong with a human account, there’s a person to call. With agents, the owner is often unclear, credentials are shared, and the logs point to a service account nobody remembers creating. SailPoint Chief Executive Mark McClain explained on the earnings call that enterprises need to know what data each agent can access, which human is accountable for that access, and how to revoke it when necessary. Those are the right three questions, and most companies can’t answer any of them today.

SailPoint’s bet on unified identity

SailPoint has leaned hard into this problem. In May, it launched Agentic Fabric, which discovers AI agents and machine identities, maps each to a human owner, and enforces real-time authorization. It became GA in August as part of a broader SailPoint Identity Security solution that pairs it with Human Fabric, the evolution of its Identity Security Cloud, on the Atlas platform. Capabilities include endpoint and browser sensors that expose hidden agents, Model Context Protocol servers, inline redaction of personal data before it reaches large language models, and a centralized kill switch for rogue agents.

I met with SailPoint President Matt Mills at BlackHat, and we discussed the product’s importance. He explained, “You cannot secure what you cannot see, or what you cannot tie back to accountability.” It’s the latter part of his statement that’s most important, because visibility without ownership just creates a longer list of problems.

What to watch at SailPoint Navigate

SailPoint Navigate is coming up next week, and here’s what I’ll be looking for:

• Proof in production. Agentic Fabric has been generally available for about two months. I want to hear from customers about how many agents they found, how they assigned ownership and what they shut down.
• Interoperability with the agent stack. Identity has to integrate with runtimes such as OpenShell, cloud agent platforms and developer tools. SailPoint’s recent Cursor connector is a good start, but the ecosystem should expand.
• Just-in-time access for agents. Standing privilege is the enemy. I’ll be watching how far SailPoint pushes toward zero standing privilege for nonhuman identities.
• Speed of governance. Quarterly access reviews don’t work for identities created and destroyed in minutes. Governance has to become continuous and largely automated.

Recommendations for IT pros

Regardless of which vendor an organization chooses to use, this is where the focus for identity should be:

• Inventory every agent. You can’t govern what you can’t see. Run discovery across cloud, software-as-a-service, endpoints and browsers, and expect the number to be much higher than you think.
• Assign a human owner to every agent. No agent should exist without a named person accountable for it. Disable unowned agents by default.
• Eliminate standing privileges. Move agents to just-in-time, scoped access that expires when the task is complete. Never embed long-lived keys or tokens in agent code.
• Govern humans and machines together. Agents often act on people’s behalf. Managing them in separate tools creates blind spots, so bring human, machine and agent identities into a single governance model.
• Build and test a kill switch. Know exactly how you would revoke an agent’s access and credentials in seconds and practice it before you need to.
• Connect identity to enforcement. Ensure your identity platform feeds your agent runtimes, network controls and security operations tools so policy is enforced wherever the agent goes.

Final thoughts

The industry has spent the past few years debating whether AI is safe, and that discussion has reached a crescendo over the past couple of months. The more practical question for IT leaders is whether they know who and what is operating within their environment. Identity has always been foundational to security, but in the AI era it becomes the control plane for trust.

Companies that treat agents as first-class identities can scale AI with confidence. Those that don’t will eventually learn the hard way what their agents have been doing. Navigate should give us a good read on how ready the industry and SailPoint are for that shift.

Per-token pricing was the best thing to happen to enterprises looking to experiment with artificial intelligence, but it may be the worst thing for AI in production.

That’s the quandary at the center of a new Futurum report, “The Off Ramp From Per-Token Pricing,” sponsored by neocloud provider QumulusAI Inc. The report’s key finding is that agentic AI can drive token consumption per task 10 to 100 times higher than a simple inference call. Agentic AI being more expensive is likely no surprise, but it’s good to see the report quantify it.

This is a real problem I have heard from chief information officers and chief financial officers over and over with increasing frequency. The most successful AI projects end up costing the most, often with budget estimates way off. I spoke with one organization that budgeted $1 million for the year, and the initiative was so successful they spent it in three months.

Usage pricing punishes success

The appeal of per-token pricing is obvious. A developer can call an application programming interface and have a working prototype by the afternoon, without any capacity planning or procurement cycle. The problem is that the meter doesn’t distinguish between a pilot and a production system serving 20,000 employees, and agents are token machines. A chatbot answers a question. An agent plans, calls tools, checks its work, retries, hands off and summarizes, generating tokens at each step.

Futurum forecasts that agent and reasoning inference will grow by 219% this year, and total inference spending will rise from $120 billion in 2025 to $885 billion by 2030. Put those numbers next to a pricing model that scales linearly with consumption, and the result is a budget line that grows faster than the value it creates.

Mazda Marvasti, co-founder and chief executive of Amberd.ai, described the pattern in the report. “When they start deploying it throughout the organization, the cost starts skyrocketing because it’s a useful tool that somebody built, but it’s now priced on a variable basis,” he said. “It starts getting the attention of the CFO and the CIO in terms of how much I’m exactly spending to run this tool, and whether it’s worth it.”

That captures the overlooked part of this story. The risk isn’t just a high bill; it’s that unpredictable bills kill useful projects. Marvasti noted that some customers abandoned internally built automation tools because they couldn’t forecast or justify the costs. That’s a governance failure disguised as a pricing problem, and it will slow AI adoption more than any model limitation.

Enterprises have already voted with their capacity

A more interesting data point is that the market has quietly moved beyond the “everything in the public cloud” assumption. According to Futurum’s survey of 824 AI decision-makers, reserved and owned infrastructure account for 66% of AI compute consumption, compared with 19% for on-demand cloud. Some 59% of respondents primarily run AI workloads outside hyperscaler public clouds, in their own data centers, colocation facilities, or with bare-metal providers.

I’d caution against interpreting this as enterprises moving away from the hyperscalers. Much of that owned capacity reflects GPU purchases made when on-demand capacity simply wasn’t available. But it shows enterprises are comfortable making capacity commitments for AI, and the question is no longer whether to commit, but which workloads justify such commitments.

This mirrors the adoption cycle information technology went through with the cloud. Start on demand, discover that steady-state workloads are cheaper on reserved capacity, and end up hybrid. AI is compressing that curve from years to quarters, and agents are the accelerant.

The real economics are about utilization, not price

One of the more interesting sections of the report is Amberd.ai’s deployment on QumulusAI bare metal. The company partitions an eight-GPU Nvidia H200 server into four virtual environments, each with two GPUs, and tiers customers across them based on latency tolerance.

“With one 8x H200 server, two customers pay for the entire server, and I can probably have about 30 to 35 customers running on that one server,” Marvasti said. “After the second customer, the server is free to me, and any customer that comes after that is profit.” Though those data points are compelling, the lesson isn’t that bare metal is cheap. It’s that Amberd.ai built a custom virtualization layer and tiered pricing to drive utilization. Reserved infrastructure turns a variable cost into a fixed one, and fixed costs only pay off when kept busy. An idle reserved GPU is the most expensive GPU there is.

Futurum’s guidance supports this, recommending reserved bare metal for sustained workloads with predictable utilization above roughly 60%. The report also acknowledges that these environments “require more custom engineering, limiting the operating margin gains for teams without the hardware expertise.”

That caveat deserves more attention than it receives. Most enterprises lack deep bench strength in serving engines, batching, quantization and key-value cache management. Without it, the offramp can lead to a different kind of cost overrun.

The model question the report doesn’t answer

The offramp works well for open-weight models a company can deploy on infrastructure it controls, which is why Amberd.ai built on private, open-source large language models. But many enterprises have standardized on frontier models available only through their developers’ application programming interfaces or hyperscaler marketplaces. For those workloads, no bare-metal alternative exists, so the pricing lever rests with the model provider.

That makes the reserved-versus-per-token decision a model-strategy decision first. Open-weight models are gaining momentum and are increasingly good enough for classification, extraction, summarization and many agent subtasks. The companies with the most leverage will route work to the cheapest model that does the job well, then run it on the cheapest infrastructure that runs reliably.

In the report, Brennen Smith, chief technology officer of Runpod, explained the importance for finance teams. “If you have a predictable workload, such as a well-defined business operation, a fixed lease contract is the way to go,” he said. “However, if it’s experimentation, scaling, or variable velocity, that’s when you need to go on demand. When talking to CFOs, I recommend budgeting for both.”

It’s the right answer, but a harder organizational change than it sounds, because it requires finance, infrastructure, and AI teams to share a view of workload behavior that most companies lack today.

What this means for buyers

Per-token pricing isn’t going away, and it shouldn’t. But treating it as the default for production AI is a mistake that agentic workloads will quickly reveal. My advice for IT and finance leaders:

• Measure cost per task, not cost per token. Agents change the unit of work. As agent complexity grows, track the cost to resolve a ticket or process a claim end to end.
• Set a graduation trigger. Define the utilization and volume thresholds that determine when a workload transitions from APIs to on-demand GPUs and then to reserved capacity. Futurum’s 60% baseline is a reasonable starting point.
• Be honest about operational skills. Reserved infrastructure only saves money if it stays busy. If that expertise isn’t in-house, factor in managed services before committing.
• Test open-weight models now. Every workload that can run on an open model can move off the meter.
• Negotiate for hardware cycles. Contracts should address upgrade paths, renewals, and portability so today’s commitment doesn’t become tomorrow’s stranded capacity.

The companies that win with agentic AI won’t necessarily be the ones with the best models. They’ll be the ones that figured out how to afford to run them at large scale.

For decades, the observability industry has answered one basic question: Is it running? Agentic artificial intelligence breaks that model. An agent can return a clean response, meet its latency target and throw no errors, yet still give a customer the wrong answer, call the wrong tool or pull from a stale knowledge base.

By every traditional metric, the system is healthy, but the only metric that matters to the business is that it failed. That’s the gap Amazon Web Services Inc. is targeting with Amazon CloudWatch Omni (pictured), which became generally available last week. AWS positions Omni as the next generation of CloudWatch.

It’s app-centric, runs outside the AWS Management Console, is built on OpenTelemetry and embeds AI. This shifts observability from “Is it running?” to “Why did my agent do that?” I’d argue that’s the question standing between most enterprises and production-scale agentic AI. AWS cites an IDC forecast of more than 1 billion deployed agents by 2029. No operations team can manually review that much nondeterministic behavior.

Here are five considerations for information technology and business leaders:

Evaluation is the new monitoring

The most important part of Omni isn’t the dashboards; it’s the evaluation engine. Omni captures every trace and ships with 17 built-in evaluators that score coherence, helpfulness, faithfulness and routing correctness, among other metrics. Teams can compare prompt versions in a playground, build test datasets from production traffic, and automatically catch regressions. Evaluators can also run continuously against live traffic, so quality drift is flagged the same way a CPU spike would be. Latency and error rates can’t tell you whether an answer was right, but scoring can.

Sony is an early adopter. “At Sony, our enterprise-wide agentic AI platform now supports hundreds of proof-of-concept and production workloads,” said Masahiro Oba, senior general manager of the AI Acceleration Division at Sony. “At this scale, observability and evaluation are essential. With Amazon CloudWatch Omni, I can go from a single trace directly to evaluation, AI analysis, comparison or dataset creation.”

The key word in that statement is “hundreds.” Most companies I talk to aren’t stuck on building a single agent. They’re stuck on governing dozens or hundreds, each built by a different team with a different idea of what “good” looks like. Oba also noted that assembling evaluation datasets is often a business-side bottleneck, and that one-click dataset creation from live traces removes that bottleneck.

Getting out of the console is a bigger deal than it sounds

Developers get a native extension for Visual Studio Code, Cursor and Kiro, where traces appear as they run an agent locally, with no AWS account required. Operators get a standalone web experience with single sign-on via existing identity providers such as Okta and Microsoft Entra ID. Both share a single data layer, so the trace a developer debugs is the same one an operator investigates.

AWS acknowledges that its console is built for infrastructure administrators, not for the site reliability engineers, AI engineers and application owners who now carry operational responsibility. Meeting developers in the integrated development environment, where AI coding assistants such as Claude Code and Codex can set up instrumentation, shifts quality work to the point where problems are cheapest to fix.

The unified data layer is the real differentiator

Many startups can trace large language model calls. What’s interesting about Omni is that agent traces, application telemetry and infrastructure signals all live in the same CloudWatch data store. As a result, an investigation can start with an agent receiving a bad tool result, move to an application programming interface error from a capacity-limited service, and end with an exhausted database connection pool.

In most shops today, that’s three tools, three teams and a lot of meetings to connect the dots. AWS DevOps Agent is enabled by default in investigation sessions, correlating signals and maintaining a full investigation history.

Capital One was a design partner. “Capital One operates one of the largest observability footprints in financial services,” said Parvez Naqvi, managing vice president of cloud platform and resilience engineering at Capital One. “As a design partner for Amazon CloudWatch Omni, we helped shape a single AI-powered observability solution that will give our engineers topology-aware intelligence and natural-language querying across all telemetry from a single surface, with full data ownership through OpenTelemetry.”

For heavily regulated industries, such as banking, data portability is critical to success, and that requires data ownership. Captured investigation history is also underrated, since in regulated industries it’s audit evidence of how an AI incident was handled.

Open standards lower the lock-in bar but don’t eliminate it

Instrumentation runs on OpenInference and the AWS Distro for OpenTelemetry, whether agents run on AWS or in other clouds. Omni supports LangChain, LangGraph, CrewAI, the OpenAI Agents SDK, Strands and the Vercel AI SDK, as well as third-party evaluators such as DeepEval. Amazon Bedrock AgentCore agents receive Omni automatically. Azure ingestion is supported today, with deeper multicloud coverage coming.

That openness is necessary in a crowded field. Datadog, Dynatrace, New Relic, Grafana Labs and Splunk are all expanding into agent observability, as are large language model-focused tools such as LangSmith and Arize AI.

OpenTelemetry makes the data portable, but the intelligence layer isn’t. The topology, evaluators, investigation history and DevOps Agent all run on AWS. Companies already heavily invested in AWS will see Omni as the natural default. Those running mature Datadog or Splunk estates across multiple clouds will likely use it for agent development and evaluation, while keeping their observability system of record where it is.

Pricing is built for adoption, so watch the telemetry bill

The IDE extension is free. Customers pay for the telemetry they send and store. Dashboards and alerts are free, and queries up to five times the monthly ingestion volume are included. Eligible accounts receive a 30-day trial and $1,000 in OpenTelemetry ingestion credits.

The catch is that agents are chatty. Every prompt, model call, tool invocation and sub-agent handoff generates a span. Multiply that across hundreds of workloads and continuous evaluation, and ingestion costs can outpace the AI budget that created them. DevOps Agent is also priced separately.

What this means for buyers

Omni is a comprehensive agent observability platform that addresses the trust gap that keeps agents in pilot mode. IT leaders should:

• Define “good” before you buy the evaluator. Built-in scoring only helps if your business owners have documented what a correct, compliant and helpful answer looks like for each agent. Most haven’t.
• Standardize instrumentation now. Put every agent pilot on OpenTelemetry, regardless of the backend. That keeps your options open and makes future platform decisions much easier.
• Model telemetry costs at production scale. Set policies for sampling, retention and evaluation frequency before agents go live, not after the first bill arrives.
• Decide where your system of record resides. If AWS is your primary cloud, Omni is a strong default choice. If you’re multicloud with an established observability platform, consider Omni for development and evaluation, and integrate it rather than replacing your existing setup.
• Treat investigation history as part of governance. Integrate Omni’s captured investigation trail into AI risk and compliance processes, especially in regulated industries.

The industry spent a decade learning to observe distributed systems. Agentic AI requires observing decisions, not just systems, and AWS aims to own that layer for its customers. The companies that get the most out of it will be those that treat evaluation as an operational discipline, not a feature to be switched on.