.webp)
The problem with today’s ITOM
Most managed service providers (MSPs) still rely heavily on static SOPs, legacy runbook automations, and traditional IT operations management software (ITOM software) such as ServiceNow or BMC Remedy. Despite decades of progress, IT teams are still chasing the dream of zero-touch IT operations - where alerts resolve themselves and engineers focus on innovation rather than tickets. With AI for Process, Kore.ai is bridging that gap by applying Agentic AI to modern ITOM workflows.
In a recent workshop with a major MSP, their ITOM was correlating 400+ alerts daily. Impressive visibility - but every one still flowed into ServiceNow for manual triage. That’s the gap we need to close.
The flow looks something like this:
1. Machine/Server failure: A server or endpoint experiences a performance or availability issue.
2. Monitoring tools: Alerts are generated by monitoring servers (CPU, memory, disk, network, etc.).
3. Event filtering/routing: Another system filters events, de-duplicates alerts, and assigns the correct category or tower.
4. Ticket creation: A ServiceNow or Remedy ticket is created and logged.
5. Runbook automation: Tickets are picked up by automation engines; runbooks attempt to remediate the issue by following pre-defined Standard Operating Procedures (SOPs).
6. Escalation: If runbooks fail, tickets are passed to an L1 engineer, who again follows SOPs step by step. If unresolved, the issue escalates to L2/L3 support.
Runbooks and SOPs enforce consistency. But they are static and brittle, often breaking when conditions vary outside predefined rules.
The result is:
1. Long MTTR (Mean Time to Resolution),
2. High Opex from manual escalations, and
3. A backlog of repetitive incidents that never truly go away.
From static ITOM software to dynamic, AI-driven IT operations management
Traditional ITOM software practices are limited by rigid SOPs, brittle runbooks, and manual escalations. The result is high cost, slow response, and frustrated engineers.
Agentic AI introduces a new model - one that reasons, learns, and evolves - dramatically shifting how incidents are managed.
Today (static ITOM):
1. Static SOPs: Rigid, manual updates and strict adherence.
2. Runbooks: Predefined scripts work only for predictable incidents.
3. False Positives: Fixed thresholds trigger unnecessary tickets.
4. Missed Alarms: Static rules fail to detect new or evolving patterns.
5. Heavy Human Load: L1 teams spend time on repetitive troubleshooting and manual decisions.
Tomorrow (AI-driven ITOM):
1. Dynamic SOP Prompts: Adaptive guidance that evolves with context.
2. Agentic Workflows: Real-time reasoning and orchestration across tools.
3. Automated Noise Filtering: Fewer false positives, more meaningful signals.
4. Proactive Pattern Detection: Recurring issues prevented before tickets are raised.
5. Human-in-the-Loop → Autonomy: Agents handle routine fixes, escalating only when judgment is needed, reducing ITSM reliance. Agents learn from human interventions and then take over autonomously once the same action has been repeated a few times.
6. Continuous Learning: Agents self-improve from outcomes and interventions.
From what we’ve seen across MSPs and large enterprises, today’s ITOM software stops at correlation.The next evolution, AI-driven ITOM, combines reasoning, learning, and orchestration across systems, moving organizations closer to zero-touch IT operations. Learn more about how this ties into AI-driven Process Automation with Kore.ai.
Real-world example: memory spike in windows servers
Take the memory spike demo we’ve built. Traditionally, when a server runs out of memory, the process looks like this: monitoring fires an alert, ITOM software correlates and routes it into ITSM, and a runbook or an L1 engineer manually clears zombie processes. If that doesn’t work, the ticket escalates, and someone restarts the service. It’s slow, reactive, and inconsistent.
With an AI agent integrated into your IT operations management platform, the workflow changes completely. Once the memory spike alert comes in, the Kore Agent doesn’t just repeat a static script — it learns from history. It checks past incidents on that server and sees that in about 30% of cases, killing zombie processes fixed the issue, so it tries that first. If usage is still high, it goes a step further: it looks for patterns. For example, if this is a banking application, the server may always spike on the last day of the month when payroll deposits hit and users check balances. In that scenario, the agent applies the resolution it has “seen” before — temporarily raising the memory threshold by 10% for a few hours — and reverts it once the surge passes.
If neither of those actions resolve the problem, the agent weighs the remaining history: more than half of similar tickets were ultimately fixed with a restart. At that point, it checks the CMDB: if this server is running a business-critical app, the agent takes an autonomous step to restart the service gracefully. If it’s not critical, it loops a human in — but with full context, showing the resolution options it considered and the success rates from previous incidents.
This approach doesn’t just close tickets faster. It builds confidence over time, because the agent is reasoning, planning, and reflecting — not just executing a playbook.
Impact:
1. In our early pilots, we’ve seen L1 load reductions of 60–90%, depending on ticket type, and MTTR comes down from hours to single-digit minutes for common infra issues like memory spikes.
2. Human effort shifts to higher-value problem solving.
The Business value
For MSPs and enterprises alike AI in ITSM is unlocking measurable business impact:
1. In some cases, customers have seen 90%+ L1 reduction and MTTR reduced from hours to minutes. Kore.ai’s AI Agent Platform makes this transformation faster and easier to operationalize.
2. Faster Time-to-Value: SOPs to agents in days, not weeks.
3. Cost Savings: Replace or shrink expensive ITSM footprints; up to 50% license savings when moving from ServiceNow to lighter ITSM platforms.
4. Coverage Expansion: Runbooks are cost-justified only for high-volume issues; agentic AI makes even “long-tail” tickets (<150/month) worth automating.
5. Customer Experience: Faster resolution = higher SLA compliance, fewer escalations, more resilient operations. Improved SLA compliance, better employee experience for IT staff, and faster resolution for end users.
The end state: achieving zero-touch ITOM with AI in ITSM
The ultimate goal is zero-touch operations:
1. 70-80% of incidents never become tickets.
2. Monitoring tools feed directly into AI agents.
3. Agents may begin to augment monitoring systems directly, reducing reliance on separate tooling
4. Agents reason, act, and learn continuously.
5. Humans focus only on exceptions, governance, and innovation.
As AI-driven ITOM matures, organizations will transition from ticket-centric to event-centric operations. Using Kore.ai’s AI for Process and its embedded observability features, enterprises can move toward continuous, AI-assisted IT operations where tickets exist only as audit trails, not as the backbone of operations.
This is not science fiction - with Agentic AI, it’s a 6–9 months achievable roadmap.
Zero-touch ITOM roadmap
Most enterprises can achieve tangible progress toward zero-touch operations within 6–9 months by following a phased roadmap:
Phase 1 – Integrate: Connect monitoring tools, ITSM, and automation systems to Kore.ai’s platform.
Phase 2 – Automate: Deploy Agentic AI for high-volume, repeatable incident types (memory spikes, disk alerts, database restarts).
Phase 3 – Observe & Learn: Use AI Observability and policy-based governance to refine automation outcomes.
Phase 4 – Scale: Expand to cross-domain use cases (network, application, cloud).
Why Kore.ai’s AI for Process?
In one of our pilots, we were able to translate a static runbook into a dynamic agent prompt in under two days - something that would have taken weeks otherwise. Kore.ai’s Agent platform is purpose-built for this transformation:
1. Multi-Agent Reasoning & Planning at Scale: Supervisor and Network (Delegation) model prevents agent sprawl and ensures harmony across monitoring tools, ITSM, and RPA.
2. Memory & Context Management: Short-term and long-term memory enable context persistence for smarter actions.
3. Speed to Build: SOPs → dynamic prompts in days, dramatically cutting automation development cycles. 4-6 weeks for new runbook automation vs. days with agentic prompts.
4. Observability & Governance: Explainability, audit trails, SLA tracking, policy enforcement
From what we’ve seen in the field, zero-touch ITOM is no longer aspirational - it’s a practical goal when powered by Agentic AI and AI in ITSM. Organizations that move first will redefine agility and efficiency in IT operations.
My view: the winners in IT operations will be the ones who can prove real zero-touch outcomes, not just dashboards, within the next 12–18 months.
