E-Book
The Four Decisions: A 90-Day Leadership Playbook for Agentic ITOps
Take your enterprise to proactive, agentic operations in three months
0
Agentic AI is transforming modern enterprise IT operations
1
Why major IT incident management is the ideal starting point for agentic ITOps
2
The Four Decisions for laying the foundation for AI in major incident management
3
The 90-Day Plan to Agentic ITOps
4
The three-month check-in: What good looks like at day 90 of agentic ITOps
5
Agentic AI is the future of ITOps, and BigPanda powers that future
Agentic AI is transforming modern enterprise IT operations
Enterprises spend $250 billion annually on manual, human-driven IT operations, and it doesn’t scale.
Every year, IT environments grow more complex. Hybrid cloud, microservices, CI/CD, and relentless change put relentless pressure on IT teams. Now, coupled with AI development and coding at unprecedented volume, it will put the human teams that manage it all at the breaking point. But the way enterprises operate it all has barely changed, as organizations continue to simply route more alerts to more humans on more bridge calls. Attempting to scale operations by scaling headcount has hit its ceiling. The math no longer maths, and the people doing the work are being crushed under a mountain of manual tasks that never get them ahead of the problem.
Agentic ITOps changes the model. Agentic AI for IT operations integrates autonomous AI agents that detect, diagnose, respond to, and prevent infrastructure issues in a near-autonomous state. This represents a fundamental shift in how enterprises operate.
Agentic ITOps represents significant advancements over traditional artificial intelligence for IT Operations (AIOps) by incorporating autonomous decision-making and action. For the first time, enterprises can adopt AI to fix the broken model of human-driven IT operations. Agentic AI can provide the reasoning that previously required a person: seeing that something is broken, investigating what’s happening, deciding what to do, and taking action. And unlike human-driven operations, where institutional knowledge walks out the door with attrition, and every incident starts from scratch, AI agents can do the same work faster and more accurately. Each decision and action feeds the next, and knowledge deepens over time, making the system smarter with every incident.
The BigPanda Agentic ITOps platform covers the full incident lifecycle and is powered by a shared intelligence layer, the IT Knowledge Graph. Here’s what that makes possible.
“With the help of BigPanda, we reduced incidents by 69% and significantly improved IT operational efficiency.”
Predicting and preventing IT incidents. AI Incident Prevention analyzes every change request against your historical incident data, scores its risk, and hands your team clear, explainable mitigation steps, so your change advisory board approves with confidence instead of guessing. It also proactively identifies recurring problem areas based on historical incidents and root cause patterns across the environment, to prevent those incidents from happening again.
Automating L1 detection and response. The highest-volume, most repetitive tier of IT work becomes agentic. AI Detection and Response correlates signals across observability, service desk activity, and external dependencies, so every incident arrives with a unified summary and next-step recommendation. The BigPanda Agent can autonomously take action on that recommendation: routing the incident to the right team with full context, suppressing low-priority incidents, or executing runbook steps. This results in lower operational costs, fewer tickets, reduced MSP spend, and fewer errors and inconsistencies that lead to frequent escalations, re-escalations, and long MTTR.
Empowering L2, L3, and SRE teams with AI assistance. The BigPanda AI Incident Assistant automates response and investigation across the fragmented teams, tools, and operational knowledge that enterprise IT depends on. The moment something breaks, the right people and context are brought together, automating coordination and investigation so incidents are resolved faster and teams spend more time building rather than firefighting. Your teams can resolve major incidents faster, and senior engineers can focus on the strategic work they were hired to do.
This kind of transformation can feel daunting for IT organizations that have been mired in the same manual process-oriented environment for twenty years. That’s why we built this 90-day playbook. The reality is that most agentic AI pilots die of organizational neglect, not model quality. Research by MIT found that 95% of enterprise generative AI pilots fail to deliver their intended operational impact, but the failure is almost never due to the model. The production work that pilots skip, from integration, reliability engineering, governance, and the operating model, is where programs actually live or die.
No enterprise transforms everything at once, and those that try risk joining the 40%+ of agentic AI projects that Gartner predicts will be canceled by the end of 2027. The first 90 days of Agentic ITOps demand a use case that is high-value enough to matter to the business, contained enough to govern, and fast enough to prove value before pilot fatigue sets in.
Based on our experience with the world’s largest enterprises, that use case is major incident management. Major incident management is one of the most visible, manual, and error-prone pains in enterprise IT, and the AI Incident Assistant is built for it.
The rest of this ebook covers how you can get your organization started successfully with Agentic ITOps, including the four leadership decisions you’ll need to make and a 90-day plan for turning Agentic ITOps from ambition into an operating model.
“With the help of BigPanda, we reduced incidents by 69% and significantly improved IT operational efficiency.”
1.
Why major IT incident management is the ideal starting point for agentic ITOps
“Centralizing our operations with BigPanda allowed us to have a much earlier MTTD (mean time to detection), which gave us a head start to resolve operational incidents.”
It’s 2 am, and a Sev1 is underway. Dozens of SMEs have been pulled onto a bridge call, half of them unnecessarily. The incident commander goes around the horn: “Network team, are you up? Database team, how are you running?” Nobody has the full picture, so everyone is hunting. Responders reconstruct what happened rather than fix it. Leadership demands updates that pull engineers off the problem. The post-mortem won’t be written for three weeks.
This is the most expensive hour in IT. And at most enterprises, it plays out the same way every time.
Major incident management is where agentic AI’s value is most visible, and where trust must be earned most carefully. Gartner predicts that by 2029, 70% of enterprises will deploy agentic AI to operate their IT infrastructure, up from less than 5% in 2025. Gartner also predicts that over 40% of agentic AI projects will be canceled by the end of 2027, and S&P Global found that 42% of companies abandoned most of their AI initiatives in 2025, up from 17% the year before. These findings indicate that agentic AI in ITOps is both inevitable and essential, yet prone to failure. Major incidents raise the stakes in both directions: the value pool is bigger, and a single bad autonomous action during a Sev1 can end the program.
Most enterprises looking to solve this with agentic AI ask the wrong first question: “Which agent do we deploy?” The better question:
These aren’t four separate choices; they’re all part of the 90-day roadmap to success with Agentic ITOps. Scope determines where AI reasons, autonomy is earned per lifecycle stage, metrics are the promotion criteria for autonomy, and the change agent is the leader who moves the dial.
“Centralizing our operations with BigPanda allowed us to have a much earlier MTTD (mean time to detection), which gave us a head start to resolve operational incidents.”
2.
The Four Decisions for laying the foundation for AI in major incident management
Autonomy is a data problem before it’s a trust problem. Nowhere is this clearer than in a major incident, where the assistant’s credibility depends entirely on the quality of the context it brings.
An AI incident assistant is only as good as the context it receives. In a major incident, AI must answer in seconds: What changed? Who owns this service? What does the topology say about blast radius? How did we fix this last time? Who fixed it last time? Answering those questions requires unifying observability, change, CMDB, topology, ticketing data, and, critically for major incident management, the informal knowledge trapped in past bridge calls, incident channels, and post-mortems.
This is what the BigPanda IT Knowledge Graph was built for. It forms a living layer of organizational intelligence and memory, continuously ingests fragmented, messy, and informal inputs, and learns the relationships across them. Every major incident enriches it, so institutional knowledge stops walking out the door when senior responders leave. Response improves and recurrence drops, because the system remembers.
The BigPanda AI Incident Assistant analyzes the incident against the IT Knowledge Graph to investigate multiple hypotheses simultaneously, orchestrate responses across bridge calls and stakeholders, and automate coordination and reporting.
The Four Decisions framework for Agentic ITOps readiness
You cannot prove a day-90 win without a day-0 number. Before your pilot begins, your organization needs to capture:
The data investment pays for itself. Gartner found that organizations with successful AI initiatives invest up to four times more in foundational areas, such as data quality, governance, AI-ready people, and change management, than those with poor AI outcomes.
Self-assessment: Readiness for AI in major incident management
If you answered no to two or more, your first 30 days are your foundational phase, and that’s exactly what the 90-day plan is designed for.
Decision 1: Scope. Where do you let AI reason?
The question isn’t “should we use AI on major incidents?” Rather, it’s “which moments of the major incident lifecycle does AI own, assist, or observe?” The scope in major incident management is a lifecycle question, not a severity question. Every major IT incident has a response and investigation effort, and the AI Incident Assistant orchestrates across both:
-
Assembly
The moment an incident opens, the right channel stands up and the right responders get paged, without anyone stopping to figure out who needs to be looped in.
-
Investigation and remediation
Scanning recent changes, translating complex telemetry into plain-language insights, and surfacing similar past incidents and what fixed them so responders can troubleshoot in natural language instead of tool-hopping.
-
Communication
Responders get a live, current summary of what’s happening, while executives, support, and customers get simple, audience-appropriate updates, all without a person manually relaying status.
-
Documentation
The call transcript, root cause summary, and post-mortem are generated directly from the incident record, so nobody spends hours afterward reconstructing what happened.
With the AI Incident Assistant, incident investigation no longer requires time-consuming, manual digging. Instead, agents act in parallel across your entire enterprise knowledge base and automatically return the likely root cause.
Decision 2: Autonomy. How far can your AI act without a human in the loop?
Here’s the core insight most enterprises miss: in major incident management, autonomy advances by lifecycle stage, not just by incident category. The standard autonomy ladder still applies: Advisory → Supervised → Monitored → Autonomous → Self-improving. AI earns autonomy over coordination and knowledge work long before it earns autonomy over remediation.
As part of this decision, there are a few guidelines that your organization should remember. Automating the delivery of context is lower risk than automating a remediation path. If you get remediation wrong, you could cause further issues, so giving operators insights that they can take or leave is the lowest-risk approach.
Promotion is earned, not scheduled. Advance a stage only on sustained performance: assembly accuracy (right experts, first page), summary accuracy, comms approval-without-edit rate, human override rate, and success and rollback rates for any action.
Demotion is a feature. Your organization can build in circuit breakers per lifecycle stage. If override rates spike on comms drafts or paging accuracy dips, that stage automatically drops back a level. This is the mechanism that de-risks the entire program for a skeptical CIO.
Non-negotiable guardrails for the first 90 days: Approval workflows are built into incident-type templates, such as protocol-fit or not protocol-replacement. Every action is signed, traced, and reversible, and a full decision tree is logged for post-incident audit.
One stat makes these guardrails non-optional. Gartner predicts that by 2029, at least 70% of organizations with production agentic AI in infrastructure and operations will experience a material service, security, or cost incident linked in part to insufficient runtime controls. The promotion system and circuit breakers controls reduce risk and create a measurable path to safe adoption.
Decision checklist: Scope
Decision 3: Metrics. Which numbers go in your business review?
If everything is a KPI, nothing is. Your business review needs exactly three numbers that together tell the story of speed, cost, and trust in major incident transformation.
-
Speed
MTTR for major incidents (Sev1/Sev2) vs. baseline. The universal currency of ITOps, at its most expensive tier. Segment AI-assisted vs. unassisted majors to isolate the impact honestly. Supporting sub-metrics for the weekly ops review: MTTD, time-to-assemble, and time-to-first-stakeholder-update.
-
Cost
Bridge-call hours per major incident. This is the Major Incident Management-native capacity metric, tracking responders × duration and translating it into engineering hours returned and dollars saved. BigPanda customers have reduced bridge call costs by up to 74%, and this doesn’t take into account the post-mortem work hours reclaimed by auto-generation.
-
Trust
Human override rate on AI actions and drafts. This is the differentiated pick, and the one almost nobody puts in a business review, yet. Your organization should track the percentage of AI-drafted communications sent without edit, paging suggestions accepted, and summaries used as-is. A declining override rate represents earned trust in measurable form, and it’s the gating metric for Decision 2’s promotion system. This is what closes the loop between metrics and autonomy.
Beyond these key measurements, you should be tracking (and NOT tracking) a few things. The repeat major incident rate is the number that will eventually matters most, as it tracks the “AI that learns from every incident” story maturing from response to prevention. You should not waste time or effort tracking or reporting on vanity metrics such as alerts processed, agents deployed, unbaselined percentages, and blended MTTR that hides the AI-assisted delta.
Decision 4: The Change Agent. Who owns the shift from pilot to operating model?
In major incident management, the natural owner is obvious; so name them! The Major Incident Manager or Incident Commander function (or the head of IT operations who owns it) is the person who already owns the process that AI is transforming, already has war-room authority, and already answers for MTTR. They are the accountable operator, with an executive sponsor above them.
The Change Agent owns:
-
Phase exit criteria and go/no-go calls for each stage of the 90-day plan.
-
The autonomy promotion board, which reviews per-stage performance after every major incident and moving levels up or down.
-
Workflow codification, such as encoding existing comms, escalation, and approval protocols into incident-type templates, so AI fits into your operational process.
-
Role redefinition. Incident commanders shift from human routers and status-reporters to decision-makers supervising an AI partner; responders learn to interrogate the assistant in natural language.
-
The feedback loop. Post-incident review now includes “grade the assistant,” with corrections captured into the knowledge foundation (this is the flywheel).
-
The day-90 business case, and the scale/stop recommendation.
The people story is sharper in major incident management than anywhere else in IT. Incident commanders and senior SREs carry the institutional knowledge, and they need to hear early that the AI Incident Assistant captures and amplifies their expertise rather than replacing it. The payoff includes fewer 2 am bridge calls, fewer unnecessary pages, and post-mortems that write themselves. Change management is a trust program for humans, running in parallel with the trust program for agents.
Decision checklist: Metrics
3.
The 90-Day Plan to Agentic ITOps
“AI Incident Assistant speeds up MTTR and enhances mean time to knowledge, allowing a deeper understanding of impacts based on historical data and streamlining communication between teams.”
The table below is your road map to an operating plan. Each phase maps activities to the Four Decisions and ends in hard exit criteria. A major incident can occur on any day of the plan, and the phases define what the AI Incident Assistant is allowed to do during such an incident. Please note that your organization might move more quickly through these phases, depending on the complexity of your major incident management process, but what we have outlined below is typical of our Fortune® 500 clients.
“AI Incident Assistant speeds up MTTR and enhances mean time to knowledge, allowing a deeper understanding of impacts based on historical data and streamlining communication between teams.”
4.
The three-month check-in: What good looks like at day 90 of agentic ITOps
To bring this home, this is what success at 90 days of Agentic ITOps can look like.
One of our customers, a Fortune® 500 global hospitality enterprise, was two hours into a major incident, running the traditional playbook. Dozens of responders were on the bridge. The incident commander was going around the horn, “Network team, are you up? Database team, how are you running?” Everyone was hunting for information that no single individual had visibility into.
Then they turned the incident over to the AI Incident Assistant’s agentic swarm investigation. Multiple agents fanned out across their systems, collected evidence, reasoned over what they found, and went back out with follow-up queries informed by each other’s findings. Multi-agent collaboration works the problem the way a war room does, only at machine speed. The root cause surfaced in roughly fifteen minutes.
As a result, two hours of human hunting was cut down into fifteen minutes of agentic investigation.
And the investigation was only part of what was running. The bridge spun up automatically. Context from every connected system was assembled before responders arrived. The right experts were identified and pulled in based on historical context, not just on-call rotations. The call was transcribed live and stakeholder updates went out automatically, so leadership stayed informed without pulling engineers off the problem. And everything that was learned, from what happened, what was tried, to what worked, was documented and fed back into the IT Knowledge Graph. This way, the next similar incident starts from established knowledge, not from zero.
The honest definition of success at day 90 is not an autonomous war room. It’s an AI Incident Assistant that your teams trust with context, coordination, communications, and documentation on live majors. It also includes three numbers trending in the right direction, with “MTTR from hours to minutes” as the aspiration that makes this story credible, incident commanders who would fight to keep it, and a defensible scale-or-stop decision.
Here’s why it was achievable in 90 days. Our customer didn’t have to rip anything out or re-platform. The AI Incident Assistant works within the tools your teams already use, including Microsoft Teams and ServiceNow, and requires no cross-team rule-building campaign. Unlike detection-side transformations, which require data onboarding, rule creation, and alignment across teams that don’t communicate, the major incident use case only needs access to context. Rather than restructuring your processes, it brings consistency, knowledge, and speed to the process you already run. That’s precisely what makes major incident management the right first-90-days beachhead; well-defined scope, highest-value process, minimal change-management surface.
5.
Agentic AI is the future of ITOps, and BigPanda powers that future
“By delivering scalable, enterprise-ready AI that integrates seamlessly into existing environments, BigPanda enables a fundamental shift in how organizations manage IT operations towards greater confidence, control, and agility.”
The BigPanda Agentic ITOps platform transforms how enterprises detect, respond to, and prevent incidents. Agentic ITOps represents a new paradigm in which technology works alongside humans to scale IT capacity to meet the speed, complexity, and demands of modern enterprise IT environments.
Whether your enterprise lands in the cohort that transforms or the cohort that stalls is decided in the first 90 days. Make the four decisions, run the plan, and let the AI Incident Assistant earn its place in your war room, one major incident at a time. Your enterprise can start unlocking these capabilities today with a progressive, phased approach. Agentic ITOps unlocks value in phases and reduces adoption friction. Once you implement the AI Incident Assistant, you can continue to add capabilities so your enterprise can respond to and prevent IT incidents at machine speed, improving operational efficiency and delivering exceptional service reliability.
“By delivering scalable, enterprise-ready AI that integrates seamlessly into existing environments, BigPanda enables a fundamental shift in how organizations manage IT operations towards greater confidence, control, and agility.”
DEMO
See the BigPanda Agentic ITOps platform in action
Agentic AI transforms how enterprises detect, respond to, and prevent incidents.
