A self-improving IT-operations agent: it checks patches and backups, opens tickets, learns which alerts matter and asks before it changes anything
A professional-services firm of about 120 staff in two offices and a small cloud tenant, a leader in its segment.
Reviewed by Christopher Clayton, CEO
- Scale
- ~140 endpoints, 12 servers, 1 backup platform, 1 ticketing system, 1 agent, 2 approval tiers
- Engagement
- 4 months, read-only for the first six weeks
The challenge
The firm's small IT team received about 180 alerts a day from monitoring, backup and patch tools, and most were noise. A failed backup had once sat unseen for nine days because it looked like the rest. The team wanted routine checks done daily and consistently, and wanted the alert load to fall without hiding the one that mattered. Nobody wanted software that could patch or reboot a server on its own.
The firm's IT team was not short of data. It was short of attention. About 180 alerts a day came from monitoring, patching and backup tools, and a failed backup once went unnoticed for nine days because it looked like everything else. The team wanted routine checks done the same way every day, a falling alert count and a hard guarantee that software would not patch or reboot a server by itself.
The agent was read-only for the first six weeks. It read monitoring, patch and backup status and the ticket history, and wrote a daily summary that the team compared with its own view. Only then did it start doing work: daily checks written as explicit steps, each with evidence, covering patch compliance by device group, pending reboots, backup results and the age of the last successful restore test. When something was wrong, it opened a ticket with the device, the symptom, what it had already checked and a suggested next step.
Learning was the point, and it was bounded. For each alert type the agent tracked how often a person acted on it, and it proposed to merge, downgrade or silence the ones that never led to action. A lead approved each proposal, and alerts about backups or security tools could not be silenced automatically. Changes had two tiers: reading and ticketing ran on their own, while patching, rebooting, restarting a service or editing a backup job needed a named person to approve in the ticket, inside a maintenance window.
Four months in, about 25 alerts a day reached a person instead of 180, and a failed backup became a ticket by the next morning. The agent made no change to a server on its own. This illustrative case describes the pattern we use for operations: let the agent do the looking, the writing and the remembering, and keep a person in charge of every change.
What our team delivered
- A read-only first phase of six weeks: the agent read monitoring, patch and backup status and the ticket history and wrote a daily summary, so the team could compare it with what they saw themselves
- Daily checks written as explicit steps: patch compliance by device group, pending reboots, backup job results and the age of the last successful restore test, each with the evidence attached
- Tickets opened by the agent in the firm's ticketing system with the device, the symptom, what it already checked and a suggested next step, instead of a bare alert
- Alert learning: for each alert type the agent tracks how often a person acted on it, and proposes to merge, downgrade or silence the ones that never lead to action; a lead approves each proposal and anything involving backups or security tools is never silenced automatically
- Two approval tiers: reading and ticketing run on their own, while patching, rebooting, restarting a service or changing a backup job require a named person to approve in the ticket, with a maintenance window
- A monthly review of what the agent proposed, what was accepted and what it missed, and a one-page summary for the firm's insurance and audit questions
Result
Over four months the alerts reaching a person fell from about 180 a day to about 25, with every silenced alert type approved by a lead. A failed backup is now a ticket by the next morning, and restore-test age is visible on the daily summary. The agent made no change to any server on its own; every patch, reboot and job change went through a person's approval in the ticket. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
AI agent bot, standard
One bot for a task that crosses two systems or handles varied documents, with exception handling and a review queue for your team.
About 3 to 4 weeks
$5,900 per bot
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Show 3 more
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
Assessment report in 5 business days; plan draft in 15 business days
$5,400 per bundle, phishing simulation for 25 users
Microsoft Copilot and AI readiness
Before you turn Copilot on, find out what it will be able to see, and fix the permissions first.
Report within 8 business days
$2,400 per tenant
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Critical patches in days, not months
Distribution of days from vendor patch release to deployment for critical-severity CVEs, before and after a managed patching service. The dashed line marks two weeks: under CISA BOD 22-01, US federal agencies must remediate Known Exploited Vulnerabilities within two weeks for CVEs assigned in 2021 or later (six months for older ones). Private organisations are not bound by it, but it is a sensible benchmark. Illustrative figures.
Backup tiers: data lost versus time to recover
Recovery point objective (RPO) is how much recent data a restore loses; recovery time objective (RTO) is how long the restore takes. Faster tiers sit close to the production system and share its fate; slower tiers survive ransomware and site loss. The scale is logarithmic. Illustrative figures.
Three approval tiers for AI agents
Every action an agent can take falls into one of three tiers: it runs on its own, a named person approves it first, or a human always does it. The examples are illustrative; each firm draws its own lines during scoping.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.