2025-11-25 00:00:00
We are bringing together three concepts: Operational Resilience, Configuration Management and Agentic AI. In this article, we will:
Operational Resilience has become an imperative for many organisations, driven by increased regulation (DORA, Op Res, NIS2 etc.), geopolitical threat and greater access to powerful technologies.
In today’s interconnected organisational environments, delivering and assuring operational resilience spans multiple business units, functions and teams. This can be incredibly difficult to manage at the organisational level with silos of operation, disparate information, people and processes.
The challenge? Data is everywhere, but risk insight and the keys to better resilience decisions are often locked away in these silos.
This is where the right combination of a well-governed Configuration Management System (CMS) and Agentic AI can transform how you detect, assess and respond to resilience risk. Our view is that the CMS sits at the heart of Operational Resilience.
At the core of modern organisations, IT Service Management (ITSM) platforms like ServiceNow have the power to host the CMS (Configuration Management System), which serves as the authoritative map of your technology and business landscape, often formed of multiple CMDBs (Configuration Management Databases).
It knows:
For operational resilience, this is gold. When scenario planning, or when an incident occurs, you can instantly see which business services are impacted and trace upstream and downstream dependencies, something that would otherwise take hours or days.
Going one step further, beyond lines of seemingly meaningless data, tools like EMMa 3D now allow us to visualise our data landscapes and ‘see’ what was previously hidden, unlocking immediate, visual insight into our data value chains.
The CMS is only part of the story. Resilience decisions require accurate context and information, for example:
Integrating these disparate datasets into a unified data fabric allows you to transition from asset awareness to risk awareness.
Traditional reporting relies on pre-built dashboards and static queries. Agentic AI changes the game:
Instead of searching for data, you ask a question and AI orchestrates the queries, joins the dots and gives you an actionable answer in minutes, not days.
Agentic AI delivers evidence-backed answers directly from the data fabric, removing layers of human interpretation, however;
With these cautions in mind, integrated AI enables leaders to act on facts, not assumptions. This transparency builds resilience, even if it forces difficult conversations.
Regulation as a Driver of Resilience
Beyond operational efficiency, regulatory change is one of the biggest pressures facing organisations. New requirements often demand years of analysis and remediation just to understand where gaps exist. With Agentic AI, that work can be accelerated dramatically and maintained continuously. Imagine being able to ask your AI Engine a direct attestation question for the regulator, “Can you tell me when we last conducted recovery tests of our important business applications?” and being able to relay this in seconds.
This is more than operational efficiency; it’s risk intelligence at the speed of business.
Imagine you need to assess the liquidity risk position of all suppliers underpinning an Important Business Service (IBS), for example, your digital payments platform.
With CMDB: Identify all infrastructure, software and vendor services linked to the IBS. With integrated datasets: Pull supplier contract terms from contract management system and match supplier financial scores from third-party risk feeds
With Agentic AI: Ask: “Which suppliers for our payment platform have liquidity risk and are supporting our Payments IBS?”. AI autonomously queries across CMDB, contract data, EOL data and financial feeds producing a ranked risk report and suggested mitigations.
The Result: leadership can act immediately, renegotiating contracts, activating contingency suppliers or fast-tracking tech refresh before the business service is at risk. This shifts the human effort and investment to ‘solving the problem’, not ‘identifying it’!
Whilst the concepts discussed here are compelling, the reality for many is this might seem a long way off, or unrealistic. Most organisations are not yet ready to capitalise on Agentic AI. Data fragmentation, poor data quality or standardisation, lengthy governance and unclear ownership are common barriers.
Here are some practical steps on the road to our Agentic AI, data-led resilience vision:
Stage 1 - Data discovery and inventory: Define data points you need to make decisions; then go and find them! – In most organisations, the answers are there, but they are scattered, stale or hidden in pockets. Identify the gaps in your data inventory. What do you want to know but don’t currently have access to?
Stage 2 - Data quality and standardisation: Automate data discovery. If you haven't yet grappled with the question “do we trust automated data feeds?”, you need to be at a level of comfort with real-time feeds and ready to use them. Overreliance on manual data entry risks spoiling your data foundations. Establish common taxonomies (e.g., consistent naming for suppliers, assets, services) to establish your data lingua franca.
Stage 3 - Governance and ownership: Define who owns each dataset and who is accountable for keeping it current. Establish simple data stewardship practices (review cadence, data quality thresholds).
Stage 4 - Integration and mapping: Start linking core systems (CMDB, contract management, risk feeds) to enable cross-domain questionsCreate initial dependency maps between business services, suppliers and technology; even partial maps have value.
Stage 5 - Security and access control: Think of AI Agents like Users and implement role-based access so sensitive data (contracts, financial health, risk exposure) can be safely consumed by the Agent.
Stage 6 - Proof of Concept: Choose one high-impact scenario (e.g., “Which suppliers supporting our payments service have liquidity risk?”). Build a lightweight Agentic AI proof of concept that executes this question end-to-end. Use the PoC to both demonstrate value and reveal where further data readiness work is required.
Stage 7 - Incremental maturity: Build on PoCs and one-by-one start hooking in new data sets, sources and Agents to build out your observable world. Progress to semi-automated monitoring where AI agents flag anomalies for humans to validate.
Operational resilience is no longer about static disaster recovery and crisis management plans. It’s about dynamic, data-driven, AI-augmented decisions.
By combining the CMS as the single source of truth, integrated cross-domain data, and Agentic AI’s ability to think and act across it, organisations can move from reactive recovery to proactive resilience.