I attended the ServiceNow World Forum recently, and what struck me wasn't the technology on show. It was the collective admission that most organisations are investing heavily in AI while fundamentally under-investing in (both time and money) the conditions that make AI valuable.
The Spend Paradox: AI needs an operating model, not just a deployment plan.
“110% growth in AI spend. Against 9% growth in automated workflow adoption”.
That is not a technology problem. That is a strategy problem.
Organisations are burning tokens on simple tasks, adding cost, adding risk, and in some cases creating entirely new security exposures all while the underlying operational architecture remains fragile. You cannot retrofit governance onto a system that was never designed to be governed. And yet that is precisely what most organisations are attempting to do.
Governance Before You Build – moving to Shift Zero
ServiceNow speakers often referred to Shift Zero - the idea that governance must be embedded by design, not bolted on after the fact to prevent vulnerabilities before they are identified.
This is not a new concept (vis-à-vis Zero Tolerance) but this is a meaningful departure from how most organisations have approached digital transformation. We are accustomed to building fast, learning fast and fixing the governance gaps later. With AI, that sequencing is dangerous.
“Closing the stable door after the horse has bolted”
One speaker made the point bluntly in the context of financial services:
only one in four organisations currently has governance in place for AI at scale. 24% of banks have effective AI testing and auditability. Meanwhile, shadow AI (tools and agents adopted without organisational oversight) is already inside the walls of most enterprises.
The better framing is that
governance is not a constraint on AI adoption. It is the accelerator.
- Define before you deploy
- Govern before you scale
- Certify continuously, not retrospectively
The CMDB Is not a Legacy Tool, but it shouldn’t be implemented carelessly.
If there was one operational theme I feared it would feel dated at this conference, it was the CMDB. I was wrong.
The Configuration Management Database emerged as perhaps the
most strategically important asset an organisation can invest in right now but sensibly.
Here is why: AI agents and real-time observability depends on knowing what you have, who owns it, how it connects, and what the blast radius is when something goes wrong.
Without that foundation, you are not running AI. You are running guesswork at scale.
“Don’t boil the Ocean.”
The organisations making the most progress were those that had moved from a reactive CMDB to a governed one; where every primary configuration classes for your
business critical services has defined operational and technical ownership built in. The
Ingest > Govern > Insight model was a simple but powerful frame. You cannot derive insight from data you have not yet chosen to trust.
The practical implication? Don't turn on discovery and hope for the best. Define what matters to your business before you start ingesting. Understand your critical services, your blast radius, and your dependencies. Then build outward.
The Attack Surface Is Not Growing Slowly
The security sessions carried a weight that went beyond the usual threat briefing cadence.
- 69% of tools operating within organisations are not sanctioned
- 40% of operational technology devices sit in environments without being formally recognised
The implication for leaders is direct: you are no longer working at human speed. Your threat landscape is compound and exponential. The architecture of your response needs to match that reality - and that means autonomous, rules-bound, continuously-discovering systems, with
“humans on the loop rather than in the loop.”
What This Means for Organisations
Strip away the product announcements and the session structures, and the signal from this conference was consistent:
The organisations that will realise genuine value from AI are not the ones moving fastest. They are the ones who have built the operational foundations that make speed safe.
That means:
- A governed data architecture - trusted, current, and purposefully maintained
- A living, lean CMDB - not a snapshot, but a continuously-discovered source of operational truth for your business critical services.
- AI governance embedded in design - not appended to deployment after the fact. Shift-left, Shift-zero.
- Security operations rebuilt for machine-speed response - with the autonomy and rules-based structure to match modern threat cadence.
“The window between a threat emerging and it needing to be contained is now measured in minutes and seconds - not days and weeks.”
The ones who skip that work are not moving faster. They are accumulating invisible debt that will surface at the worst possible moment.
The question is not whether your organisation will face that reckoning. It is whether you will be ready when it arrives.
If you are interested in a
free-to-attend networking event hosted by Airwalk Reply -bringing together industry peers for an open and interactive discussion on how AI is reshaping Service Management in practice - you can register
here.
