This week at a glance
The market moved from whether agents will run the network to how agents will be paid for. Gartner predicts that half of organisations will run IT operations agents with minimal human involvement by 2030, up from almost none today. It also warned that buyers on uncapped, token-metered agent pricing will overrun their cost expectations by more than 50% through 2027, compared with buyers on subscription or bundled pricing. In the same week Extreme told investors its next agent will be metered by “agent actions” sold in token tranches, and ServiceNow lost 27% of its market value in a day as investors questioned how seat-priced software holds up once agents do the work. Pricing is now a competitive weapon in this category, in both directions.
The platform incumbents spent the week tightening their hold on the operations console and the channel. Cisco’s Partner Summit paid partners to run Cisco IQ as their own branded service and gave them early access to Cisco’s networking models through Model Foundry. It also announced MCP servers for its networking platforms and bundled ThousandEyes testing into access-point licences at no extra cost. HPE folded its EdgeConnect SD-WAN and SASE into Mist and Aruba Central, putting branch security in front of the network operations team. Extreme, for its part, told analysts that Cisco’s bundling and HPE’s Juniper integration are creating openings for it.
On demand, TechTarget’s second look at the Cisco/Omdia and EMA surveys found buyers expect to move fast. The share using agents to fix problems is set to double from 18% to 36% within two years, but 56% still want a human to approve before an agent acts. The specialists are selling to that gap. Itential and Gluware pitched autonomy that agents earn one task at a time, and Forward Networks extended its network model into security exposure as Gartner’s NOC/SOC forecast gives network vendors a reason to sell to the security budget. For an enterprise NetOps vendor, the week’s message is that buyers want predictable pricing, a role for the security team and proof that agents act safely before they are given more control.
On our watch list
- Who answers Gartner’s pricing warning first. Gartner says token-metered agent pricing overruns budgets by more than 50% versus subscription or bundles. Watch whether rivals respond to Extreme’s metered Operator with capped or bundled agent pricing, and whether buyers start writing token caps into contracts.
- Extreme’s first Operator invoices. Operator rolls out through the first quarter of 2027, sold in token tranches with no published prices yet. The first disclosed price points, and whether Operator lifts the 22% growth in SaaS ARR, will show whether customers will pay per agent action.
- Cisco’s fiscal first-quarter results, expected in mid-November. The date is not yet confirmed. Watch for partner-led software growth, Cisco IQ adoption beyond its 16,000 customers, any reaction to the November 7 price rises, and whether only 8% of the installed base on the new portfolio becomes a refresh story.
- Cisco’s networking MCP servers and Model Foundry. Model Foundry is with partners now and due for general availability in June 2027. Watch for MCP server dates and whether third-party operations vendors are allowed to use them on equal terms with Cisco’s own agents.
- HPE’s EdgeConnect integration dates. Mist support is due before the end of 2026 and Aruba Central in the first half of 2027. The test is the unified policy model, still on the roadmap, and whether HPE wins security buyers rather than only network buyers.
- ServiceNow’s fourth quarter. It guided current remaining performance obligations to slow to 18.5% growth from 20.5% and raised its AI contract target to $1.7 billion. A miss would add pressure on every vendor that sells into the NOC per seat or per user.
- The first named NOC/SOC mergers. Gartner puts merged operations centres at 5% of enterprises today and 25% by 2030, with more than 25% savings. Customer announcements, and vendors repositioning to sell to them, would confirm the trend.
- The share of buyers letting agents act. Cisco/Omdia respondents expect remediation by agents to rise from 18% to 36% within 24 months. Watch the next EMA and Omdia surveys for movement on the 56% who still want approval first.
- Cisco’s partner referral incentives next spring. Advisers and developers become eligible for referral pay. Watch whether consultancies and managed providers such as NTT Data begin specifying Cisco’s agentic stack by default.
- Customer proof from the specialists. Itential’s AI Skills and Forward’s Threat Exposure arrived without named enterprise customers or prices, and Forward gave no availability date. Named deployments would show whether specialists can hold the multi-vendor ground against the platform vendors.
Entities and connections across this week’s 25 tracked stories. Node size reflects how often an entity appears; line weight reflects how often two appear together.
View interactive topic map →
Article index
Market sizing & analyst view
Gartner put dates on the autonomous NOC: agents with minimal human involvement at half of organisations by 2030, a quarter of enterprises merging NOC and SOC, and budget overruns for buyers on token-metered pricing. TechTarget’s survey data shows buyers expect to move fast but want sign-off first. One analyst column and one buyer’s guide set out who buyers are shortlisting.
Competitive moves: Cisco and its channel
Cisco’s Partner Summit paid partners for influence, managed services and cross-selling, gave them Cisco IQ to resell under their own brand and early access to Cisco’s networking models. It also added MCP servers, task-scoped access for agents built with Teleport, and ThousandEyes testing bundled into access points. NTT Data is building Cisco’s agentic platform into its own services.
Competitive moves: HPE and Extreme
HPE is putting SD-WAN and SASE inside the consoles its network teams already use, and still claims to be the only vendor delivering self-driving networks. Extreme’s Agent ONE Operator acts within limits engineers set, and it is the first network agent here sold by metered usage.
Pricing and the investor view
Extreme told investors that half its subscription bookings now come through Platform ONE and that agent actions will be its next revenue line. ServiceNow’s 27% one-day fall shows how quickly investors mark down software companies they think agents could disrupt.
Specialists and multi-vendor platforms
Itential made its automation usable from AI coding tools, and its Lumen case study puts a dollar figure on automation that agents can call. Forward is taking its network model into security exposure. EMA published an impact brief on NetBrain’s platform expansion.
The NOC operating model: trust, telemetry and the security team
Vendor authors agree that autonomy is earned one action at a time, that agents need a reliable model of the network before they act, and that NetOps teams need to speak the security team’s language as the two operations centres converge.
| Article |
Source |
Published |
| 18. Autonomous Network Operations: How Agents Earn the Right to Act (foundational, Itential-authored) |
Itential |
Oct 26, 2026 |
| 17. Gluware’s Agentic Framework Earns Trust One Step at a Time (foundational, Gluware-authored) |
Gluware |
Oct 12, 2026 |
| 25. Beyond the Buzzwords: From Observability and AIOps to the Governed Operating Model, Autonomous IT (foundational, LogicMonitor-authored) |
LogicMonitor |
Oct 30, 2026 |
| 23. Why Do AI Agents Need Network Observability Before They Act? (foundational, Equinix-authored) |
Equinix |
Oct 28, 2026 |
| 20. On AI and autonomous networks: Sceptics and believers make the same mistake (foundational, Celfocus-authored) |
Mobile Europe |
Oct 27, 2026 |
| 21. Key security concepts NetOps must understand to proactively support SecOps (foundational, BackBox-authored) |
Network World |
Oct 27, 2026 |
| 24. DDI for AI-driven Operations (foundational, EfficientIP-authored) |
EfficientIP |
Oct 29, 2026 |
Detailed write-ups
1. Gartner puts dates on the autonomous NOC, and a warning on agent pricing
Gartner · October 26, 2026
Gartner’s top AI trends for infrastructure and operations in 2027 put dates on the market this category is selling into. By 2030, it predicts, 50% of organisations will use AI agents with minimal human involvement in IT operations, up from almost none in 2026. The tasks it names are incident triage, change validation and remediation. “Heads of I&O who fail to restructure their organization around agentic AI risk higher costs, poor operational agility and performance, and ultimately, irrelevance,” said VP analyst Jonathan Forest, describing a move from humans in every step to humans overseeing the loop.
Two of the predictions bear directly on how vendors sell. First, through 2027, enterprises running operations agents on uncapped pricing tied to token usage will exceed their initial cost expectations by more than 50%, compared with those on predictable subscription or bundled pricing. Gartner’s advice to buyers is a strict “no telemetry, no deployment” rule. Second, it expects 25% of enterprises to merge their network and security operations centres by 2030, up from 5% in 2026, and to cut combined tooling and staff spend by more than a quarter as a result. A Gartner survey of 272 heads of I&O found 58% rank scaling AI pilots as a priority for the next year.
For vendors, the pricing call is the most immediate. Gartner will be advising buyers to favour predictable pricing in the same quarter that Extreme moves its acting agent to metered tokens, which gives vendors with subscription or bundled agent pricing a ready argument in competitive deals. The NOC/SOC forecast widens who signs the purchase order: network operations vendors that can show value to the security team stand to gain from that consolidation, and those that cannot may lose seats to it.
Sources: Gartner (Gartner Identifies the Top AI Trends in Infrastructure and IT Operations for 2027)
2. Buyers expect agents to take over fast, but most still want to sign off first
TechTarget · October 27, 2026
TechTarget’s second piece on autonomous network operations looks forward, and the demand signal is strong. In Cisco’s survey of 1,000 IT and NetOps leaders, run by Omdia, 84% expect to reach an AI-led operating model within 12 months and 85% expect agents to handle most operational tasks within five years. Today 18% use agents to fix problems; 36% expect to within two years, with similar gains expected across 14 other tasks from troubleshooting to capacity planning. The average organisation fields about 4,100 monitoring alerts a day, half of them network-related. “This is no longer a staffing problem that better recruiting can solve,” the report says.
Buyers still want control. 56% prefer a person to approve before AI acts, against 24% who favour full autonomy, even though 82% would let AI make some production changes, such as rerouting traffic, without asking. Business leaders with budget influence are more likely than engineers to see AI as an insights tool rather than something that acts. EMA’s Shamus McGillicuddy called Cisco’s view more aggressive than his own, and EMA’s survey found 26% say fragmented monitoring data severely limits AI. “If we are able to define QA criteria well enough for a human being, we can also do it for agents,” said Sune Tornbo Baastrup, CIO of Danfoss.
Buyers have set the direction and the order of steps: agents that recommend now, agents that act once they have proved themselves, with a human approval step in between. Vendors that make approval quick and well documented can sell into that middle stage now, rather than waiting for buyers to accept full autonomy. Cisco sponsored the survey and Omdia belongs to the same group as TechTarget, but EMA’s independent data points the same way.
Sources: TechTarget (Agentic network operations set to surge amid AI tsunami)
3. Extreme starts charging for agent actions and goes after Cisco and HPE accounts
Yahoo Finance · Packet Pushers · October 28, 2026
Extreme Networks reported fiscal first-quarter revenue growth of 10%, SaaS annual recurring revenue up 22% to $265 million, and operating margin up 4.1 points. It raised full-year guidance to 10% growth. Platform ONE now accounts for more than half of subscription bookings, nearly every new customer takes it, and Extreme expects more than half its customer base on the platform by the end of the fiscal year, up from 10% a year ago. Management called this year a transition and promised a “sharp reacceleration” in recurring revenue in fiscal 2028.
The new element is how Extreme plans to make money from agents. Its Coworker assistant stays inside the base subscription, but Operator mode, the agent that acts without being asked, is metered. Packet Pushers reports customers buy tranches of tokens and are warned when a task may exhaust them. Operator works only within limits set by engineers and Extreme’s governance rules, starts with reporting jobs such as weekly vulnerability checks and firmware audits, and confirms scope and timing with an engineer before it runs. It rolls out through the first quarter of 2027. On the call, management spoke of “Cisco fatigue” with Cisco’s complex bundles and called the disruption from HPE’s Juniper integration a “multiyear opportunity.”
Extreme is the first vendor in this category to put a usage meter on an acting agent, in the same week Gartner warned that metered agent pricing overruns budgets. That leaves an opening for rivals with predictable pricing. The figures are from an earnings-call summary and the Packet Pushers trip was partly funded by Extreme. Packet Pushers’ own conclusion is that Cisco, HPE and Extreme are building agents around their own hardware, which leaves the multi-vendor estate to specialists.
Sources: Yahoo Finance (Extreme Networks, Inc. Q1 2027 Earnings Call Summary) · Packet Pushers (Extreme Networks Adds Autonomous AI with Agent ONE Operator)
4. Cisco makes its partners the delivery channel for agentic operations
SiliconANGLE · Network World · CRN · October 26–27, 2026
At its Partner Summit in Vancouver, Cisco changed what partners are paid for. A new deal registration programme credits advisers and developers who influence a sale without closing it; Cisco cited Omdia research that buyers involve six or seven partners before purchasing. Cisco IQ, its installed-base and support platform with more than 16,000 customers and nearly 20 million devices, is now generally available for partners to run under their own brand, with a $2,500 incentive per onboarded customer and a $1 million prize for managed services built on it. CFO Mark Patterson added a 2% bonus for cross-selling newer lines including Splunk. Cisco is also adding 1,000 sellers and 120 partner sales executives, with seller pay tied to partner incentives. About 90% of Cisco bookings already flow through partners. “Cisco IQ is the engine. Partners are the business,” said Liz Centoni, chief customer experience officer.
The product announcements were aimed at agents. Model Foundry, a service in Cisco Cloud Control, lets partners fine-tune and run Cisco’s networking models on customer data; general availability is planned for June 2027. Cisco will add MCP servers to its networking platforms so outside agents can read live network data, and ThousandEyes testing is now included in eligible access points at no extra cost. Its Privileged Infrastructure Access, built with Teleport, in which Cisco became the largest strategic investor in August, gives people and agents device access that expires when the task ends. Separately, NTT Data is building Cisco Cloud Control into its own services. “Cisco creates the intelligence, and NTT Data industrializes this intelligence at scale,” said NTT Data’s Dilip Kumar.
Cisco is using its channel to bring agentic operations into its installed base: partners get paid to run Cisco’s console as a managed service and to build agents on Cisco’s own models. Bundling ThousandEyes for free also raises the price pressure on standalone assurance tools. The opening for others is the MCP servers. If Cisco opens its devices to any agent, multi-vendor operations vendors gain a standard way in. Only 8% of Cisco’s installed base has moved to its new enterprise portfolio, so the refresh cycle still has a long way to run.
Sources: SiliconANGLE (Cisco Partner Summit: Five insights that will define the channel in the AI era) · Network World (Cisco taps AI, partners to modernize IT operations and fortify network security) · Network World (Cisco’s partner shift: What customers should expect from their Cisco partner in the AI era) · SiliconANGLE (Cisco’s Privileged Infrastructure Access ties admin and AI agent privileges to the task) · CRN (NTT Data Expands AI Factories With Cisco To Take Enterprise AI From Pilot To Production: Exclusive)
5. HPE pulls SASE into its self-driving consoles and bets on the network team
CRN · Futurum · October 27–28, 2026
HPE is folding EdgeConnect, its SD-WAN and SASE product, into both of its network management consoles: Mist before the end of 2026 and Aruba Central in the first half of 2027. Existing EdgeConnect customers can bring their appliances into either console and gain HPE’s Marvis AI. Mist and Central customers gain SD-WAN and cloud security features. EdgeConnect data now feeds the Mist data lake, so network and security teams share one view across wired, wireless, firewall and SASE. “We are at a point where we call one brain, two bodies,” said HPE’s Mittal Parekh, describing Marvis serving both consoles. CRN frames the move as aimed at Cisco, and Parekh repeated HPE’s claim to be “the only vendor delivering self-driving networks.”
Futurum’s Fernando Montenegro called it a bet that branch security will be bought and run by network operations. “HPE is betting on the network operations team,” he wrote. He describes three camps competing for the converged branch: networking vendors, security vendors moving into networking, and cloud SASE specialists. ETR spending data shows HPE’s networking lines ahead of their sector, but Juniper’s security line well behind it. Security policy is still written in a separate EdgeConnect tool; a single policy model across domains remains on HPE’s roadmap.
The move lines HPE up with Gartner’s NOC/SOC forecast by bringing security data into the network console. It also makes HPE’s console harder to replace in branch estates. Whether security buyers accept it depends on the unified policy model, and until that ships HPE is selling to the network team.
Sources: CRN (HPE Adds SD-WAN To Self-Driving Network Vision In Latest Aruba-Mist Integration Move) · Futurum (HPE Brings SASE Into Its Network Consoles)
6. ServiceNow’s worst trading day shows investor doubts about seat-priced software
CNBC · October 29, 2026
ServiceNow shares fell 27% on October 29, their worst day on record, after third-quarter results that met expectations without the usual beat. Revenue rose about 20% to $4.11 billion, in line with forecasts, while adjusted earnings of $1.00 a share came in two cents short. The company nudged up its full-year subscription outlook to $15.78–15.79 billion, net new AI contract value rose 65%, and it raised its year-end AI contract-value target to $1.7 billion. Citi’s Tyler Radke said investors wanted faster returns from the new engineering team ServiceNow embeds in customers to build AI. “This was a little bit uncharacteristic for ServiceNow standards, just in terms of the lack of upside,” he told CNBC.
CNBC tied the reaction to the “SaaSpocalypse” fear that AI agents will erode traditional software pricing. Later accounts put the stock down about a third over the week, far worse than the wider software index, even as ServiceNow reported agent usage up thirteen-fold and an expanded OpenAI partnership.
ServiceNow runs ticketing and workflow in many enterprise NOCs, so its share price is a reference point for how investors value operations software. The sell-off shows that strong AI adoption figures are not enough on their own: investors want to see how AI revenue replaces per-seat revenue. That pressure will reach any NetOps vendor priced per user or per seat. Together with Gartner’s warning on token pricing and Extreme’s move to metered agent actions, it shows a category still working out how to charge for agents.
Sources: CNBC (ServiceNow shares plunge 27% to worst day ever after earnings revive AI disruption fears)
7. Specialists sell earned autonomy, and a route in through AI coding tools
Futuriom · Itential · Gluware · October 12–27, 2026
Itential launched AI Skills, a set of open-source tools that let engineers build, run and administer network automation from the AI coding tools they already use: Claude Code, Codex, GitHub Copilot and Cursor. There are three skill packs (Builder, Operator and Admin), and permissions come from the user’s existing Itential account. Futuriom’s Scott Raynovich compared it with Cisco’s Cloud Control Studio and Selector’s Foundry, noting that Itential is “headless”: customers can embed it in their own tools rather than adopt a vendor console. “Agentic development is changing how software gets built,” said CTO Chris Wade. Futuriom reported no customers or pricing.
The specialists also set out how agents should gain authority. Itential’s model gives each action one of four permission states, from observe to execute within policy. It cites Lumen, where an engineer approved one remediation more than 100 times without a defect before removing the approval step, and argues that “autonomy is not a level a network reaches.” Gluware describes the same staged path through its Titan products, from building automation to read-only exposure analysis to validated remediation: “Every change to the network runs through a proven, validated process, never an agent’s best guess.”
The specialists are competing on two fronts the platform vendors handle less well: working across vendors, and working inside tools engineers already use. Their trust model matches what buyers told Omdia: approval first, autonomy task by task. These are vendor posts without named enterprise customers, and the Lumen figures are self-reported by a carrier, so they show the specialists’ positioning more than buyer adoption.
Sources: Futuriom (Itential Launches AI Skills Platform) · Itential (Autonomous Network Operations: How Agents Earn the Right to Act) · Gluware (Gluware’s Agentic Framework Earns Trust One Step at a Time)
8. Forward takes its network model into the security budget
Forward Networks · Network World · October 27–29, 2026
Forward Networks previewed Forward Threat Exposure, which uses its model of a customer’s network across on-premises and four public clouds to map every path an attacker could take to critical systems. It shows which vulnerabilities are reachable from untrusted networks, scores them by reachability, severity and business importance, and identifies the device and rule where each path can be closed before a patch is available. Collection is read-only and no test traffic is sent. “Protecting critical assets starts with knowing which paths an attacker could use to reach them,” wrote Forward’s Manish Kalra. The product was shown at Security Field Day; Forward gave no availability date or named customers.
A Network World piece by Richard Phillips of BackBox made the same point from the buyer’s side. Security leaders’ blind spots on network devices are sending more requests to network teams, he argued, so NetOps needs to understand zero trust, least privilege, patching, vulnerability management and governance of autonomous AI to work effectively with security operations.
Forward is reusing the network model it already sells to NetOps to compete for exposure-management budget, which security vendors currently hold. That fits Gartner’s forecast of merged NOCs and SOCs and HPE’s move to put security data into network consoles. A network vendor whose model of the network also answers security questions has a stronger case when the two teams buy together. The product is still a preview.
Sources: Forward Networks (Forward Threat Exposure: Know What an Attacker Can Reach) · Network World (Key security concepts NetOps must understand to proactively support SecOps)
Calls to action
- Put a predictable-pricing offer in front of buyers now. Gartner is telling I&O leaders that token-metered agents overrun budgets by more than 50%, and Extreme has just metered its acting agent. A capped or bundled agent price is a ready competitive argument this quarter.
- Prepare a displacement play for disrupted accounts. Extreme is openly targeting Cisco customers tired of bundling and HPE customers unsettled by the Juniper integration. Identify those accounts in your own pipeline before Extreme does.
- Make your platform callable over MCP. Cisco is adding MCP servers to its networking platforms and ServiceNow has an MCP plugin in OpenAI’s marketplace. Make sure other vendors’ agents can call your analysis and actions, so you are not shut out of their workflows.
- Recruit the partners Cisco is now paying for influence and managed services. Offer them a multi-vendor managed service they can brand as their own, priced to compete with Cisco IQ’s $2,500-per-customer incentive.
- Build a security-team business case. With Gartner forecasting merged NOCs and SOCs and HPE and Forward courting security buyers, show what your platform answers for SecOps (reachable vulnerabilities, change risk, audit trails) and put it in front of the CISO as well as the network lead.
- Publish your earned-autonomy model with evidence. 56% of buyers want approval before agents act. Show how many approved runs a task needs before it goes autonomous, and publish customer approval and error rates.
|