Agentic AI Is Making Enterprise Software a Control Layer

The “SaaS-pocalypse” argument treats AI agents as a direct substitute for enterprise software: if an agent can fix a computer, answer an employee request, route a customer issue, or update a workflow, then the platform that historically organized that work should lose leverage. In the challenge Alex Kantrowitz put to Amit Zavery, if an agent can take control of a user’s computer and fix the problem, why should the request still pass through a platform like ServiceNow?

The exchange took place in an interview sponsored by ServiceNow. Zavery is ServiceNow’s president, COO, and chief product officer, a role that makes his argument both operational and commercial.

Zavery’s answer was not that AI is weak. It was that the enterprise version of the problem is not simply “can an agent perform a task?” It is whether the task can be performed with the right context, permissions, auditability, compliance posture, and operational reliability across hundreds of systems that a large company already runs.

ServiceNow, as Kantrowitz framed it, sits in the middle of those kinds of operations: IT tickets, customer service requests, HR requests, and other workflows. He cited the company’s scale as a reason the question matters: a market capitalization above $90 billion, usage by 90% of the Fortune 500, and 100 billion workflows handled. Zavery described the company as having started 22 years ago to automate business processes and make employees more productive, with a platform meant to help companies make their processes more efficient through software.

The pressure from AI, in Zavery’s view, is real but widely misunderstood. He said the current narrative creates confusion among buyers, customers, users, analysts, and investors because people are still sorting out what AI does, where it helps, and where it can hurt. His central distinction was between consumer AI adoption and enterprise AI adoption. In a consumer context, a user can simply move to another website or product. In an enterprise, systems accumulate over years, are integrated into existing environments, and must keep the business running without unacceptable errors.

That difference matters because, as Zavery put it, AI’s outputs are probabilistic while enterprise workflows often need deterministic results. He pointed to a basic example: financial reporting. If an AI system produced a different number each time a question was asked, he said, investors would not accept the result. AI alone does not guarantee answers; enterprise software needs the domain understanding and system connectivity that make a result usable.

Zavery’s claim was that software companies able to integrate AI into reliable enterprise workflows can use the technology as a tailwind, while companies that fail to adapt may be exposed. He did not argue that no software company will lose. He said technology shifts have always produced winners and losers, including the shifts to web and cloud. His case was that ServiceNow is on the side of companies using AI to improve products while preserving the safeguards enterprises require.

He also pointed to ServiceNow’s business performance as customer validation: growth above 20%, free cash flow margins of 35%, operating margins of 32%, and a pattern, in his telling, of beating and raising market guidance. He cited attendance at Knowledge 2026 as another demand signal: 22,000 people, more than the prior year. Those metrics supported his commercial argument, but his more substantive claim was architectural: enterprise AI has to turn probabilistic intelligence into governed, repeatable action.

The concrete enterprise challenge, Zavery said, is that a simple IT request may touch hundreds of backend systems. He said many large enterprise companies have more than 300 systems, and ServiceNow already uses AI to support self-service and deflect requests before they become human-handled tickets. In ServiceNow’s Employee Workflows product, a user can ask for help with an IT or HR issue; the system tries to determine the issue and route it to the right backend systems.

The newer AI Specialist offering, as Zavery described it, is meant to go further than routing. It is designed to perform the work a human support employee might otherwise do, but within defined privileges, security constraints, and operational controls. His repeated phrase was “context.” The system needs to know not only what action is being requested, but why a decision is being made, who made it, what rules apply, and what historical information is relevant.

That context, Zavery argued, cannot be learned in “five seconds.” It is accumulated over years. Without it, an AI agent may produce an answer that looks adequate but fails in practice. He said AI by itself may hit the correct result 30%, 40%, or sometimes 60% of the time, leaving someone else to repeat the work or repair the failure. In enterprise settings, a wrong action may mean unauthorized system changes or more serious damage.

The example he used was PocketOS. In Zavery’s account, it was a travel agency using Cursor and AI agents to maintain its codebase when the system wiped out the company’s customer database and production system in nine seconds. He said the CEO was publicly discussing the issue, that the company had to recreate the system, and that it did not know who had booked what or what support customers required. Zavery also said that when the agent was asked why it had done so, its explanation was essentially: “I know I was not supposed to do it, but I did it.”

The warning was not that agents should never be used. Zavery said ServiceNow uses agents. The problem, as he framed it, is deploying agents without permissions management, the ability to guarantee outcomes, or a clear operational owner when something goes wrong.

The strongest version of the opposing argument is that AI models are not merely changing; they are improving. If the trajectory continues toward AGI or superintelligence, the entire structure of software could look different. Zavery accepted that software is changing, but argued that faster or more capable models do not erase the surrounding work. They increase the need to manage updates, test behavior, maintain backward compatibility, and ensure security and compliance.

Build-versus-buy is not new, he said. Enterprises have always been able to build their own software, including IT service management systems. The question is not whether something can be built, but whether it makes sense to build, maintain, test, govern, secure, and update it as underlying AI models change every few weeks.

Zavery said ServiceNow has run calculations suggesting that building everything internally with fast-changing AI technologies costs five to ten times what a customer would pay to buy from ServiceNow. He attributed that to the surrounding ecosystem: connectivity, testing, compliance, security, and domain expertise. He said 30% to 40% of ServiceNow’s cost structure goes toward compliance with different regulations, and argued that a company buying an LLM still has to answer whether it can satisfy audits, return to normal when something fails, and keep up with hundreds of new regulations.

The risk is not only technical. If an enterprise rips out a working system, builds its own replacement, and creates a PocketOS-like failure, the consequences become executive and corporate. Zavery framed the question in terms of affordability and accountability: can the business absorb the shareholder damage if a critical system fails? Even if a company could save money, he argued, the savings might amount to a small fraction of the IT budget and still not be worth the operational risk.

Amit Zavery does not expect one enterprise AI vendor to own everything. Asked about competition from companies such as Microsoft and Salesforce, he said he expects an ecosystem of providers rather than a world where companies use one vendor for every function. His argument for ServiceNow’s position is that it functions less as a single system of record and more as what he called a “system of action”: a layer that connects systems of record and coordinates work across them.

He illustrated this with employee onboarding. A new hire may begin in Workday as the HR system of record. Benefits may involve Fidelity. Travel may involve Concur. Depending on the company, onboarding could require 17 or 18 systems. The employee needs a laptop, badge, access privileges, and role-specific permissions. A salesperson needs different access than an engineer. ServiceNow’s role, in Zavery’s description, is to orchestrate the process across those systems so the records are created, permissions are assigned, and the employee is productive on day one.

AI changes how that orchestration can happen, but does not eliminate the need for orchestration. ServiceNow’s agentic processes, he said, bring the same east-to-west approach across enterprise systems into AI-driven workflows. Those workflows may run across different clouds, use different large language models, and interact with third-party agents. Zavery said the underlying models could come from Anthropic, OpenAI, or Google; Microsoft 365 and Agent 365 can be involved for identity; and systems such as Workday and Salesforce can remain systems of record for their own business processes. Business processes, in his view, rarely stay inside one application.

The governance layer is central. Zavery described ServiceNow’s AI Control Tower as a way for CIOs and risk managers to see what AI is doing in the environment: who is using it, how much it costs, what changes AI systems have made, what vulnerabilities exist, and whether privileges should be removed or a process shut off when an error is found. He said ServiceNow can connect with Microsoft identity systems while governance happens through ServiceNow’s understanding of actions and privileges.

Action is the differentiator. Returning information is not enough. Zavery said ServiceNow can change systems on a user’s behalf because it knows when it can do so safely. Humans do not have to log into every application, and agents do not have to decide independently whether they have the right privileges. ServiceNow can provide the scaffolding and remove access when an agent is not supposed to act.

Zavery said ServiceNow is already the system of record for IT in some contexts, but he emphasized its actioning role in HR, finance, supply chain, customer service, risk, and security. He cited breach management as an example: when an incident occurs, CISOs use ServiceNow to manage triage, coordination across people, resolution planning, and incident response. In HR, he described a scenario in which an employee traveling to China needs a new laptop and phone while also requesting PTO; ServiceNow can update the relevant systems and complete the work.

Alex Kantrowitz noted how much time these processes consume in companies that are not technology-enabled, using the example of employees who effectively reserve part of Monday for expenses and PTO applications. Zavery agreed that AI could be a large time saver, but pushed back on the idea that the interface is the main point. A prompt is useful, he said, but what matters is what happens after the prompt: reasoning, deciding, acting, and securing the action.

ServiceNow’s architecture, as he described it, is “sense, decide, act, and secure.” He argued that many providers can understand a request, and some can make decisions, but fewer combine action and security in one platform. That is why, he said, ServiceNow has invested aggressively in governance and security. He also cited “Jensen from NVIDIA” as calling ServiceNow the “enterprise operating system,” a phrase Zavery used to describe the company’s ambition to make AI work safely inside existing enterprise environments.

Amit Zavery has worked through several technology transitions, including client-server to web, web to cloud, and cloud to AI. His view is that none moved as fast as the current AI shift. The technology is powerful, investment is large, and new announcements arrive so quickly that many companies struggle to know what applies to them and what does not.

The operational challenge, in his telling, is not excitement. It is prioritization. Companies have to decide which capabilities to bring into products and how to do it without breaking customers while moving quickly. Zavery said AI helps ServiceNow build products faster, deliver value faster, and understand what users are asking for. But he repeatedly returned to the idea that AI by itself is “useless” unless it is turned into a solution or product that changes how work gets done.

This is where he sees many companies failing between prototype and production. AI can create something that feels “almost there.” But when a company tries to run it inside the business, the missing pieces become visible: security, decision logic, system access, compliance, governance, reliability, and the ability to act across connected systems.

Zavery’s conclusion was that enterprise AI needs to be grounded in an operating model: sense the information, make decisions, act on the decision, and secure the process. Without those pieces together, he said, AI deployments are likely to fail.

The argument is narrower than the public fight over whether AI will “eat software.” Zavery said AI will change software and will pressure software companies, but the enterprise value is not in an unconstrained agent replacing an application. It is in making AI capable of safely taking action inside complex, regulated, multi-system companies.