Automation is becoming part of the service model, not merely a tool used behind it.
Kyndryl has packaged engineering knowledge into agentic workflows delivered as services-as-software. Security vendors are similarly moving investigation, triage and workflow generation towards agent-led operation.
At the same time, Ofcom's work on telecoms security reporting and wholesale fibre offers shows where accountability remains irreducibly human and organisational: deciding what must be reported, preserving evidence, governing incentives and owning the customer outcome. Automation can improve consistency and speed. It cannot carry regulatory duty, commercial judgement or executive accountability.
Four developments matter this week
Incident reporting is becoming a designed operational capability
Ofcom's telecoms-security consultation closed on 4 August with proposals for clearer compromise reporting, a 72-hour form, bulk reporting and more consistent mobile-incident evidence.
Wholesale incentives remain part of service-strategy risk
Ofcom updated its Openreach consultation on 4 August after an Equinox-area amendment. Its provisional position would block one acquisition offer while leaving other notified offers untouched.
Provider expertise is being converted into reusable software workflows
Kyndryl introduced agentic modernisation services-as-software through Kyndryl Bridge, explicitly packaging operational knowledge into governed, repeatable workflows.
Agentic SOC propositions are moving from correlation towards investigation
Elastic expanded its agentic security proposition to investigate and validate threats, draft detection rules and generate workflows, while retaining analyst approval at material decision points.
The next managed-service advantage is not automation alone. It is automation that produces evidence, respects authority and remains accountable when conditions depart from the workflow.
Telecoms security reporting is becoming an evidence architecture
Ofcom's consultation on updates to its policy under section 105Y of the Communications Act closed on 4 August and is now pending a statement. The proposals seek more consistent reporting of security compromises, particularly for mobile networks, and include a draft 72-hour incident form, a bulk-reporting template, postcode data and a cell-data reporting standard.
The consultation also recognises that the impact of outages differs between urban, rural and most-rural areas. This pushes reporting beyond a single incident count towards evidence about geography, users and service consequence.
Reporting is not an administrative task to design after an incident. It requires telemetry, service inventory, dependency mapping, impact assessment, decision authority and preserved evidence to be built into the operating model.
What providers should be able to demonstrate
- Which services, customers, locations and suppliers were affected.
- How detection time, impact time and recovery time were established.
- Who decided that a reporting threshold was or was not met.
- Which evidence can be reproduced after the event.
Could the service produce a defensible regulatory incident record from live operational data, or would teams have to reconstruct it manually under pressure?
Wholesale pricing is an operating-model decision, not only a procurement input
Ofcom is consulting on Openreach commercial offers for FTTP and Ethernet. Its provisional view is to direct withdrawal of the Incremental New to Openreach Customer Offer because of competition concerns, while not proposing intervention in the other notified offers.
The page was updated on 4 August following Openreach's 30 July amendment extending the Equinox offer area to FTTP footprint released Ready For Service by 31 March 2027. Stakeholders can comment until 27 August.
What the evidence supports
- Wholesale incentives remain active levers in fibre migration and competitive positioning.
- Regulatory assessment distinguishes between individual offers rather than treating all discounting as equivalent.
- Provider economics can change before end-customer propositions and operations are ready.
What it does not support
- Assuming the provisional view is a final regulatory decision.
- Treating discounted acquisition price as sustainable whole-life service cost.
- Allowing access incentives alone to determine architecture or withdrawal policy.
Commercial teams should model contract duration, reversion pricing, migration cost, assurance obligations and customer-exit exposure together. A cheaper circuit is not automatically a cheaper managed service.
Kyndryl turns operational knowledge into services-as-software
Kyndryl introduced Agentic Modernization services-as-software on 6 August. It describes pre-defined agentic workflows for discovery, dependency mapping, target-state design, code analysis, testing and validation, deployed through Kyndryl Bridge with human oversight, governance and cost visibility.
The proposition matters beyond application modernisation. It points towards a delivery model in which provider methods, guardrails and operational experience are encoded into reusable workflows rather than recreated through labour-intensive projects.
Kyndryl's 5 August results provide relevant commercial context. Total quarterly revenue declined 3% year on year, while Consult revenue grew 10% and hyperscaler-related revenue grew 34%. The company also recorded $152 million of workforce-rebalancing charges and expects those actions to produce $400–$500 million of annualised operating-expense savings in fiscal 2028. The figures do not prove that agentic delivery caused the shift, but they show the simultaneous pressure to grow higher-value work and industrialise the delivery base.
Codified expertise becomes a product only when its boundaries are explicit.
Providers should define approved inputs, decision rights, exception routes, evidence outputs, rollback, model and workflow versions, and customer-specific responsibility. A workflow that performs well in the expected case still needs an accountable owner for the unexpected one.
Agentic security moves from alert correlation towards controlled action
Ahead of Black Hat USA, held from 3 to 6 August, Elastic expanded Attack Discovery from alert correlation into autonomous investigation. Its published design hunts events, checks risk scores, corroborates evidence, filters likely false positives and can draft new detection rules for analyst approval.
Elastic also added plain-language workflow generation, version history, rollback and human-in-the-loop approval routing. These are vendor-described capabilities, not independent proof of reduced incident impact or lower cost-to-serve. Nevertheless, the control pattern is strategically important.
The credible agentic SOC proposition is not “remove the analyst”. It is to reduce undifferentiated queue work while making investigation rationale, approval, change history and rollback more explicit.
Automation raises the standard for governance; it does not reduce it
| Issue | Current position | Leadership implication |
|---|---|---|
| Cyber Security and Resilience Bill | The Bill remains in the parliamentary process and is not enacted law. Proposed duties for qualifying relevant MSPs include proportionate controls and staged incident reporting. | Map automated detection and response to named legal entities, customer-notification authority and auditable decision records. |
| Telecoms security supervision | Ofcom's section 105Y consultation closed on 4 August and is pending a statement. | Do not wait for final wording to improve service inventory, impact mapping, incident evidence and reporting ownership. |
| Critical third-party oversight | UK financial regulators began direct oversight of designated critical technology providers in July. Regulated firms retain responsibility for resilience. | Ensure automation dependencies, models, platforms and privileged integrations appear in concentration, continuity and exit analysis. |
Governance must cover not only what an automated workflow can do, but the data it relies upon, the authority it exercises, the evidence it creates and the failure mode when it is unavailable or wrong.
The operating model must govern both automated execution and human exception
This week strengthens the case for treating automation as a service component with its own lifecycle and controls.
Authority
Define which actions can run autonomously, which require approval and who can stop or override them.
Evidence
Retain inputs, rationale, versions, actions and outcomes in a form usable for customers, audit and regulators.
Exceptions
Design escalation for incomplete data, conflicting policies, failed integrations and conditions outside the approved workflow.
Economics
Measure avoided effort and improved outcomes alongside platform cost, supervision, tuning, assurance and change overhead.
What leaders should do next
Do
- Classify automated actions by impact, authority and approval requirement.
- Test whether incident evidence can be produced from live operational systems.
- Model wholesale pricing across the full customer and service lifecycle.
- Add agent, workflow and platform dependencies to service inventories.
Monitor
- Ofcom's final section 105Y policy and Openreach-offer decision.
- Measured outcomes from services-as-software and agentic SOC deployments.
- Cyber Security and Resilience Bill amendments and secondary legislation.
- Customer procurement requirements for automation evidence and control.
Challenge
- Automation claims without exception handling, rollback or audit trails.
- Labour savings presented without supervision and platform costs.
- Pricing-led migrations that ignore assurance and exit obligations.
- Claims that human-in-the-loop automatically creates accountability.
Ignore
- Agentic product labels that do not change an operational decision or outcome.
- Benchmarks that cannot be traced to a production scope, baseline and method.
Automation can scale delivery. It cannot outsource accountability.
Agentic workflows can make specialist knowledge more repeatable and reduce low-value operational work. Regulatory and commercial developments show why the provider still needs defensible evidence, explicit authority and end-to-end ownership.
The strongest managed services will not choose between automation and human expertise. They will industrialise the routine, preserve judgement for material exceptions and make accountability visible across both.
Turn market intelligence into practical service decisions
Receive the UMMIM Morning Signal
Concise weekday intelligence for MSP and enterprise leaders, delivered by email.
Request a subscriptionGovern service automation
Connect automation, decision authority, operational evidence and commercial accountability.
Explore UMMIM servicesPublic evidence used in this advisory
Confirmed developments are distinguished from UMMIM analytical judgement. Vendor performance and product claims are attributed rather than treated as independently proven outcomes. Source links open in a new browser tab.
About UMMIM Intelligence
Weekday Morning Signals identify movement. Weekly and monthly executive advisories connect recurring developments to service strategy, investment, governance and operational reality. UMMIM does not accept payment for inclusion. Judgements and opinions are our own.