PLAYBOOK ATLASPlaybook Atlas

IT Services

AI in IT services: explore 40 applications.

Bring incident evidence, service context and proposed changes into controlled IT workflows.

Explore incident timelines, diagnostic workbenches, service requests and remediation review for IT operations and security teams.

Plan your first AI move See the 40 applications

Where the 40 applications sit

Explore the domains
  1. 16Cybersecurity
  2. 12IT Operations
  3. 12Software Development
  4. 4User Experience

01Why AI now

Why IT services is moving on AI, in three figures.

Each figure links to its source.

  1. iFood: Bits Investigation cut MTTR by 70%

    Datadog quotes an iFood SRE as saying Bits Investigation began cutting the company's MTTR by 70%.

    Source: Datadog

  2. GitHub Copilot: 55% faster coding

    AI pair programming transforming developer productivity

    Source: Microsoft Research

  3. Workplace AI: 90% of tech professionals use it

    DORA’s 2025 survey of nearly 5,000 technology professionals found 90% use AI at work and more than 80% report increased productivity.

    Source: Google Cloud

How to evaluate a first project

Choose one incident class or service action and establish a reproducible baseline. Check evidence freshness, access scope and alternative explanations before proposing remediation. Require approval appropriate to the action, retain a recovery path and verify service restoration after execution.

02Capability map

Where IT services puts AI to work, domain by domain.

Pick a domain to see its applications. Each one opens a full report.

Inside Cybersecurity

Applications in Cybersecurity

What the use cases ask AI to do

Share of the IT services use cases, by the kind of work the AI does.

  1. Reasoning

    Analyzes, predicts and decides: scoring, forecasting, classifying.

    61%

  2. Generation

    Creates: text, images, code and other content.

    34%

  3. Agentic

    Acts: plans, uses tools and completes multi-step tasks.

    5%

Under 1% each: perception and optimization.

03Workflow ideas

Ways AI could change the work, in IT services.

Atlas groups these applications by the changes they propose to a workflow. These preliminary classifications help you explore ideas; each application still needs a review of its sources and operating requirements.

Workflow categories in this catalog

Share of the 32 applications assigned a category.

How to evaluate an application

  1. Start with a bounded task

    Identify the inputs, the person responsible, and the decision or output the workflow must produce.

  2. Check the support for each method

    Look for source-backed details about the specific implementation, including its limits and human review.

  3. Measure the pilot

    Record the current baseline, agree on acceptance criteria, and test on representative cases before expanding.

Explore applications

04What gets built

The approaches IT services uses most, and when to skip them.

Knowing when not to use one matters as much as knowing when to.

  1. 01 · 9 applications

    Workflow Automation

    Use AI inside orchestrated workflows to automate multi-step business processes.

    Use it when

    • When you have repetitive, rule-heavy workflows that still require human judgment or document understanding.
    • When the process spans multiple systems (ERP, CRM, ticketing, email) and manual coordination is slow or error-prone.
    • When large volumes of semi-structured or unstructured data (emails, PDFs, forms) must be processed consistently.

    Skip it when

    • When the process is highly creative, exploratory, or non-repeatable, with no stable sequence of steps.
    • When decisions are extremely high-stakes (e.g., life-critical medical decisions, major legal judgments) and regulations require full human control.
    • When you lack reliable access to the necessary systems or data sources to complete the workflow end-to-end.
    Workflow Automation, in depth

  2. 02 · 5 applications

    Generative AI

    Models that learn data distributions to generate new text, images, code, and media.

    Use it when

    • When you need to generate natural language, code, or media that would be expensive or slow for humans to produce manually.
    • When tasks involve ambiguity, open-ended questions, or creative exploration rather than strict right-or-wrong answers.
    • When you can ground the model on reliable internal or external data sources to improve factuality.

    Skip it when

    • When the task requires strict determinism, formal guarantees, or regulatory-grade traceability (e.g., certain financial calculations, safety-critical control systems) without a robust verification layer.
    • When you lack access to high-quality, authoritative data or subject-matter expertise to validate outputs in a high-risk domain.
    • When a simple rules engine, search, or template-based system can solve the problem more reliably and cheaply.
    Generative AI, in depth

  3. 03 · 5 applications

    Security Operations Intelligence

    Security operations and analyst-enablement intelligence systems.

    Security Operations Intelligence, in depth

05The applications

40 IT services applications, each with a full report.

The widest first, by the number of use cases each covers. Every report shows what changed, how it works, who has done it and what can go wrong.

  1. AI-Driven Cyber Threat Anomaly DetectionThis AI solution uses machine learning and generative AI to detect anomalous behavior across networks, endpoints, cloud workloads, and DevOps environments in real time. By automating intrusion detection, malware analysis, SOC workflows, and cyber threat intelligence, it accelerates threat response, reduces breach risk, and lowers the operational cost of security at scale.Batch → RT17 use cases
  2. Software Development Automation HubThis application area focuses on using advanced automation to assist and accelerate the entire software development lifecycle, from coding and unit testing to code review and maintenance. Tools in this AI solution generate and refine code, propose implementations, create and improve test cases, and act as automated reviewers that flag bugs, security vulnerabilities, and quality issues before code is merged or shipped. It matters because traditional software engineering is constrained by developer capacity, high labor costs, and the difficulty of maintaining quality at speed, especially with large, complex, or legacy codebases. By offloading boilerplate tasks, improving test coverage, and systematically reviewing both human‑ and machine‑written code, these applications increase developer productivity, reduce defect rates, and help organizations deliver software faster and more safely, even as they adopt code‑generating assistants at scale.Human Creative → Augmented14 use cases
  3. Cyber Threat Detection and ResponseThis application area focuses on continuously identifying, prioritizing, and responding to cyber threats across endpoints, networks, cloud environments, and user accounts. It replaces or augments traditional rule‑based security tools and manual analyst work with systems that can sift through massive volumes of security logs, behavioral signals, and telemetry to surface genuine attacks in real time. The goal is to shrink attacker dwell time, catch novel and zero‑day threats that don’t match known signatures, and coordinate faster, more consistent incident response. It matters because the speed, scale, and sophistication of modern cyberattacks—often enhanced by attackers’ own use of automation and AI—have outpaced human-only security operations. By embedding advanced analytics into security monitoring, organizations can detect subtle anomalies, reduce alert fatigue, and automate playbooks for containment and remediation. This is increasingly critical for enterprises, cloud-centric organizations, and small businesses alike, all facing a widening cybersecurity talent gap and escalating regulatory and reputational risk from breaches.Batch → RT13 use cases
  4. IT Operations Incident ManagementTurn alerts into an owned incident with a concise evidence timeline, clear responder handoffs and reviewed next actions. Add automation in stages after the team can verify recovery and stop unsafe actions.Workflow Automation11 use cases
  5. Cyber Threat Intelligence and Hunting AutomationThis AI solution uses AI to detect, analyze, and respond to cyber threats across networks, endpoints, and cloud environments, from small businesses to military and enterprise SOCs. By automating threat hunting, malware analysis, and incident response while upskilling the cybersecurity workforce, it reduces breach risk, accelerates response times, and strengthens resilience against both conventional and AI-orchestrated attacks.Batch → RT9 use cases
  6. AI Code Review Workflow RouterAI-powered code review and code understanding platform that orchestrates review, testing, security, and delivery workflows while explaining code behavior for faster onboarding and requirements analysis.Expert → AI8 use cases
All 40 applications, A to Z

Work with us

The catalog shows what is possible. A sprint decides what you should fund.

Reading every report still leaves the hardest question open: which move is worth funding first, here, given your constraints. That is the sprint: two weeks, fixed scope, and a candid answer either way.

Book a 30-minute callHow the sprint works

Two weeks Fixed scope A candid fit-or-no-fit answer

  1. 01

    Three ranked opportunities

    A decision-ready shortlist scored against value, feasibility, evidence, risk, and time to proof.

  2. 02

    One pilot-ready workflow

    A bounded operating design with actors, handoffs, data needs, controls, and success measures.

  3. 03

    A defensible 90-day plan

    Build-versus-buy guidance, ROI assumptions, risk treatment, sequencing, and executive decisions.

06Rules & standards

Rules and standards to check, with their scope and sources.

Selected US and EU references for these workflows. Applicability depends on jurisdiction, organization, data and intended use. The planning notes are Atlas editorial guidance; they are not official implementation-time estimates or an exhaustive list of obligations.

  1. NIST Secure Software Development Framework

    Voluntary framework

    United States framework · usable internationally

    The SSDF recommends secure development, software protection and vulnerability-response practices. It is guidance rather than a universal law; procurement or contract terms may incorporate specific requirements.

    NIST: Secure Software Development Framework

    Source checked

    Project planning note

    Include generated code and model integrations in existing review, dependency, logging and vulnerability-response practices.

  2. GDPR · personal data and automated decisions

    Law or regulation

    European Union / EEA · processing within GDPR scope

    Personal-data processing needs an applicable lawful basis and safeguards. Article 9 adds conditions for special-category data; Article 22 addresses certain solely automated decisions with legal or similarly significant effects. Consent is not the only lawful basis.

    EUR-Lex: GDPR, Articles 3, 6, 9, 22 and 35

    Source checked

    Project planning note

    Map personal data in tickets, logs and retrieval indexes to permitted processing and access controls.

07The AI graveyard

One failure, and the lesson it paid for.

  1. Microsoft Tay AI

    2016 · Source

    Project cancelled in 24 hours

    What went wrong

    AI chatbot learned from Twitter interactions and began posting offensive content within hours of launch.

    The lesson

    AI systems exposed to public input need robust content filtering

Your next step

Find your first move in IT services.

Ask the workspace which move fits your company. Add your size, systems and constraints, and it works from these 40 applications to a plan your team can act on.

Plan your first AI move

Rather talk it through? Book a 30-minute call