Aldworth Insurance: Two Vendors and a Q3 Deadline
Aldworth Insurance has a 25-year-old NOC watching 4,000 servers through eleven monitoring tools. Runbooks live in Word documents, the CMDB is estimated to be 60% accurate, and tickets sit in a service management system with six years of history. Events are correlated by a legacy rules engine that operators quietly bypass. Mean time to repair is 3 hours 40 minutes and the CIO has promised the board 'AIOps by Q3'. Vendor A sells rule-based event correlation and deduplication with a machine-learning label on the slide; its strength is consolidating the eleven feeds. Vendor B sells per-metric anomaly detection with no topology awareness and no integration with ticketing. The NOC manager must recommend a path in two weeks and is being told to pick the 'most AI' option.
1. How does the historical lineage of AIOps help you classify these two offers, and what should the NOC manager say to the CIO?
Read the worked answer
The lineage runs from event correlation and business service management, through big-data ingestion of heterogeneous telemetry, to machine learning over that data with an automation loop back into operations. Each layer is real, and each layer is sold today as 'AI'.
Vendor A is the event-management layer: valuable consolidation and deduplication, but deterministic, and the NOC already owns a rules engine they bypass - which is a warning about adoption, not about algorithms. Vendor B is the ML layer without the layers beneath it: anomaly scores per metric, no dependency graph, no ticket linkage, so operators cannot triage what it emits.
What the CIO should hear: buying either delivers something real, but neither alone is AIOps, and the word on the slide is not a capability. Ask both vendors to backtest on Aldworth's own six years of tickets and to demonstrate root-cause grouping across at least three of the eleven tools. That test, not the deck, settles the choice.
2. The NOC manager wants to 'start with the ML'. Using the data foundation, argue for or against that sequencing.
Read the worked answer
Against, on the evidence in front of them. ML needs three things Aldworth does not yet have. First, normalized telemetry: eleven tools with eleven identity schemes means the same server has eleven names, so nothing can be joined. Second, topology: an anomaly score on a single host is unattributable, and root-cause inference requires a dependency graph; with a CMDB at 60% accuracy the graph will be wrong roughly two times in five at the exact moment it matters. Third, labels: six years of tickets exist, but if they are free-text and uncategorized they encode means of detection, not ground truth of cause.
The sequence that works is unglamorous: consolidate ingestion, fix service-to-host mapping for the top twenty business services, standardize ticket categories, and only then train. Each step produces value alone - the runbook and CMDB work reduces MTTR before any model exists - and each is a prerequisite for measuring whether the model helps.
3. Rewrite 'AIOps by Q3' into a defensible roadmap with stages, and state what Q3 actually delivers.
Read the worked answer
Name the stages so the board can see progress without conflating them. Reactive consolidation: one event pipeline, deduplication across the eleven tools, alert volume measured. Assisted: enrichment with topology and historical similar tickets, anomaly detection on a bounded set of signals, human still decides. Proactive: predictive signals such as capacity exhaustion and disk failure, still human-approved. Autonomous: closed-loop remediation with blast-radius limits - a separate governance decision entirely.
Q3 should deliver only the first stage plus a slice of the second: a single normalized event stream, deduplication on the top five alert types that drive ticket volume, service mapping for the twenty business-critical services, and a baseline measurement of noise rate and MTTR to compare against the current 3 hours 40 minutes.
That is honest, it is achievable, and it makes the next quarter's claim testable. Promising all four stages in one quarter guarantees that the board's first real look at AIOps is a disappointment, which is how these programmes die.