When AI Learns to Investigate: The Quiet Architecture Shift in Incident Management

For two decades, we have poured billions into monitoring tools that tell us something is broken. Yet the moment an outage hits, what do we do? We summon a human at 2 AM to comb through dashboards, logs, and config changes – essentially doing manual archaeology while the business bleeds. We’ve obsessively measured detection time and largely ignored investigation time. That asymmetry is finally being attacked, and it says something profound about where enterprise architecture is heading.

The Signal

Freshworks has acquired Israel-based AI startup Robusta Dev to fold AI-powered incident investigation into its IT service management platform. Robusta’s technology uses AI agents to analyse monitoring data, infrastructure information, and recent code or configuration changes to diagnose outages and recommend fixes – with engineers reviewing and approving actions before they touch production. This follows Freshworks’ recent acquisitions of Torii and FireHydrant, painting a clear picture of consolidation across the IT operations stack.

The Real Story Is Token Economics, Not Features

What caught my attention most was a line from Robusta’s founder: investigating raw events one-by-one in large enterprises would be “exorbitant from a token cost perspective.” This is the conversation the industry should be having far more candidly. We love to demo AI agents on toy problems with three variables. Real enterprise environments throw off millions of telemetry events per hour. The engineering challenge isn’t making an LLM smart enough to reason about an outage – it’s designing an architecture where the right, compressed, relevant context reaches the model at a cost that survives the CFO’s review.

This is fundamentally an architecture problem: intelligent pre-filtering, correlation layers, and hierarchical reasoning pipelines sitting between the firehose of observability data and the reasoning engine. The startups that master this discipline – not the flashiest demos – will define the next AIOps era.

The Human-in-the-Loop Pattern Is the Real Product

Notice what the design deliberately avoids: autonomous changes to production. Engineers review and approve before anything goes live. I believe this is not a temporary guardrail but the correct end-state for high-stakes enterprise AI. The maturity curve looks like this: AI observes, AI diagnoses, AI recommends, human approves – and only later, for low-risk categories, does the loop close.

For CTOs, this reframes the build-versus-buy question. The valuable asset isn’t the model; it’s the feedback structure – the audit trail, the approval workflows, the institutional memory of past incidents feeding future prevention. That’s where your architecture investment should go.

Consolidation and the End of the Toolchain Bazaar

Zoom out a decade, and incident management was a bazaar: one tool for alerting, another for on-call, a third for root cause, a fourth for postmortems. The signal here is consolidation into unified platforms where diagnosis, response, and prevention share a single data spine. That reduces the correlation tax enterprises pay when stitching fragmented toolchains. But it also raises the classic trade-off: platform lock-in versus integration overhead. Architects should negotiate that balance consciously, not drift into it.

A Lesson for Indian SaaS Builders

There’s a genuinely instructive arc here for the founder community I mentor at STPI: a company founded in Chennai in 2010, listed on Nasdaq, now acquiring Israeli and American deep-tech teams to strengthen its platform. India doesn’t need to only build for the world’s cost-consciousness – it can buy and build for the world’s operational complexity. For young founders, the takeaway is to aim at workflow depth, not surface features.

Takeaways

• Investigate the investigation gap. Mean time to detect is a vanity metric if mean time to diagnose stays manual.
• Design for token-aware AI. Context engineering, not model choice, will decide AIOps viability at scale.
• Keep humans sovereign over production. Approval workflows are a feature, not friction.
• Watch the consolidation wave. Decide your stack strategy deliberately – integration debt compounds silently.

The next generation of resilient enterprises won’t be the ones with the most dashboards. They’ll be the ones where the system explains itself – and the human still holds the final key.

---

About the Author: Sanjeev Sarma is the Founder Director and Chief Software Architect at Webx Technologies. With a core focus on Generative AI integration, Cloud-Native Scalability, and Enterprise Software Architecture, he has spent over two decades driving digital transformation across Northeast India and beyond. Beyond his corporate leadership, Sanjeev is deeply invested in shaping the future of the IT industry. He serves as an Industry Expert on the Board of Studies for Assam Don Bosco University’s School of Technology, advises state technology committees, and actively mentors emerging tech startups at STPI. He brings a unique, dual perspective of high-level enterprise execution and future-ready academic curriculum development.