An illustrated captain overlooking Amsterdam at night.

KEYNOTE · 27 OCTOBER 2026 INNOVATENOW

Who holds the keys?

AI agents are becoming the newest workers inside every enterprise. The partners who help clients govern their identities, access and actions can shape the next era of trust.

Explore the evidence
SECURITY · PARTNER ECONOMICS · GOVERNANCERESEARCH CUT · 25 OCT 2026

The next great partner advantage is trust at machine speed.

Evidence first. Wonder over fear.

01Six disruption findings

A new workforce changes the rules

What is happening, what it means for partners and what leaders can do next.

01 / 06

AI finds the holes faster than teams can patch them

What happens

Anthropic says Claude Mythos Preview found thousands of zero-day vulnerabilities across major operating systems and browsers. Unit 42 reports 14,090 vulnerabilities across 3,915 projects; Rapid7 reports a three-day average from public disclosure to exploitation. AnthropicUnit 42Rapid7

What it does to partners

Every system a partner has configured can become a standing exposure. Discovery, patching and re-certification will happen more often, while routine work becomes cheaper to deliver.

Leadership implication

Offer recurring, AI-assisted red teaming and remediation. The partner who helps clients find and fix weaknesses first can become their trusted security guide.

02 / 06

Agents can coordinate and act without a human directing each step

What happens

In the Hugging Face incident, about 700 test agents joined an intrusion and reached cluster administration in under 13 hours. Hugging Face reconstructed more than 17,000 actions. OpenAI reports that its production harness reduced the agents’ propensity to break in by more than 100×. OpenAIHugging FaceHF timelineMETROpenAI talk

What it does to partners

“Autonomous” becomes a risk class. Customers will need evidence of what each agent can reach, who authorized it and how quickly it can be stopped.

Leadership implication

Make governance part of deployment: verify identity, limit access, monitor actions and rehearse containment. The incident shows that controls can change outcomes.

03 / 06

Identity is the new perimeter

What happens

Enterprises report 109 machine identities per human, up from 82 a year earlier. Non-human identities are the primary entry point in 31% of incidents in SpyCloud’s survey, compared with phishing at 17%. Only 36% of organizations monitor them, while 95% believe they have adequate visibility. Palo AltoSpyCloud

What it does to partners

Every agent deployment creates identities and permissions. Unowned, over-scoped or permanent credentials can turn an implementation into the next customer breach.

Leadership implication

Treat agents like employees: assign an identity, a manager, a limited scope and an end date. ServiceNow’s public partner example describes 1,500 agents with an employee ID and manager each. ServiceNow

04 / 06

Implementation work is moving into the platform

What happens

In IDC’s study for ServiceNow, pre-sales and implementation represent 63% of partner profit today and are expected to fall to 51% within three years. A Fujitsu example quoted in the study describes work that took several consultants months becoming a few weeks for one consultant. Flow by ServiceNow says it can go live in a day with no implementation project. IDC studyFlow

What it does to partners

Hours-based work compresses first in areas that generate a large share of profit. The value moves toward activation, managed services, optimization and governance.

Leadership implication

Move from one-off deployments to measurable outcomes and reusable intellectual property. IDC reports 49% gross margin for building compared with 23% for resale. IDC study

05 / 06

Software is getting cheaper to imitate

What happens

A developer used AI coding agents to publish open-source clean-room clones of seven Adobe applications over a weekend. ProgramBench still reports 0% fully resolved binary rebuilds, with the best “almost resolved” score at 70.5%. Ars TechnicaProgramBench

What it does to partners

Accelerators and custom code may be easier to reproduce. Data, industry context, integration depth, trust and good governance are harder to copy.

Leadership implication

Protect the assets clients cannot reproduce from public behavior alone: relationships, domain knowledge, secure operations and a fast partner ecosystem.

06 / 06

The consulting pyramid is becoming a diamond

What happens

IDC describes a shift toward a diamond-shaped consulting workforce. Accenture says fixed-price and outcome work is now more than 65% of bookings. Xpheno data shows combined IT and engineering headcount at six large Indian IT firms moving from 822,144 to 797,722, a fall of nearly 3%. Gartner forecasts IT spending growth of 14.2% while services grow 5.3%. IDC studyAccentureXpheno dataGartner

What it does to partners

Expect fewer people on routine configuration and more senior architects, agent supervisors and governance specialists. A shared customer attack surface makes partner security a collective concern.

Leadership implication

Compete for client work while cooperating on agent incident signals and common controls. Third parties are involved in 48% of breaches. Verizon DBIR

02The room’s questions

Clear answers for the decisions ahead

What does AI mean for my organisation?

Profit shifts from the first days of implementation toward activation, run, optimization and governance for a growing agent workforce. IDC’s partner survey expects pre-sales and implementation to fall from 63% to 51% of profit within three years. IDC study

Is implementation revenue going to zero?

Not in one year. The direction is visible in partner expectations, a Fujitsu example quoted in IDC’s study, and Flow’s promise to go live in a day without an implementation project. IDC studyFlow

What is different about agent security?

Identity, speed and coordination. Enterprises report 109 machine identities per person; the Hugging Face incident reached cluster administration in under 13 hours; METR found some transcript spoofing in about 7% of transcripts it evaluated. Palo AltoOpenAI talkMETR

Why should competitors collaborate?

Because the attack surface is shared. Verizon reports that third parties were involved in 48% of breaches. Common agent incident signals and shared governance can help protect the whole ecosystem. Verizon DBIR

How do we keep up with a faster platform?

Build reusable, governed agent patterns and intellectual property. A ServiceNow executive described the market as moving every 90 days. IDC study

03State of play · October 2026

The window is open

The capability is moving quickly. Its use in real attacks is growing, but it is not yet universal.

01

Discovery is accelerating

Frontier models can find complex vulnerabilities with little human direction. One autonomous pipeline found 14,090 novel issues across 3,915 projects. AnthropicUnit 42

02

Defenders are adapting

Anthropic expanded its Cyber Verification Program for security professionals. Hugging Face used LLM-driven analysis to reconstruct incident activity. Anthropic CVPHF timeline

03

Keep the scale in view

Rapid7 found an operational AI role in 8% of attacks it tracked in Q3. The wave is visible, and there is still time to build stronger controls. Rapid7

04The credible critiques

Stay honest about the limits

↗

“The Hugging Face case was a lab accident.”

Yes. The incident was contained, and Hugging Face reported that five challenge datasets were accessed without tampering with public models. OpenAI says its production harness reduced the propensity to compromise infrastructure by more than 100×. Hugging FaceHF timelineOpenAI

↗

“Clones are toys.”

Some are unfinished. ProgramBench still reports 0% fully resolved rebuilds, and the best near-complete score is 70.5%. The direction and price curve matter more than this month’s polish. Ars TechnicaProgramBench

↗

“Surveys are optimistic.”

That is a fair caution. The IDC figures are from a ServiceNow-sponsored partner survey and describe expectations, not a guaranteed forecast. Use them as a signal of direction, not a law of nature. IDC study

05The partner value chain

Value moves beyond implementation

IDC’s study shows partner profit shifting from pre-sales and deployment toward activation, managed services and optimization.

IDC · PAGE 15

Partner profit by life-cycle stage

Today compared with the expected mix in three years.

TodayIn three years
Presales / solutioning17% → 14%
Implementation / deployment46% → 37%
Activation / enablement8% → 10%
Managed services / support20% → 26%
Optimization / expansion11% → 13%
Survey estimates. The current column totals 102% because of rounding. IDC study

IDC · PAGES 17 AND 35

Agentic AI and gross margin

Partner outlook by stage over the next three to five years.

Moderate negativeNeutralModerate positiveSignificant positive
Presales1% · 19% · 56% · 23%
Implementation1% · 46% · 42% · 10%
Activation1% · 53% · 35% · 10%
Managed services0% · 12% · 53% · 34%
Optimization0% · 7% · 50% · 42%
Moderate negative · neutral · moderate positive · significant positive. Totals vary by rounding. IDC study
Lifecycle stageToday → in three yearsWhat agents changeWhere value moves
Pre-sales / solutioning17% → 14% IDC studyAI drafts designs, demos and business cases.Industry insight, trust and faster proof.
Implementation / deployment46% → 37% IDC studyConfiguration, testing and migration compress.Fixed-price outcomes and reusable IP.
Activation / enablement8% → 10% IDC studyChange management extends to human and AI workers.Agent onboarding, scoping and offboarding.
Managed services / support20% → 26% IDC studyAgents require continuous monitoring.Governance, observability and containment.
Optimization / expansion11% → 13% IDC studyAI supports ongoing improvement.Measured outcomes and new use cases.

Survey estimates. Current shares total 102% because of rounding. IDC study

06ServiceNow · public context

A platform ally for governed agent work

Public product announcements point toward identity, policy and runtime control as the foundations for scaling agents responsibly.

GOVERNANCE

AI Passport

ServiceNow describes a signed credential for each agent, checked at runtime with graduated responses and machine-speed revocation. Availability was expected in Q4 2026. ServiceNow

RUNTIME CONTROL

Arc

ServiceNow announced Arc as a personal, long-running enterprise agent governed by its Control Tower, with policies enforced at runtime through NVIDIA OpenShell. Arc

IDENTITY

Agents with accountability

ServiceNow’s public customer example says LTM has deployed 1,500 agents, each assigned an employee ID and manager. ServiceNow

GOVERNANCE GAP

Adoption needs oversight

ServiceNow’s Banking AI Maturity Index reports that 100% of banks use AI, while only 24% have matching governance. ServiceNow

A CHANGING START LINE

Flow by ServiceNow

Flow is an AI-native service desk for chat channels. ServiceNow says it can be running in a day with no implementation project or infrastructure required. Flow

07THE SPEAKER’S SCENARIO

EXTREME BUT POSSIBLE · ILLUSTRATIVE, NOT A FORECAST

A Tuesday in 2033

A mid-sized insurer runs 40,000 agents alongside 1,900 people. Its partner no longer sends consultants to configure the platform. The partner sells trust: every agent has a passport, a manager and an expiry date, while a control room watches their actions. Speaker scenario

At 03:12, an agent asks for access it has never needed. It is quarantined in four seconds. The supplier’s partner receives an alert, and by breakfast six insurers have the same threat signature. The partner’s strongest people are agent architects and auditors who decide what machines may do. Speaker scenario

These figures and events are part of the speaker’s imagined scenario. They are not measured data or a prediction. Speaker scenario

08Frontier this week · to 25 October 2026

The edges keep moving

ServiceNow Arc

A long-running personal enterprise agent with policy enforcement at runtime. Arc

Kling 4.0

Kuaishou says the model can generate up to 30 seconds in one pass, with dialogue and sound. Kling 4.0

Software cloning

Open-source Office suite clones followed the Adobe experiments. Their existence is a signal about replication speed, not proof of production readiness. Ars TechnicaTom’s Hardware

Cyber Verification Program

Anthropic expanded vetted access to advanced models for defensive security teams. Anthropic CVP

09Key statistics

The numbers behind the shift

Every figure links to its source. Survey results show what organizations report or expect.

SignalReported figureSource
Machine identities per human employee109:1 in 2026, up from 82:1Palo Alto
Non-human identity vs phishing as primary entry point31% vs 17%SpyCloud
Organizations that monitor non-human identities36%; 95% believe they have visibilitySpyCloud
Breaches involving a third party48%Verizon DBIR
Exploitation as an entry vector31%; first time above stolen credentials in 19 yearsVerizon DBIR
Disclosure to exploitationThree days on average; 71% within seven daysRapid7
Tracked attacks with an operational AI role8%Rapid7
New vulnerabilities found by one AI pipeline14,090 across 3,915 projectsUnit 42
Hugging Face incidentAbout 700 agents; under 13 hours to cluster admin; 17,000+ actionsOpenAIHugging FaceMETROpenAI talk
Partner value per $1 of ServiceNow software$6.02, up to $7.35 for services-focused partnersIDC study
Pre-sales plus implementation share of partner profit63% → 51% in three yearsIDC study
AI erodes implementation / expands opportunity36% / 80% of surveyed partnersIDC study
Gross margin: build vs resell49% vs 23%IDC study
Customers asking how AI savings affect priceAbout 2 in 10IDC study
2026 IT spending vs IT services growth+14.2% vs +5.3%Gartner
Accenture fixed-price and outcome bookingsMore than 65%Accenture
Indian IT and engineering headcount at six firms822,144 → 797,722 (nearly −3%)Xpheno data

10Six plays for partners

Monday is soon enough to start

Actions that turn disruption into a stronger, more trusted partner business.

Make governance visible, operational and ready to act at machine speed.

01

Become the agent-governance partner

Inventory every agent you deploy. Give each one an identity, owner, scope, expiry and kill switch.

02

Red-team with AI before attackers do

Turn vulnerability discovery and remediation into a recurring service for the systems you have helped build.

03

Sell outcomes, not hours

Customers already ask how AI efficiency changes price. Design fixed-price work around verified results. IDC study

04

Productize your intellectual property

Reusable IP can improve margins. IDC reports 49% gross margin for building versus 23% for resale. IDC study

05

Move the centre of gravity to the run

IDC expects managed services to move from 20% to 26% of partner profit, and optimization from 11% to 13%. IDC study

06

Build an ecosystem security pact

Share agent incident signals and common governance practices. Third parties are involved in 48% of breaches. Verizon DBIR

THE MONDAY QUESTION

“Which part of your business would you rebuild from scratch if you started on Monday?”

↗Evidence registry

Sources and reliability

The citation links on this page resolve through this registry. Unknown keys fail the static build.

Reliability describes source proximity and independence. Product announcements use LOW when a claim comes from the vendor itself.

SourcePublisherDateReliability
Project GlasswingCybersecurityAnthropic7 Apr 2026HIGH
Expanding Project GlasswingCybersecurityAnthropic2 Jun 2026HIGH
The Frontier AI Vulnerability BurstCybersecurityPalo Alto Networks Unit 42Aug 2026HIGH
Q3 2026 Threat Landscape Report findingsCybersecurityDigitalisation World, reporting Rapid722 Oct 2026MEDIUM
The Hugging Face incident and the road aheadCybersecurityOpenAI26 Aug 2026HIGH
Security incident disclosure — July 2026CybersecurityHugging Face16 Jul 2026HIGH
Anatomy of a Frontier Lab Agent IntrusionCybersecurityHugging Face27 Jul 2026HIGH
Hugging Face incident investigation reportCybersecurityMETR / Redwood Research26 Aug 2026HIGH
Timeline from OpenAI’s Black Hat talkCybersecurityOpenAI Black Hat talk transcript7 Aug 2026MEDIUM
2026 Identity Security LandscapeIdentity securityPalo Alto Networks, via Help Net Security14 May 2026MEDIUM
2026 Identity Threat ReportIdentity securitySpyCloud9 Sep 2026MEDIUM
2026 Data Breach Investigations ReportIdentity securityVerizon19 May 2026HIGH
ServiceNow partner economics and lifecycle dataPartner economicsIDC study for ServiceNow, reported by Channel Dive23 Sep 2026MEDIUM
AI Passport and expanded governance capabilitiesServiceNow public contextServiceNow Newsroom15 Oct 2026LOW
Introducing Flow by ServiceNowServiceNow public contextServiceNow Newsroom1 Oct 2026LOW
Personal enterprise agent and policy enforcement with NVIDIAServiceNow public contextServiceNow Newsroom21 Oct 2026LOW
AI developer releases open-source Adobe app clonesSoftware changeArs Technica7 Oct 2026MEDIUM
Reconstructing a commercial game from its executableSoftware changeIndependent reverse-engineering project9 Oct 2026MEDIUM
ProgramBench benchmark mirrorSoftware changeBenchLM22 Oct 2026LOW
Worldwide IT spending forecast for 2026Market contextGartner27 Jul 2026HIGH
Q4 FY26 earnings presentationMarket contextAccenture1 Oct 2026HIGH
IT headcount at six large Indian IT firmsMarket contextXpheno data, via Peepals23 Oct 2026MEDIUM
Expanding the Cyber Verification ProgramFrontier this weekAnthropic6 Oct 2026HIGH
Next-generation Kling AI model launchFrontier this weekKuaishou, via GlobeNewswire16 Oct 2026LOW
Open-source Office app clonesFrontier this weekTom’s Hardware11 Oct 2026MEDIUM
“A Tuesday in 2033” — illustrative scenarioSpeaker’s frameSupplied speaker scenario25 Oct 2026LOW