Let me settle the loudest debate in enterprise technology, because the market has been arguing about the wrong construct all year. The "SaaSpocalypse" thesis holds that AI will make packaged software obsolete, that models will simply absorb the work applications used to do, and that entire categories of enterprise software will collapse. ServiceNow CEO Bill McDermott has spent much of 2026 calling that idea nonsense, and he is correct. Knowing he is correct is one thing. Understanding why matters more, because that is where the practical lessons are.
AI does not remove the need for enterprise software. It multiplies the need for the one construct nobody wants to build: governance. The moment a company moves past chatbot experiments and deploys agents that take real action across real systems, intelligence stops being the constraint. Intelligence is cheap now. Control is the scarce thing. Who authorized that agent to act, what data did it touch, did it stay inside policy, can anyone prove it afterward? Those questions do not get easier as models improve, whatever the optimists tell you. They get harder as agents multiply, and I have yet to see a serious argument otherwise.
The New Sprawl Problem
Enterprises spent fifteen years assembling hundreds of point applications, each chosen by a different team for a different job. That fragmentation was already an ungoverned mess. Now bolt an autonomous agent onto each of those applications, none of them connected, none of them governed by a common policy, and you have engineered a genuine disaster. McDermott called this an AI blind spot at Knowledge 2026: hundreds of applications, an agent attached to each like a sidecar, a rising token bill, and a finance leader who approved the spend but cannot find the return. It is a problem many of us in the field have been flagging for a while.
If you run networks and security operations, this picture should alarm you, and if it does not, you are not paying attention. We have watched this exact failure play out with unmanaged devices, shadow IT, and unfederated identity. Agent sprawl is the same model at higher velocity.
Each agent is a new actor on the network with credentials, a scope of access, and the ability to trigger downstream processes across systems that were never built to authenticate a non-human decision-maker. The attack surface does not grow linearly. It compounds, because agents call other agents, chain tasks, and move data across boundaries that used to have a human checkpoint sitting in the middle. This is not speculation. It is arithmetic.
The enterprises that struggle over the next two years will not be the ones with too little AI. They will be the ones that stood up thousands of ungoverned agents and built no framework to see what those agents are doing to their data, their networks, and their compliance posture. I would bet on that outcome without hesitation.
Why Orchestration is the Scarce Resource
There is a structural reason governance is the hard part, and I will state it plainly because the industry keeps talking around it. AI is probabilistic. It produces likely answers, not guaranteed ones. Enterprise operations are deterministic. Payroll runs the same way every time. A firewall rule either applies or it does not. A regulated transaction either meets the control or fails the audit. You cannot run a global business on a system that is usually right, and anyone who claims otherwise has never carried operational accountability.
So the value does not sit in the model. It sits in the orchestration framework that wraps the model in rules: the layer that decides which agent can act, on what, under which policy, with what evidence trail. That layer is deterministic by design, and it is the thing that turns a clever demo into a system a CFO and a CISO will both sign off on. This is the real answer to the SaaSpocalypse, and it is not complicated once you see it. Software is not disappearing. It is moving up the stack, from doing the task to governing the machines that now do the task.
For network and security teams, this settles the question of mandate. The job is no longer only to connect sites and defend perimeters. It is to provide the control architecture on which autonomous systems operate safely at scale. That is a networking problem, a security problem, and a data governance problem at once, which is precisely why it will not collapse into one tidy product category no matter how badly vendors want it to.
Governance is a Network and Security Discipline
Treat every agent as an identity, because that is what it is, and I am tired of explaining this twice. It needs to be authenticated, scoped to least privilege, monitored in real time, and revoked the instant its task ends or its behavior drifts. The identity apparatus enterprises built for employees and machines now has to extend to non-human actors that reason and act on their own. Static, role-based access designed for predictable human workflows will not hold when the actor is dynamic by nature. It simply will not, so stop pretending it might.
Visibility is the second pillar, and it is where nearly everyone is weakest. You cannot govern what you cannot see. If agents make decisions across a distributed environment, security operations need a unified system that correlates agent activity with network telemetry, data access, and policy events. Fragmented tooling produces fragmented evidence, and fragmented evidence fails audits and misses threats every single time.
The third pillar is data trust. Agents act on the data you give them. Feed them incomplete or inconsistent data and they will confidently do the wrong thing at machine speed. Governance therefore has to reach down into data quality, lineage, and policy controls, so that the information an agent consumes is as trustworthy as the actions it is allowed to take. None of this is vendor-specific. These are principles any competent enterprise can adopt regardless of platform, and the ones that skip them will learn the hard way.
The Real Dividing Line
The SaaSpocalypse framing asked whether AI would replace software. That was always the amateur's question. The correct question is who governs the agents once every function has them, and the answer draws a clean line between enterprises that scale AI safely and those that construct expensive, unaccountable chaos.
Autonomy without oversight is not transformation. It is risk with better marketing, and I will keep saying so until the market catches up. The advantage over the next few years belongs to the organizations that treat AI governance as core infrastructure: identity for every agent, visibility across every action, and trusted data underneath all of it. Intelligence is becoming a commodity. Control is the product now. I have been right about this for a while, and the numbers are starting to agree.
Author
Jamie Pugh - Chief Technology Officer
Jamie Pugh is a technology leader with more than 20 years of experience in enterprise networking, managed services and security architecture. Before joining Globalgig, he held senior engineering leadership roles and founded technology businesses, building expertise in network design, service delivery and automation.
As Globalgig's Chief Technology Officer, Jamie leads technology strategy across networking, cloud, security and AI, with a focus on helping enterprises adopt emerging technologies securely and at scale. His work spans AI security, governance and automation, addressing how organizations can integrate AI into their operations without compromising visibility, control or resilience.