Skip to main content

Why ITOps Need Right-Sized AI, Not Bigger Models

John Donegan
ManageEngine

Over the past few years, large language models (LLMs) have revolutionized the software industry. Given their ability to excel at multi-step reasoning, LLMs have helped enterprises streamline workflows and adapt to the unknown. However, employing such models comes with sky-high costs, latency issues, and limited flexibility. In the realm of IT operations, it is generally wiser to employ smaller, domain-specific models instead.

Most tasks within ITOps do not require LLMs. Utilizing a billion parameter model to automate routine ITOps tasks, like ticket triaging and classification, is likely a colossal waste of money. What's more, LLMs have much higher latency than smaller, domain-specific models, and repetitive IT operations, such as alert creation and incident triage, require fast responses. Importantly, most ITOps tasks are well-defined, making right-sized, domain-specific models a great fit.

The Nature of ITOps

ITOps tasks are generally latency-sensitive, high-volume, and domain-specific; within many enterprises, thousands of events are processed within a narrow and predictable context. By nature, many of these tasks, including ticket routing, anomaly detection, and log generation, are repetitive and highly-structured.

Put simply, high volume, routine tasks require low-latency responses, and domain-specific LLMs provide exactly this. Not only are right-sized models faster, but they are also more predictable and easier to fine-tune to account for a specific environment.

Before rolling out a language model of any size into an organization's workflows, it is important to match the solution to the need at hand. When it comes to ITOps, there is often a need to automate narrow, routing tasks. By fine-tuning small models with proprietary data and right-sizing these models to one's specific workloads, enterprises can maximize accuracy and speed, while keeping costs under control.

When considering costs, IT personnel should always be sure to take operational metrics, such as latency, throughput, system uptime, and cost per query, into consideration. It's best not to over-engineer AI in ITOps, as this will introduce unnecessary complexity, add latency, and increase costs to one's organization.

The Compliance and Data Privacy Benefits to Domain-Specific Models

Given that smaller, domain-specific models are easier to run locally, all of the enterprise's sensitive infrastructure can often be retained in-house. With models running on-prem or in a private cloud, sensitive data can remain within the confines of the enterprise, reducing privacy and regulatory risks. In highly regulated industries, such as healthcare and financial services, this benefit cannot be overstated.

By not using cloud-based APIs or sending sensitive data to third-party platforms, enterprises gain more control and more easily adhere to compliance requirements. The limited scope of smaller models makes them easier to audit as well. For many cost-conscious enterprises, running self-hostable, right-sized models is far better than having an API dependency, which can potentially expose the organization to external threats outside of one's control.

Trade-Offs, Challenges, and Limitations of Smaller Models

Although domain-specific, right-sized models certainly offer strong enterprise alignment, they are not without limitations. Smaller models have more limited general reasoning capabilities, causing them to perform best within narrowly defined domains, as opposed to within cross-domain or open-ended reasoning environments.

Additionally, because the training datasets are smaller and more focused, it is vital that smaller models' training data is of particularly high quality. Poor training data will severely hamper small model accuracy and degrade trustworthiness.

Successful deployment of a domain-specific model requires in-house expertise, not only in integration and fine-tuning, but also in MLOps and inference optimization. Within the enterprise, IT personnel must be tasked with monitoring, fine-tuning, and retraining the small models as the organization's processes, workflows, and data evolve.

Lastly, even though right-sized models are comparatively simpler than LLMs, they are not without governance complexity; like their LLM counterparts, small models still require controls around explainability, versioning, access, and auditability.

Opting for a Hybrid Approach

Depending on the size and nature of an enterprise's environment, there are instances where smaller models complement, rather than replace, larger models. A hybrid approach could involve using a domain-specific model for initial data processing, whereby more complex cases are routed to an LLM.

Another hybrid strategy could be to use smaller models for repeatable and sensitive workflows, while concurrently utilizing larger language models for exploratory or broad reasoning tasks. Such an approach can keep costs relatively low, while still maximizing value.

Key Takeaways

When it comes to model usage and ITOps, bigger isn't always better. Despite delivering an impressive multi-step reasoning capability, LLMs come with their fair share of baggage, including high costs, latency issues, limited controllability, and governance risks.

For most ITOps activities, smaller language models designed for precision and efficiency are preferable. After all, most routine ITOps tasks, such as log analysis and anomaly detection, require low latency and a very specific knowledge base.

By fine-tuning smaller models on domain-specific data, IT personnel can effectively optimize their environment for unique use cases. To put it simply, most commonplace ITOps tasks do not require LLM capabilities; in fact, a domain-specific model can often get the job done quicker, cheaper, and many times, safer.

John Donegan is an Enterprise Analyst at ManageEngine

Hot Topics

The Latest

Production incidents rarely announce themselves as database problems. They appear as slow transactions, timeouts, rising response times, or an application struggling under a workload it previously handled. APM provides an essential starting point. It can identify a slow transaction path, highlight an affected service, and show that a database dependency is consuming more time than expected. But identifying the database as part of the problem is not the same as explaining what is happening inside it ...

Cloud teams are under constant pressure to reduce spend without slowing development or increasing operational risk. They are deploying autoscalers, rightsizing workloads, enforcing resource requests, reviewing utilization dashboards, and building FinOps processes around cloud-native environments. Yet the results often disappoint ...

Ask most IT leaders about their biggest concern with AI and you'll hear the same answer: hallucinations ... Today, however, the conversation has shifted ... As organizations move beyond chatbots and experiments, they are increasingly deploying AI agents that perform multi-step tasks. These systems retrieve documents, query databases, call APIs, generate reports, write code, and make recommendations. The issue is not whether the model can reason. The issue is whether the organization can see, verify, and govern the decisions being made along the way ...

While organizations want to take control of their telemetry, building telemetry pipelines from scratch can be a very daunting, complicated task, even when leveraging open-source standards like OpenTelemetry. It requires specialized knowledge across distributed systems, data engineering, and security. This fragmented approach across systems causes higher operational costs; it puts a strain on resources and reduces efficiency as teams have to work with different interfaces and processes ...

For decades, enterprise networks were designed around a simple assumption: work happened inside the office. Applications lived in centralized data centers, employees connected through internal infrastructure, and security focused on protecting the perimeter that surrounded everything ... But the way organizations operate today bears little resemblance to that environment. Cloud platforms host critical applications, employees connect from homes and airports as often as they do from offices, and partners collaborate through shared systems that exist far beyond corporate walls. In short, the corporate network no longer resembles the environment it was designed to protect ...

As an analyst who researches how IT organizations design, build, and operate their networks, I find that network data is a constant source of pain. Network teams struggle with data quality, fragmentation, authority, access, and trust. And these issues undermine everything they try to do. Here are the numbers: Only 45% of network teams are completely confident in the accuracy of their network source of truth, which documents the intent of their network ...

The 2026 Global Data Center Survey from Uptime Institute reveals an industry navigating workforce constraints, escalating outage expenses, even as rising costs remain the top concern for management teams ...

The next observability gap may not be in the code. It may be under the rack. That sounds strange until you think about how AI incidents actually feel in the middle of an investigation ... The application dashboard may be accurate. It may also be stopping at the wrong boundary. AI systems depend on software, but they also depend on a dense physical stack: racks, power paths, thermal margin, maintenance activity and, in many environments, liquid cooling. Those physical dependencies can change slowly before they look like a software incident ...

Certificate expiration is the rare outage you can see coming. Every TLS certificate carries the date it stops working, so the moment it will begin breaking connections is knowable in advance. That's what makes an expired certificate such a frustrating way to lose a service. What's changing now is how often that date comes around ...

Enterprises operate different combinations of workloads across cloud, hybrid and multicloud environments. For business-critical workloads, teams need to consider monitoring and observability early so they can detect health issues, investigate failures, and understand operational impact. Organizations place workloads on cloud platforms based on a combination of technical requirements, economics, existing dependencies, organizational standards, and business priorities. Their monitoring priorities therefore depend on what they operate and where those systems run. Those priorities will not look the same for every organization ...

Why ITOps Need Right-Sized AI, Not Bigger Models

John Donegan
ManageEngine

Over the past few years, large language models (LLMs) have revolutionized the software industry. Given their ability to excel at multi-step reasoning, LLMs have helped enterprises streamline workflows and adapt to the unknown. However, employing such models comes with sky-high costs, latency issues, and limited flexibility. In the realm of IT operations, it is generally wiser to employ smaller, domain-specific models instead.

Most tasks within ITOps do not require LLMs. Utilizing a billion parameter model to automate routine ITOps tasks, like ticket triaging and classification, is likely a colossal waste of money. What's more, LLMs have much higher latency than smaller, domain-specific models, and repetitive IT operations, such as alert creation and incident triage, require fast responses. Importantly, most ITOps tasks are well-defined, making right-sized, domain-specific models a great fit.

The Nature of ITOps

ITOps tasks are generally latency-sensitive, high-volume, and domain-specific; within many enterprises, thousands of events are processed within a narrow and predictable context. By nature, many of these tasks, including ticket routing, anomaly detection, and log generation, are repetitive and highly-structured.

Put simply, high volume, routine tasks require low-latency responses, and domain-specific LLMs provide exactly this. Not only are right-sized models faster, but they are also more predictable and easier to fine-tune to account for a specific environment.

Before rolling out a language model of any size into an organization's workflows, it is important to match the solution to the need at hand. When it comes to ITOps, there is often a need to automate narrow, routing tasks. By fine-tuning small models with proprietary data and right-sizing these models to one's specific workloads, enterprises can maximize accuracy and speed, while keeping costs under control.

When considering costs, IT personnel should always be sure to take operational metrics, such as latency, throughput, system uptime, and cost per query, into consideration. It's best not to over-engineer AI in ITOps, as this will introduce unnecessary complexity, add latency, and increase costs to one's organization.

The Compliance and Data Privacy Benefits to Domain-Specific Models

Given that smaller, domain-specific models are easier to run locally, all of the enterprise's sensitive infrastructure can often be retained in-house. With models running on-prem or in a private cloud, sensitive data can remain within the confines of the enterprise, reducing privacy and regulatory risks. In highly regulated industries, such as healthcare and financial services, this benefit cannot be overstated.

By not using cloud-based APIs or sending sensitive data to third-party platforms, enterprises gain more control and more easily adhere to compliance requirements. The limited scope of smaller models makes them easier to audit as well. For many cost-conscious enterprises, running self-hostable, right-sized models is far better than having an API dependency, which can potentially expose the organization to external threats outside of one's control.

Trade-Offs, Challenges, and Limitations of Smaller Models

Although domain-specific, right-sized models certainly offer strong enterprise alignment, they are not without limitations. Smaller models have more limited general reasoning capabilities, causing them to perform best within narrowly defined domains, as opposed to within cross-domain or open-ended reasoning environments.

Additionally, because the training datasets are smaller and more focused, it is vital that smaller models' training data is of particularly high quality. Poor training data will severely hamper small model accuracy and degrade trustworthiness.

Successful deployment of a domain-specific model requires in-house expertise, not only in integration and fine-tuning, but also in MLOps and inference optimization. Within the enterprise, IT personnel must be tasked with monitoring, fine-tuning, and retraining the small models as the organization's processes, workflows, and data evolve.

Lastly, even though right-sized models are comparatively simpler than LLMs, they are not without governance complexity; like their LLM counterparts, small models still require controls around explainability, versioning, access, and auditability.

Opting for a Hybrid Approach

Depending on the size and nature of an enterprise's environment, there are instances where smaller models complement, rather than replace, larger models. A hybrid approach could involve using a domain-specific model for initial data processing, whereby more complex cases are routed to an LLM.

Another hybrid strategy could be to use smaller models for repeatable and sensitive workflows, while concurrently utilizing larger language models for exploratory or broad reasoning tasks. Such an approach can keep costs relatively low, while still maximizing value.

Key Takeaways

When it comes to model usage and ITOps, bigger isn't always better. Despite delivering an impressive multi-step reasoning capability, LLMs come with their fair share of baggage, including high costs, latency issues, limited controllability, and governance risks.

For most ITOps activities, smaller language models designed for precision and efficiency are preferable. After all, most routine ITOps tasks, such as log analysis and anomaly detection, require low latency and a very specific knowledge base.

By fine-tuning smaller models on domain-specific data, IT personnel can effectively optimize their environment for unique use cases. To put it simply, most commonplace ITOps tasks do not require LLM capabilities; in fact, a domain-specific model can often get the job done quicker, cheaper, and many times, safer.

John Donegan is an Enterprise Analyst at ManageEngine

Hot Topics

The Latest

Production incidents rarely announce themselves as database problems. They appear as slow transactions, timeouts, rising response times, or an application struggling under a workload it previously handled. APM provides an essential starting point. It can identify a slow transaction path, highlight an affected service, and show that a database dependency is consuming more time than expected. But identifying the database as part of the problem is not the same as explaining what is happening inside it ...

Cloud teams are under constant pressure to reduce spend without slowing development or increasing operational risk. They are deploying autoscalers, rightsizing workloads, enforcing resource requests, reviewing utilization dashboards, and building FinOps processes around cloud-native environments. Yet the results often disappoint ...

Ask most IT leaders about their biggest concern with AI and you'll hear the same answer: hallucinations ... Today, however, the conversation has shifted ... As organizations move beyond chatbots and experiments, they are increasingly deploying AI agents that perform multi-step tasks. These systems retrieve documents, query databases, call APIs, generate reports, write code, and make recommendations. The issue is not whether the model can reason. The issue is whether the organization can see, verify, and govern the decisions being made along the way ...

While organizations want to take control of their telemetry, building telemetry pipelines from scratch can be a very daunting, complicated task, even when leveraging open-source standards like OpenTelemetry. It requires specialized knowledge across distributed systems, data engineering, and security. This fragmented approach across systems causes higher operational costs; it puts a strain on resources and reduces efficiency as teams have to work with different interfaces and processes ...

For decades, enterprise networks were designed around a simple assumption: work happened inside the office. Applications lived in centralized data centers, employees connected through internal infrastructure, and security focused on protecting the perimeter that surrounded everything ... But the way organizations operate today bears little resemblance to that environment. Cloud platforms host critical applications, employees connect from homes and airports as often as they do from offices, and partners collaborate through shared systems that exist far beyond corporate walls. In short, the corporate network no longer resembles the environment it was designed to protect ...

As an analyst who researches how IT organizations design, build, and operate their networks, I find that network data is a constant source of pain. Network teams struggle with data quality, fragmentation, authority, access, and trust. And these issues undermine everything they try to do. Here are the numbers: Only 45% of network teams are completely confident in the accuracy of their network source of truth, which documents the intent of their network ...

The 2026 Global Data Center Survey from Uptime Institute reveals an industry navigating workforce constraints, escalating outage expenses, even as rising costs remain the top concern for management teams ...

The next observability gap may not be in the code. It may be under the rack. That sounds strange until you think about how AI incidents actually feel in the middle of an investigation ... The application dashboard may be accurate. It may also be stopping at the wrong boundary. AI systems depend on software, but they also depend on a dense physical stack: racks, power paths, thermal margin, maintenance activity and, in many environments, liquid cooling. Those physical dependencies can change slowly before they look like a software incident ...

Certificate expiration is the rare outage you can see coming. Every TLS certificate carries the date it stops working, so the moment it will begin breaking connections is knowable in advance. That's what makes an expired certificate such a frustrating way to lose a service. What's changing now is how often that date comes around ...

Enterprises operate different combinations of workloads across cloud, hybrid and multicloud environments. For business-critical workloads, teams need to consider monitoring and observability early so they can detect health issues, investigate failures, and understand operational impact. Organizations place workloads on cloud platforms based on a combination of technical requirements, economics, existing dependencies, organizational standards, and business priorities. Their monitoring priorities therefore depend on what they operate and where those systems run. Those priorities will not look the same for every organization ...