Skip to main content

Why ITOps Need Right-Sized AI, Not Bigger Models

John Donegan
ManageEngine

Over the past few years, large language models (LLMs) have revolutionized the software industry. Given their ability to excel at multi-step reasoning, LLMs have helped enterprises streamline workflows and adapt to the unknown. However, employing such models comes with sky-high costs, latency issues, and limited flexibility. In the realm of IT operations, it is generally wiser to employ smaller, domain-specific models instead.

Most tasks within ITOps do not require LLMs. Utilizing a billion parameter model to automate routine ITOps tasks, like ticket triaging and classification, is likely a colossal waste of money. What's more, LLMs have much higher latency than smaller, domain-specific models, and repetitive IT operations, such as alert creation and incident triage, require fast responses. Importantly, most ITOps tasks are well-defined, making right-sized, domain-specific models a great fit.

The Nature of ITOps

ITOps tasks are generally latency-sensitive, high-volume, and domain-specific; within many enterprises, thousands of events are processed within a narrow and predictable context. By nature, many of these tasks, including ticket routing, anomaly detection, and log generation, are repetitive and highly-structured.

Put simply, high volume, routine tasks require low-latency responses, and domain-specific LLMs provide exactly this. Not only are right-sized models faster, but they are also more predictable and easier to fine-tune to account for a specific environment.

Before rolling out a language model of any size into an organization's workflows, it is important to match the solution to the need at hand. When it comes to ITOps, there is often a need to automate narrow, routing tasks. By fine-tuning small models with proprietary data and right-sizing these models to one's specific workloads, enterprises can maximize accuracy and speed, while keeping costs under control.

When considering costs, IT personnel should always be sure to take operational metrics, such as latency, throughput, system uptime, and cost per query, into consideration. It's best not to over-engineer AI in ITOps, as this will introduce unnecessary complexity, add latency, and increase costs to one's organization.

The Compliance and Data Privacy Benefits to Domain-Specific Models

Given that smaller, domain-specific models are easier to run locally, all of the enterprise's sensitive infrastructure can often be retained in-house. With models running on-prem or in a private cloud, sensitive data can remain within the confines of the enterprise, reducing privacy and regulatory risks. In highly regulated industries, such as healthcare and financial services, this benefit cannot be overstated.

By not using cloud-based APIs or sending sensitive data to third-party platforms, enterprises gain more control and more easily adhere to compliance requirements. The limited scope of smaller models makes them easier to audit as well. For many cost-conscious enterprises, running self-hostable, right-sized models is far better than having an API dependency, which can potentially expose the organization to external threats outside of one's control.

Trade-Offs, Challenges, and Limitations of Smaller Models

Although domain-specific, right-sized models certainly offer strong enterprise alignment, they are not without limitations. Smaller models have more limited general reasoning capabilities, causing them to perform best within narrowly defined domains, as opposed to within cross-domain or open-ended reasoning environments.

Additionally, because the training datasets are smaller and more focused, it is vital that smaller models' training data is of particularly high quality. Poor training data will severely hamper small model accuracy and degrade trustworthiness.

Successful deployment of a domain-specific model requires in-house expertise, not only in integration and fine-tuning, but also in MLOps and inference optimization. Within the enterprise, IT personnel must be tasked with monitoring, fine-tuning, and retraining the small models as the organization's processes, workflows, and data evolve.

Lastly, even though right-sized models are comparatively simpler than LLMs, they are not without governance complexity; like their LLM counterparts, small models still require controls around explainability, versioning, access, and auditability.

Opting for a Hybrid Approach

Depending on the size and nature of an enterprise's environment, there are instances where smaller models complement, rather than replace, larger models. A hybrid approach could involve using a domain-specific model for initial data processing, whereby more complex cases are routed to an LLM.

Another hybrid strategy could be to use smaller models for repeatable and sensitive workflows, while concurrently utilizing larger language models for exploratory or broad reasoning tasks. Such an approach can keep costs relatively low, while still maximizing value.

Key Takeaways

When it comes to model usage and ITOps, bigger isn't always better. Despite delivering an impressive multi-step reasoning capability, LLMs come with their fair share of baggage, including high costs, latency issues, limited controllability, and governance risks.

For most ITOps activities, smaller language models designed for precision and efficiency are preferable. After all, most routine ITOps tasks, such as log analysis and anomaly detection, require low latency and a very specific knowledge base.

By fine-tuning smaller models on domain-specific data, IT personnel can effectively optimize their environment for unique use cases. To put it simply, most commonplace ITOps tasks do not require LLM capabilities; in fact, a domain-specific model can often get the job done quicker, cheaper, and many times, safer.

John Donegan is an Enterprise Analyst at ManageEngine

Hot Topics

The Latest

For fifteen years, observability lived downstream of everything else. Code shipped, something broke, an engineer went to the dashboards. The job was forensic. The pillars we built, such as logs, metrics, and traces, were designed for that role: tell a human what just happened, fast enough that they can make it stop. That role has quietly ended ...

Hybrid IT has become the standard operating model for enterprises — but that companies are still looking for the right hybrid IT mix, according to the 2026 State of the Data Center Report from CoreSite. After years of cloud migration and hybrid adoption, organizations are shifting their focus from deciding whether to use cloud, colocation or on-premises infrastructure to determining which workloads belong in each environment ...

Pilots are everywhere, stakeholders are seeking results, businesses are pushing for new tools, and IT teams are being asked to make AI secure, reliable, and useful at scale. But as organizations move from testing AI to operationalizing it, many are discovering that the biggest barrier is not the model, the use case, or even the budget. It is the file data foundation within ...

Fast or cheap? For most of my career in engineering, speed and quality sat on opposite ends of a seesaw. The "OR" in "fast or cheap" was non-negotiable. It was expected that pushing for faster releases meant that something in quality would give way. Tightening quality controls meant the schedule slipped. Every engineering leader I know has lived some version of that tradeoff ... The seesaw is starting to level out ...

I have been building enterprise software for more than 20 years ... One thing stays true across all of it: You do not find out your foundation is wrong during the crisis. You find out when the debt comes due. For a lot of organizations, that bill is arriving now. New research ... puts hard numbers on something practitioners have been sensing for a while. The telemetry problem isn't coming. It's already here ...

The rapid growth of AI workloads is pushing traditional log management approaches to their limits, according to The State of Log Management 2026 report from Dynatrace. Modern logs have become critical to understanding, validating, and securing AI-driven decisions, helping organizations ensure reliability, compliance, and performance at scale. However, the volume and complexity of AI telemetry are overwhelming legacy tools ...

For years, secure connectivity has relied on a familiar pattern: route traffic back to centralized gateways, inspect it, and then allow access. This model worked when applications lived in a handful of data centers and users were largely confined to offices. That model is now under strain. Applications are distributed across clouds, users connect from everywhere, and real-time workloads demand performance that centralized inspection points struggle to deliver. As traffic volumes grow and latency expectations shrink, routing everything through a small number of control points has become both a performance bottleneck and a resilience risk. The future of secure connectivity requires a different approach ...

The AI experimentation phase is over, and the private cloud is where enterprise AI workloads are being deployed for security and scale, according to Private Cloud Outlook 2026, a new report from Broadcom ... 2026 marks an acceleration into a full AI tipping point. The shift is being shaped by three forces — costs, complexity, and control — that public cloud environments are increasingly failing to address for production AI at scale. Key findings from the report include ...

44% of organizations have reported an outage in the past year tied to suppressed or ignored alerts, and 78% had at least one incident where no alert was fired at all ... Engineers learned about failures from customers. That gap between what our tools report and what our customers experience is the problem DevOps teams have been quietly solving with GenAI tooling, even as most enterprises continue to run their NOCs on manual alert triage ...

Cloud outages are usually described as technical failures. When a service goes down, a dependency breaks, or a region has issues, the focus immediately shifts to infrastructure. But if you look closely at how these incidents actually unfold, the root cause is rarely the technology itself. It is almost always tied to decisions made earlier, during design, implementation, or day-to-day operations. The system behaves the way it was built. The real question is how it was built ...

Why ITOps Need Right-Sized AI, Not Bigger Models

John Donegan
ManageEngine

Over the past few years, large language models (LLMs) have revolutionized the software industry. Given their ability to excel at multi-step reasoning, LLMs have helped enterprises streamline workflows and adapt to the unknown. However, employing such models comes with sky-high costs, latency issues, and limited flexibility. In the realm of IT operations, it is generally wiser to employ smaller, domain-specific models instead.

Most tasks within ITOps do not require LLMs. Utilizing a billion parameter model to automate routine ITOps tasks, like ticket triaging and classification, is likely a colossal waste of money. What's more, LLMs have much higher latency than smaller, domain-specific models, and repetitive IT operations, such as alert creation and incident triage, require fast responses. Importantly, most ITOps tasks are well-defined, making right-sized, domain-specific models a great fit.

The Nature of ITOps

ITOps tasks are generally latency-sensitive, high-volume, and domain-specific; within many enterprises, thousands of events are processed within a narrow and predictable context. By nature, many of these tasks, including ticket routing, anomaly detection, and log generation, are repetitive and highly-structured.

Put simply, high volume, routine tasks require low-latency responses, and domain-specific LLMs provide exactly this. Not only are right-sized models faster, but they are also more predictable and easier to fine-tune to account for a specific environment.

Before rolling out a language model of any size into an organization's workflows, it is important to match the solution to the need at hand. When it comes to ITOps, there is often a need to automate narrow, routing tasks. By fine-tuning small models with proprietary data and right-sizing these models to one's specific workloads, enterprises can maximize accuracy and speed, while keeping costs under control.

When considering costs, IT personnel should always be sure to take operational metrics, such as latency, throughput, system uptime, and cost per query, into consideration. It's best not to over-engineer AI in ITOps, as this will introduce unnecessary complexity, add latency, and increase costs to one's organization.

The Compliance and Data Privacy Benefits to Domain-Specific Models

Given that smaller, domain-specific models are easier to run locally, all of the enterprise's sensitive infrastructure can often be retained in-house. With models running on-prem or in a private cloud, sensitive data can remain within the confines of the enterprise, reducing privacy and regulatory risks. In highly regulated industries, such as healthcare and financial services, this benefit cannot be overstated.

By not using cloud-based APIs or sending sensitive data to third-party platforms, enterprises gain more control and more easily adhere to compliance requirements. The limited scope of smaller models makes them easier to audit as well. For many cost-conscious enterprises, running self-hostable, right-sized models is far better than having an API dependency, which can potentially expose the organization to external threats outside of one's control.

Trade-Offs, Challenges, and Limitations of Smaller Models

Although domain-specific, right-sized models certainly offer strong enterprise alignment, they are not without limitations. Smaller models have more limited general reasoning capabilities, causing them to perform best within narrowly defined domains, as opposed to within cross-domain or open-ended reasoning environments.

Additionally, because the training datasets are smaller and more focused, it is vital that smaller models' training data is of particularly high quality. Poor training data will severely hamper small model accuracy and degrade trustworthiness.

Successful deployment of a domain-specific model requires in-house expertise, not only in integration and fine-tuning, but also in MLOps and inference optimization. Within the enterprise, IT personnel must be tasked with monitoring, fine-tuning, and retraining the small models as the organization's processes, workflows, and data evolve.

Lastly, even though right-sized models are comparatively simpler than LLMs, they are not without governance complexity; like their LLM counterparts, small models still require controls around explainability, versioning, access, and auditability.

Opting for a Hybrid Approach

Depending on the size and nature of an enterprise's environment, there are instances where smaller models complement, rather than replace, larger models. A hybrid approach could involve using a domain-specific model for initial data processing, whereby more complex cases are routed to an LLM.

Another hybrid strategy could be to use smaller models for repeatable and sensitive workflows, while concurrently utilizing larger language models for exploratory or broad reasoning tasks. Such an approach can keep costs relatively low, while still maximizing value.

Key Takeaways

When it comes to model usage and ITOps, bigger isn't always better. Despite delivering an impressive multi-step reasoning capability, LLMs come with their fair share of baggage, including high costs, latency issues, limited controllability, and governance risks.

For most ITOps activities, smaller language models designed for precision and efficiency are preferable. After all, most routine ITOps tasks, such as log analysis and anomaly detection, require low latency and a very specific knowledge base.

By fine-tuning smaller models on domain-specific data, IT personnel can effectively optimize their environment for unique use cases. To put it simply, most commonplace ITOps tasks do not require LLM capabilities; in fact, a domain-specific model can often get the job done quicker, cheaper, and many times, safer.

John Donegan is an Enterprise Analyst at ManageEngine

Hot Topics

The Latest

For fifteen years, observability lived downstream of everything else. Code shipped, something broke, an engineer went to the dashboards. The job was forensic. The pillars we built, such as logs, metrics, and traces, were designed for that role: tell a human what just happened, fast enough that they can make it stop. That role has quietly ended ...

Hybrid IT has become the standard operating model for enterprises — but that companies are still looking for the right hybrid IT mix, according to the 2026 State of the Data Center Report from CoreSite. After years of cloud migration and hybrid adoption, organizations are shifting their focus from deciding whether to use cloud, colocation or on-premises infrastructure to determining which workloads belong in each environment ...

Pilots are everywhere, stakeholders are seeking results, businesses are pushing for new tools, and IT teams are being asked to make AI secure, reliable, and useful at scale. But as organizations move from testing AI to operationalizing it, many are discovering that the biggest barrier is not the model, the use case, or even the budget. It is the file data foundation within ...

Fast or cheap? For most of my career in engineering, speed and quality sat on opposite ends of a seesaw. The "OR" in "fast or cheap" was non-negotiable. It was expected that pushing for faster releases meant that something in quality would give way. Tightening quality controls meant the schedule slipped. Every engineering leader I know has lived some version of that tradeoff ... The seesaw is starting to level out ...

I have been building enterprise software for more than 20 years ... One thing stays true across all of it: You do not find out your foundation is wrong during the crisis. You find out when the debt comes due. For a lot of organizations, that bill is arriving now. New research ... puts hard numbers on something practitioners have been sensing for a while. The telemetry problem isn't coming. It's already here ...

The rapid growth of AI workloads is pushing traditional log management approaches to their limits, according to The State of Log Management 2026 report from Dynatrace. Modern logs have become critical to understanding, validating, and securing AI-driven decisions, helping organizations ensure reliability, compliance, and performance at scale. However, the volume and complexity of AI telemetry are overwhelming legacy tools ...

For years, secure connectivity has relied on a familiar pattern: route traffic back to centralized gateways, inspect it, and then allow access. This model worked when applications lived in a handful of data centers and users were largely confined to offices. That model is now under strain. Applications are distributed across clouds, users connect from everywhere, and real-time workloads demand performance that centralized inspection points struggle to deliver. As traffic volumes grow and latency expectations shrink, routing everything through a small number of control points has become both a performance bottleneck and a resilience risk. The future of secure connectivity requires a different approach ...

The AI experimentation phase is over, and the private cloud is where enterprise AI workloads are being deployed for security and scale, according to Private Cloud Outlook 2026, a new report from Broadcom ... 2026 marks an acceleration into a full AI tipping point. The shift is being shaped by three forces — costs, complexity, and control — that public cloud environments are increasingly failing to address for production AI at scale. Key findings from the report include ...

44% of organizations have reported an outage in the past year tied to suppressed or ignored alerts, and 78% had at least one incident where no alert was fired at all ... Engineers learned about failures from customers. That gap between what our tools report and what our customers experience is the problem DevOps teams have been quietly solving with GenAI tooling, even as most enterprises continue to run their NOCs on manual alert triage ...

Cloud outages are usually described as technical failures. When a service goes down, a dependency breaks, or a region has issues, the focus immediately shifts to infrastructure. But if you look closely at how these incidents actually unfold, the root cause is rarely the technology itself. It is almost always tied to decisions made earlier, during design, implementation, or day-to-day operations. The system behaves the way it was built. The real question is how it was built ...