{
    "totalCount": 11074,
    "pageSize": 10,
    "pageNumber": 1,
    "totalPages": 1108,
    "posts": [
        {
            "post_type": "post",
            "post_id": 307470,
            "permalink": "https:\/\/www.forrester.com\/blogs\/what-are-best-practice-cx-metrics\/",
            "title": "What Are Best-Practice CX Metrics?",
            "date": "Nov 5, 2026 06:11:10",
            "excerpt": "This is a really dangerous question that can lead your CX efforts astray and waste your time. If you don’t believe me, bear with me… does this feel familiar? You are doing all the “best-practice” things: measure NPS at relationship level, CSAT in key journeys and ease at the touchpoint level. You try to show […]",
            "body": "<p>This is a really dangerous question that can lead your CX efforts astray and waste your time. If you don&#8217;t believe me, bear with me&#8230; does this feel familiar?<\/p>\n<ul>\n<li>You are doing all the &#8220;best-practice&#8221; things: measure NPS at relationship level, CSAT in key journeys and ease at the touchpoint level. You try to show how CX drives the business and why your team is valuable.<\/li>\n<li>But stakeholders don&#8217;t seem to care about customer issues you identify or about movement in CX metrics. And they tell you that what you report isn&#8217;t &#8220;actionable&#8221; enough.<\/li>\n<\/ul>\n<p>This is the quagmire you get stuck in when you assume other organizations&#8217; metrics should become your metrics.<\/p>\n<blockquote><p>The best CX metric isn&#8217;t NPS, CSAT, or Ease. It&#8217;s the metric that shows whether you are getting closer to a CX performance objective.<\/p><\/blockquote>\n<p>That means you need to know where you&#8217;re trying to go in the first place &#8211; a step that&#8217;s missing in many organizations I observe. And there&#8217;s a second step between defining a CX objective and choosing a CX metric that teams often skip, too. I&#8217;ll get into that below.<\/p>\n<p>AI makes this already urgent problem even more urgent. That&#8217;s because AI makes skipping steps easier than ever: Ask Copilot, Claude or ChatGPT for &#8220;best-practice&#8221; CX metrics and you&#8217;ll get an answer in seconds. But easier access to other companies&#8217; metrics doesn&#8217;t make those metrics right for you. This is one of the dysfunctional CX measurement practices I mentioned in <em><a href=\"https:\/\/www.forrester.com\/blogs\/will-ai-fix-your-cx-measurement-or-make-it-worse\/\">Will AI Fix Your CX Measurement Or Make It Worse?<\/a><\/em><\/p>\n<h2>Why Are &#8220;Best-Practice&#8221; CX Metrics Dangerous?<\/h2>\n<p>Leaders and CX teams often reach for familiar metrics because they feel safe: \u201cNobody was ever fired for using NPS.\u201d But familiarity doesn&#8217;t mean fit. A standard metric may not tell you whether you&#8217;re making progress toward the CX performance objective you&#8217;re after.<\/p>\n<p>Standards like satisfaction, NPS or ease may be perfectly reasonable choices in some situations. But if you want customers to feel confident, for example, neither standard measures confidence directly. They may correlate with it, but that doesn&#8217;t make them measures of confidence.<\/p>\n<p>Familiar metrics also come with baggage: embedded assumptions about what differences in scores mean. With NPS, for example, treating promoters, passives, and detractors as meaningfully different groups assumes those classifications correspond to differences that matter to your business. With standard metrics, you inherit those assumptions.<\/p>\n<p>Unfortunately, once you&#8217;ve chosen a metric, it is hard to undo. Leaders become attached to trend lines, teams learn how the metric behaves, benchmarks, targets, and incentives accumulate around it.<\/p>\n<h2>But Don&#8217;t We Need Standard CX Metrics So We Can Benchmark?<\/h2>\n<p>Only when the metric fits. Comparing the wrong metric with competitors simply creates more confident misdirection. You may use a standardized metric for external comparison while relying on different metrics internally. Also, many so-called standard metrics aren&#8217;t standardized &#8211; data collection methods and sample strategy.<\/p>\n<p>The only way to do a real benchmark is to do a double-blind survey and in one of those you can include any metric and benchmark it.<\/p>\n<h2>How Do We Know What The Right CX Metric Is?<\/h2>\n<p>The right metric captures evidence that shows whether you are getting closer to your objectives. That&#8217;s why metric choice starts with the objective, not the metric. But don&#8217;t jump from objectives straight to metrics. There is one more step.<\/p>\n<p>Think about health.<\/p>\n<ul>\n<li>If you ask your doctor, \u201cWhat&#8217;s the right metric for health?\u201d you might end up with familiar measures like weight or blood pressure. They aren&#8217;t bad measures. But are they the right measures for what <em>you<\/em> want to achieve?<\/li>\n<li>Say you want to get stronger. Now you have an objective. Next ask: What evidence would convince me that I&#8217;m getting stronger? Perhaps you can lift heavier weights, perform more repetitions, or gain muscle mass. Only then do you choose the metrics that capture that evidence.<\/li>\n<\/ul>\n<p>CX measurement works the same way. You need to ask two questions:<\/p>\n<h3><strong>Step 1: Which <span style=\"text-decoration: underline;\">CX performance objective<\/span> do you want to achieve?<\/strong><\/h3>\n<p>A broad business goal isn&#8217;t enough. You need to translate it into a CX performance objective: a clear statement of how the customer experience needs to change to help achieve that business goal.<\/p>\n<ul>\n<li><strong>Business goal: What does the business need to achieve? <\/strong>This comes from your overall business strategy. Identify the direction the business is trying to go.\u00a0For example, your organization needs to reduce churn.<\/li>\n<li><strong>Desired customer behavior: How would customers need to behave for you to achieve that business goal? <\/strong>Pinpoint desired and undesired customer behaviors.\u00a0For example, more customers need to stay.<\/li>\n<li><strong>CX performance objective: What would customers need to experience for the desired behavior to become more likely?\u00a0<\/strong>Don\u2019t describe what you plan to do. Describe what customers will experience if you succeed. Performance measurement expert Stacey Barr calls this a \u201c<a href=\"https:\/\/pump.academy\/articles-and-whitepapers\/the-grammar-of-a-measurable-goal\/\">future fact<\/a>.\u201d\u00a0For example, your analysis may show that customers who leave experience high friction and perceive your products as less useful. Your CX bet might therefore be: Customers can work with us without unnecessary effort and find our products useful.<\/li>\n<\/ul>\n<p>With a CX performance objective, you&#8217;re still not ready to choose a metric.<\/p>\n<h3><strong>Step 2: What <span style=\"text-decoration: underline;\">evidence<\/span> would help you track if you are making progress toward that objective?<\/strong><\/h3>\n<p>Just as with getting stronger, first ask what evidence would convince you that you&#8217;re making progress.<\/p>\n<ul>\n<li><strong>Evidence: What evidence would convince you that you are getting closer to your objective?\u00a0<\/strong>Identify the strongest evidence, then assess what\u2019s feasible to collect. For example, evidence of when customers can work with you without unnecessary effort, they might tell you that working with you feels easy, call for help less often, abandon fewer journeys, or rage-click less. If most customers work digitally, the strongest evidence may be in digital behaviors and overall perceptions of ease.<\/li>\n<li><strong>Metrics: Which metrics can capture that evidence?\u00a0<\/strong>Define each metric precisely, including its definition, data source, calculation, and the decisions it will support. For example, you may define a digital analytics frustration score to measure effort at the touchpoint level and analyze perceived effort through a relationship survey. To apply this to your situation, use <a href=\"https:\/\/www.forrester.com\/report\/forresters-metrics-design-tool-and-template\/RES195502\">Forrester\u2019s Metrics Design Tool And Template<\/a> as a guide.<\/li>\n<\/ul>\n<h2>Reality Check: Do You Have A Measurement Problem Or A Strategy Problem?<\/h2>\n<p>Don&#8217;t rely on Copilot, Claude or ChatGPT to produce your CX metrics for you. Start with your CX performance objective instead, and use AI tools to help you and stakeholders explore the evidence and metrics that could show whether you&#8217;re making progress.<\/p>\n<p>If you have a good CX strategy, much of this work is already done: The strategy defines how the customer experience needs to change and why. If you&#8217;re struggling to decide what to measure, you may not have a measurement problem. You may have a strategy problem. And \u201cbe customer-centric\u201d isn&#8217;t a strategy &#8211; you can &#8211; and need to &#8211; do much better but we have <a href=\"https:\/\/www.forrester.com\/blogs\/orchestrate-cx-success-with-forresters-cx-vision-and-strategy-research-and-tools\/\">CX strategy research and tools<\/a> for you.<\/p>\n<p><strong><em>What\u2019s Next On Your Journey To Making Your Metrics Work For You Again?<\/em><\/strong><\/p>\n<p><em>Read my blog <\/em><em><a href=\"https:\/\/www.forrester.com\/blogs\/will-ai-fix-your-cx-measurement-or-make-it-worse\/\">Will AI Fix Your CX Measurement Or Make It Worse?<\/a><\/em><\/p>\n<p><em>If you have Forrester Decisions access, dive into all the details, recommendations and exampples in these reports and request an <a href=\"https:\/\/www.forrester.com\/inquiry\">analyst call<\/a> with me:<\/em><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><em><a href=\"https:\/\/www.forrester.com\/go?objectid=RES198591\">Escape Dysfunctional Measurement Before CX Pays The Price<\/a><\/em><\/li>\n<li><em><a href=\"https:\/\/www.forrester.com\/report\/forresters-metrics-design-tool-and-template\/RES195502\">Forrester\u2019s Metrics Design Tool And Template<\/a><\/em><\/li>\n<li><em><a href=\"https:\/\/www.forrester.com\/go?objectid=RES198590\">Define Metrics That Measure What Matters In CX<\/a><\/em><\/li>\n<li><em><a href=\"https:\/\/www.forrester.com\/go?objectid=RES198589\">Use Metrics More Effectively To Improve CX<\/a><\/em><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Follow me on Forrester and on <a href=\"https:\/\/www.linkedin.com\/in\/maxieschmidt\/?lipi=urn%3Ali%3Apage%3Ad_flagship3_search_srp_people%3B3CGyayf1Q1ycIGJkPcwnIQ%3D%3D\">LinkedIn<\/a>.<\/p>\n",
            "category": [
                {
                    "term_id": 2242,
                    "name": "Age of the Customer",
                    "slug": "age-of-the-customer",
                    "description": "",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/age-of-the-customer\/"
                },
                {
                    "term_id": 2246,
                    "name": "Customer Experience Measurement",
                    "slug": "customer-experience-measurement",
                    "description": "Customer experience measurement ensures that CX investments are performing. It also helps stakeholders understand the value of CX. Explore Forrester's insights on customer experience measurement.\r\n\r\n<a href=\"\/customer-experience\/\">Discover how Forrester supports customer experience leaders.<\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/customer-experience-measurement\/"
                }
            ],
            "meta_desc": "AI can surface \"best-practice\" CX metrics in seconds. Learn how to choose effective CX metrics instead of defaulting to NPS or CSAT.",
            "author": "Maxie Schmidt"
        },
        {
            "post_type": "post",
            "post_id": 307587,
            "permalink": "https:\/\/www.forrester.com\/blogs\/ai-agents-need-more-than-least-privilege-they-need-least-agency\/",
            "title": "AI Agents Need More Than Least Privilege \u2014 They Need Least Agency",
            "date": "Nov 4, 2026 13:07:49",
            "excerpt": "For decades, cybersecurity professionals have relied on the principle of least privilege: Only give identities the access needed to perform their jobs. That principle remains essential. But AI agents have exposed its limits. An AI agent can have exactly the right permissions and still do the wrong thing Consider an agent authorized to issue customer [&hellip;]",
            "body": "<p>For decades, cybersecurity professionals have relied on the principle of least privilege: Only give identities the access needed to perform their jobs. That principle remains essential. But AI agents have exposed its limits.<\/p>\n<h3><strong>An AI agent can have exactly the right permissions and still do the wrong thing<\/strong><\/h3>\n<p>Consider an agent authorized to issue customer refunds. Least privilege can constrain which customer records and payment systems the agent can access. But those permissions alone don\u2019t determine how large a refund it can approve, under what circumstances it should act, or whether it can execute thousands of refunds without human review. The problem isn\u2019t necessarily excessive access \u2014 it\u2019s excessive agency.<\/p>\n<p>Least privilege primarily constrains access: <em>What resources can this identity reach?<\/em> AI agents introduce additional dimensions because they can make decisions, invoke tools, pursue objectives, and act with varying degrees of independence. Securing them therefore requires organizations to govern not just access but also authority and autonomy:<\/p>\n<ul>\n<li><strong>Access:<\/strong> What resources, data, systems, and tools can the agent reach?<\/li>\n<li><strong>Authority:<\/strong> What decisions and consequential actions can it make using that access?<\/li>\n<li><strong>Autonomy:<\/strong> How independently can it make those decisions and take those actions?<\/li>\n<\/ul>\n<p>That\u2019s the idea behind least agency, which Forrester defines as:<\/p>\n<p><em>Continuous enforcement of the minimum decision-making authority and operational autonomy an AI agent requires to pursue its authorized purpose.<\/em><\/p>\n<h3><strong>Least agency doesn\u2019t replace least privilege \u2014 it extends it<\/strong><\/h3>\n<p>Achieving least agency in practice means continuously constraining and adjusting access, authority, and autonomy to the agent\u2019s purpose and operating context. Too much access creates the familiar risk carried by excessive permissions. But even tightly controlled access paired with excessive authority or autonomy can produce unsafe outcomes. At the same time, constrain an agent too tightly, and it cannot accomplish the objective that made it valuable in the first place.<\/p>\n<p>The challenge is not simply minimizing access but giving an agent enough agency to accomplish its objective and nothing more. That also makes least agency more than an identity and access management (IAM) problem.<\/p>\n<p>Least agency requires integration across security domains, a point emphasized in Forrester\u2019s <a href=\"https:\/\/www.forrester.com\/report\/introducing-forresters-aegis-framework-agentic-ai-enterprise-guardrails-for-information-security\/RES185394\">AEGIS framework<\/a> for AI security. IAM establishes the agent\u2019s identity, access, and delegation relationships. AI governance establishes its purpose, ownership, accountability, and operating boundaries. Runtime security monitors what the agent is doing and enables controls to adjust or interrupt its actions as context and risk change. Together, these capabilities provide the foundation for continuously determining what an agent can access, what it is authorized to do, and how independently it should be allowed to act.<\/p>\n<p>I\u2019ll be exploring least agency and how security teams can operationalize it in my track session, \u201cFrom Least Privilege To Least Agency: IAM For Agentic Architectures,\u201d at Forrester\u2019s <a href=\"https:\/\/www.forrester.com\/event\/security-risk\/agenda\/\">Security &amp; Risk Forum<\/a>, taking place this November 9\u201310 in Washington, DC. And as always, if you\u2019re a Forrester client and want to know more, please reach out and set up an <a href=\"https:\/\/www.forrester.com\/inquiry\">inquiry or guidance session<\/a>.<\/p>\n",
            "category": [
                {
                    "term_id": 2395,
                    "name": "IAM - Identity And Access Management",
                    "slug": "iam-identity-access-management",
                    "description": "Are they who they say they are? Digital has made identity &amp; access management (IAM) crucial and complicated. Read our insights.\r\n\r\n<a href=\"\/technology\/\">Discover how Forrester supports IT leaders.<\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/iam-identity-access-management\/"
                },
                {
                    "term_id": 51787,
                    "name": "Security management",
                    "slug": "security-management",
                    "description": "",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/security-management\/"
                }
            ],
            "author": "Geoff Cairns"
        },
        {
            "post_type": "post",
            "post_id": 307733,
            "permalink": "https:\/\/www.forrester.com\/blogs\/cvs-healths-split-signals-a-reckoning-for-healthcare-megabrands\/",
            "title": "CVS Health\u2019s Split Signals A Reckoning For Healthcare Megabrands",
            "date": "Nov 4, 2026 13:02:56",
            "excerpt": "Apparently, the US midterm elections are not all that happened yesterday in terms of big news: CVS has announced that it\u2019s officially breaking up \u2014 and this time, it means it. CVS will split retail pharmacies from PBM operations and insurance CVS Health plans to break up its $117 billion business, separating its retail pharmacies [&hellip;]",
            "body": "<p>Apparently, the US midterm elections are not all that happened yesterday in terms of big news: CVS has announced that <a href=\"https:\/\/www.cvshealth.com\/news\/company-news\/cvs-health-announces-intent-to-create-two-distinct-leaders-in-healthcare.html\">it\u2019s officially breaking up<\/a> \u2014 and this time, <a href=\"https:\/\/www.forrester.com\/blogs\/cvs-eyes-a-splitting-heart-decision-separating-its-core-business-to-shock-future-growth\/\">it means it<\/a>.<\/p>\n<h3><strong>CVS will split retail pharmacies from PBM operations and insurance<\/strong><\/h3>\n<p>CVS Health <a href=\"https:\/\/s206.q4cdn.com\/752775519\/files\/content_files\/Q3-2026-Investor-Update-Presentation.pdf\">plans to break up its $117 billion business<\/a>, separating its retail pharmacies from the Caremark pharmacy benefit management (PBM) operations and the Aetna insurance company. The separation will create two separate publicly traded companies, and CVS Health shareholders will own shares in both companies.<\/p>\n<p>One company \u2014 which will retain the name CVS Health for now \u2014 will house its insurance arm Aetna, the PBM Caremark, plus Oak Street Health, Signify Health, and its specialty pharmacy business. The retail company, to be known as CVS Pharmacy, would include roughly 9,000 retail pharmacies, MinuteClinic, and mail-order pharmacy operations, as well as the newly created Health100 engagement platform. Health100 aims to be the connective tissue that acts as the front door for care. The leadership team shared in today\u2019s earnings call that they hope this separation enables Health100 to be more widely adopted across the industry and will look to position it to be a leading customer engagement platform.<\/p>\n<h3><strong>Owning more of the healthcare journey does not necessarily make that journey better<\/strong><\/h3>\n<p>The split unwinds a central piece of the premise behind CVS Health\u2019s <a href=\"https:\/\/investors.cvshealth.com\/news\/news-details\/2018\/CVS-Health-Completes-Acquisition-of-Aetna-Marking-the-Start-of-Transforming-the-Consumer-Health-Experience\/default.aspx\">$78 billion acquisition of Aetna in 2018<\/a>: Put a pharmacy, PBM, insurer, and care-delivery assets under one roof, and the resulting scale and coordination will make healthcare simpler and less expensive. Yet large megabrands in healthcare have faced scrutiny for limiting access to care and driving up prices for insurance, prescriptions, and care services.<\/p>\n<p>In recent years, healthcare companies, <a href=\"https:\/\/www.forrester.com\/report\/the-seven-trends-for-us-health-insurers-in-2026\/RES193962\">especially insurers<\/a>, have faced significantly elevated financial trends and headwinds, including challenging medical cost trends, sustained medical utilization and pharmacy spending, and margin pressure.\u00a0Today, CVS Health <a href=\"https:\/\/www.cvshealth.com\/content\/dam\/enterprise\/cvs-enterprise\/pdfs\/2026\/Q3-2026-EarningsRelease.pdf\">reported third-quarter revenue<\/a> of $108.4 billion, up 5.4% year over year, and raised its 2026 revenue guidance to at least $420 billion. As CVS Health President and Chairman David Joyner shared in the earnings call today, \u201cWe are taking deliberate action and will continue to build on our momentum.\u201d<\/p>\n<p>CVS aims to ensure that each company remains a leader in its respective markets, allowing each to focus on their respective businesses and to become more agile. As Joyner stated in the earnings call, \u201cthe same mission, sharper focus.\u201d The move also allows each company to more effectively adapt to rapidly changing regulatory pressure and pursue additional partnerships in the future.<\/p>\n<h3><strong>Regulatory, economic, and consumer pressures are reshaping healthcare megabrands <\/strong><\/h3>\n<p>Concentration risk creates significant impacts for the industry and all stakeholders. Mounting pressure on healthcare megabrands shows no signs of slowing:<\/p>\n<ul>\n<li><strong>Regulatory pressure on vertically integrated entities or megabrands is growing.<\/strong> Rising regulation has changed the strategic calculus for these megabrands. Policymakers at both the federal and state levels continue to challenge the joint ownership of PBMs, pharmacies, insurers, and care delivery assets and <a href=\"https:\/\/www.dol.gov\/index.php\/newsroom\/releases\/ebsa\/ebsa20261029\">push for greater transparency<\/a>. That scrutiny carries significant cost and complexity, as vertically integrated megabrands should keep proving the benefits to consumers, not just shareholders. With Democrats <a href=\"https:\/\/www.reuters.com\/live\/us-midterm-elections-2026-live-american-voters-cast-verdict-trump-congress-2026-11-03\/\">poised to control both the House of Representatives and the Senate<\/a>, healthcare megabrands should prepare for even greater scrutiny in 2027. Vertical integration, PBM practices, healthcare consolidation, and affordability are <a href=\"https:\/\/www.forrester.com\/blogs\/the-pbm-paradox-catalysts-of-concentration-risk-in-the-healthcare-ecosystem\/\">likely to remain squarely in policymakers\u2019 sights<\/a>.<\/li>\n<li><strong>The economics of the megabrand is getting harder.<\/strong> CVS is making the move amid a strong financial position, in contrast to a weakened position, when a split was <a href=\"https:\/\/www.forrester.com\/blogs\/cvs-eyes-a-splitting-heart-decision-separating-its-core-business-to-shock-future-growth\/\">first rumored in 2024<\/a>. As Joyner shared in today\u2019s earnings call, CVS can take this action today because of the progress it has made since 2024. He noted that the company has strengthened its balance sheet, reshaped the leadership team, expanded its technology capabilities, and revitalized the Aetna business amid headwinds on the Medicare Advantage business. Competitors are exploring partnerships, curated ecosystems, and AI-powered orchestration to create connected experiences without absorbing the cost and complexity of owning every part of the journey. Joyner acknowledged in the earnings call today that the split sets up CVS Pharmacy and CVS Health for expanded future partnerships.<\/li>\n<li><strong>Consumers aren\u2019t waiting for the healthcare system to fix itself.<\/strong> Our latest research finds that <a href=\"https:\/\/www.forrester.com\/report\/predictions-2027-healthcare\/RES202220\">AI is already enabling consumers to navigate healthcare<\/a> without relying exclusively on insurers, providers, or pharmaceutical companies. That means the competitive advantage increasingly comes from empowering consumers to reach a better decision with more confidence, not just owning more assets. A growing population of intentionally uninsured going without coverage and paying for care out of pocket has created additional challenges for health insurers. <a href=\"https:\/\/www.forrester.com\/report\/forresters-us-health-insurers-brand-experience-index-rankings-2026\/RES199328\">Less than half of US online adults<\/a> said health insurance was worth it in 2026. Breaking off Health100 from the insurance business aims to make it a solution that responds to competitive pressure and be an option for more health insurers that are scrambling to update their digital experiences to stay on par with big tech innovations gaining healthcare consumer market share, including OpenAI\u2019s ChatGPT and Google\u2019s Gemini.<\/li>\n<\/ul>\n<h3>The megabrand is not dead \u2014 but must shore up CX to attract and retain customers<\/h3>\n<p>The healthcare megabrand era is not over, but the remaining large conglomerates must prove that their scale makes care more affordable, accessible, connected, and trustworthy. Our <a href=\"https:\/\/www.forrester.com\/report\/forresters-us-health-insurers-total-experience-score-rankings-2026\/RES196913\">2026 total experience research<\/a> shows that the health insurance industry is improving on customer experience and brand experience but still has significant room to strengthen the overall relationship with consumers. Yes, a breakup gives each new CVS company an opportunity to sharpen its value proposition \u2014 but corporate simplification cannot come at the expense of consumer simplicity. If the CVS split creates more handoffs or fragmented experiences, consumers will bear the cost of that complexity, and they have more choices than ever before to stay or find alternatives.<\/p>\n<p>We will continue to watch as this strategic shift evolves. Forrester clients can:<\/p>\n<ul>\n<li>Ask Forrester AI, \u201c<a href=\"https:\/\/www.forrester.com\/forrester-ai?query=What%20does%20a%20CVS%20breakup%20mean%20for%20consumers%3F\">What does a CVS breakup mean for consumers?<\/a>\u201d<\/li>\n<li>Schedule time with us \u2014 <a href=\"https:\/\/www.forrester.com\/inquiry?id=4&amp;bioId=BIO13084\">Arielle Trzcinski<\/a> and <a href=\"https:\/\/www.forrester.com\/inquiry?id=4&amp;bioId=BIO1129\">Sucharita Kodali<\/a> \u2014 to talk more about the future of health insurance and retail health.<\/li>\n<\/ul>\n",
            "category": [
                {
                    "term_id": 2242,
                    "name": "Age of the Customer",
                    "slug": "age-of-the-customer",
                    "description": "",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/age-of-the-customer\/"
                },
                {
                    "term_id": 2132,
                    "name": "healthcare trends",
                    "slug": "healthcare",
                    "description": "The healthcare industry has lagged in CX and digital transformation. Members and patients are eager for better experiences that mirror the level of service and ease they're used to from consumer experiences. Use our insights to start closing the gap and boost satisfaction.",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/healthcare\/"
                },
                {
                    "term_id": 2158,
                    "name": "Retail Trends",
                    "slug": "retail",
                    "description": "Retail is continuously evolving as consumers expect a seamless blend of physical and digital experiences. Read our insights and advice for staying a step ahead.\r\n\r\nDiscover how Forrester supports <a href=\"\/customer-experience\/\">customer experience<\/a> and <a href=\"\/b2c-marketing\/\">B2C marketing<\/a> professionals.",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/retail\/"
                }
            ],
            "meta_desc": "If the CVS split creates more handoffs or fragmented experiences, consumers will bear the cost of that complexity, and they have more choices than ever before to stay or find alternatives.",
            "author": "Arielle Trzcinski",
            "coauthors": "Sucharita Kodali"
        },
        {
            "post_type": "post",
            "post_id": 307590,
            "permalink": "https:\/\/www.forrester.com\/blogs\/sap-teched-2026-all-in-on-ai\/",
            "title": "SAP TechEd 2026: All In On AI",
            "date": "Nov 4, 2026 09:42:29",
            "excerpt": "\u201cBuild AI that knows your business\u201d is a tagline that SAP uses in its online collateral, and AI tooling with business context sits at the core of several announcements SAP made at TechEd 2026 in Berlin on October 27\u201329. We came away with the impression that SAP\u2019s most powerful differentiators are at risk of being [&hellip;]",
            "body": "<p>\u201cBuild AI that knows your business\u201d is a tagline that SAP uses in its online collateral, and AI tooling with business context sits at the core of several announcements SAP made at TechEd 2026 in Berlin on October 27\u201329. We came away with the impression that SAP\u2019s most powerful differentiators are at risk of being obscured by a wall of AI capability announcements that \u2014 while impressive \u2014 promise more than they can deliver today.<\/p>\n<p>Here\u2019s what impressed us most and why:<\/p>\n<ul>\n<li><strong>A strong focus on process understanding.<\/strong> SAP repeatedly emphasized the need for process understanding and a process mindset to achieve optimal AI results. The <a href=\"https:\/\/help.sap.com\/docs\/signavio-process-transformation-suite\/signavio-process-transformation-suite-user-guide\/process-consulting-agent\">SAP Signavio Process Consulting Agent<\/a> and SAP Knowledge Graph reinforce that emphasis.<\/li>\n<li><strong>Updates to the tabular AI model, SAP-RPT.<\/strong> The existing SAP-RPT-1.5 is a relational pretrained foundation model specifically developed for prediction tasks on structured and relational data; it supports classification and regression. Announcements included SAP-RPT-2.0, which will support anomaly and outlier detection; <a href=\"https:\/\/help.sap.com\/docs\/sap-ai-core\/generative-ai\/sap-rpt-ts\">SAP-RPT-TS<\/a> will add time series. Providing a tabular model besides standard LLMs is extremely valuable for client use cases that involve number-crunching tasks while leaving their annual token budget almost untouched. We regard this as a differentiator for SAP.<\/li>\n<li><strong>Guided agent-building to ensure grounding in enterprise context.<\/strong> Joule Studio provides a guided experience for building agents. The generated agents are grounded in companies\u2019 operational knowledge by seamlessly harnessing information from the SAP Knowledge Graph, LeanIX data, and contextual enterprise resource planning data. Such agents can provide more accurate results than those built on a generic agentic platform using only intent, constraints, and the usual dimensions.<\/li>\n<li><strong>An expanded SAP Knowledge Graph.<\/strong> The first iteration of the SAP Knowledge Graph essentially represents SAP\u2019s domain model, managed by SAP; it captures 50 years of business knowledge. This in itself already helps ground AI in the right data but isn\u2019t quite enough. Hence, SAP is adding the ability to bring a customer\u2019s own knowledge graph into the SAP-managed environment. For customers wanting more control, SAP is also adding a customer-managed customer knowledge graph. Note: SAP also offers SAP Domain Models, which are foundation models enhanced with SAP\u2019s proprietary and business logic.<\/li>\n<li><strong>Turning headless isn\u2019t part of the plan.<\/strong> While some software platform vendors promote their suites becoming headless as a way to streamline AI access, the SAP team intentionally decided against this trend, arguing that it wants to provide the best experience for any user type, from business user and business developer (where WalkMe is a key enabler) to professional developer and AI agent. SAP offers headless as an option but doesn\u2019t intend to replace other experiences.<\/li>\n<\/ul>\n<p>TechEd is a developer conference, so expecting too much business-focused content would be unfair. That said, we see a few areas that deserve more attention:<\/p>\n<ul>\n<li><strong>Customers need more clarity on how everything fits together.<\/strong> SAP itself is on a major technology transformation journey and offers a rich portfolio of existing and new solutions. Not all customers are ready to embrace a \u201cbusiness AI platform,\u201d particularly when they can\u2019t immediately tell what is evolutionary and what is revolutionary.<\/li>\n<li><strong>Joule Studio and Joule Work could benefit from some design improvements.<\/strong> This isn\u2019t to distract from the tremendous amount of work that\u2019s gone into these tools and how powerful they are. But if some of these capabilities are to be put into the hands of businesspeople, a few tweaks would improve usability for that target audience. The current design can make it challenging for the human approving an agent or agentic workflow to know what exactly they are approving.<\/li>\n<li><strong>The positioning of AI risk needs more nuance.<\/strong> SAP has a strong focus on AI safety and security before releasing software, whether it\u2019s a new version of a product or a single AI agent. Its focus on governance capabilities is also laudable. What\u2019s missing is a more discerning approach to AI risk. \u201cHuman in the loop\u201d cannot be the stock response to the perennial disclaimer \u201cCheck for accuracy,\u201d as a human in the loop can neither scale nor guarantee correctness. What\u2019s being done technically to minimize error and to make it easier for the human to ensure accuracy? In our view, neither aspect received the attention it deserves.<\/li>\n<\/ul>\n<p>\u201cThe autonomous enterprise becomes a reality\u201d is an aspirational statement that matches SAP\u2019s ambitions, and the product announcements at TechEd, both generally available and on the roadmap, reflect those ambitions. Companies ready to transform their business, and whose center of gravity lies with SAP, should ask hard questions about product capabilities and cost. But they should also remember one important point: Nobody knows SAP better than SAP.<\/p>\n",
            "category": [
                {
                    "term_id": 2242,
                    "name": "Age of the Customer",
                    "slug": "age-of-the-customer",
                    "description": "",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/age-of-the-customer\/"
                }
            ],
            "meta_desc": "Forrester Principal Analysts Bernhard Schaffrik and Martha Bennett attended SAP TechEd 2026. Here are their main takeaways.",
            "author": "Martha Bennett",
            "coauthors": "Bernhard Schaffrik"
        },
        {
            "post_type": "post",
            "post_id": 307608,
            "permalink": "https:\/\/www.forrester.com\/blogs\/resilience-pros-answer-our-questions-to-get-a-report\/",
            "title": "Resilience Pros! Answer Our Questions To Get A Report",
            "date": "Nov 3, 2026 16:55:38",
            "excerpt": "Each year, Forrester and the Disaster Recovery Journal (DRJ) team up to launch a study examining resilience. We survey people on different topics in resilience such as disaster recovery, but this time, the focus is solely on business resilience, including business continuity and operational resilience. No matter whether your program\u2019s goals are to create business [&hellip;]",
            "body": "<p>Each year, Forrester and <a href=\"https:\/\/drj.com\/\">the Disaster Recovery Journal (DRJ)<\/a> team up to launch a study examining resilience. We survey people on different topics in resilience such as disaster recovery, but this time, <span data-teams=\"true\">the focus is solely on business resilience, including business continuity and operational resilience<\/span>. No matter whether your program\u2019s goals are to create business continuity plans and test them, to build operational resilience, or to cross-functionally maintain business operations despite disruptions, this survey is for you!<\/p>\n<p>In the last survey two years ago, we shifted our focus not only on business continuity practices but also on the adoption of operational resilience mandates. We found that:<\/p>\n<ul>\n<li>Unfortunately, the testing situation is largely unchanged since 2008. For all test types, most organizations only test once per year with plan walkthroughs and tabletop exercises, and as tests become more extensive, test frequency declines \u2014 41% of respondents said that they never performed a full simulation.<\/li>\n<li>Nine percent of respondents were already compliant with <a href=\"https:\/\/www.esma.europa.eu\/esmas-activities\/digital-finance-and-innovation\/digital-operational-resilience-act-dora\">the EU\u2019s Digital Operational Resilience Act<\/a>.<\/li>\n<li>IT failures had an outsized effect on disruptions, with 59% of respondents reporting an IT failure that caused an invocation.<\/li>\n<li>The top lessons learned from invocations had a tie, with 33% of respondents saying that execution did not adequately address organizationwide communication and collaboration and that decision-makers did not have a central dashboard that included specifics about the incident.<\/li>\n<\/ul>\n<p>This time around, we are not only interested in these same trends but also in how AI is helping you be more successful and, alternatively, how it is driving the invocation of plans. If you are a business resilience decision-maker or influencer at your organization, please take 20 minutes to complete the survey <a href=\"https:\/\/forrester.co1.qualtrics.com\/jfe\/form\/SV_b7do2ra9EaoQ6Pk\">here<\/a>.<\/p>\n<p>Once the survey is complete, the DRJ will have a summary of the results on its site. For Forrester clients, the survey results will be examined in depth in reports that will publish in the next few quarters. All the results are anonymous. If you\u2019d like to receive a complimentary Forrester report (the upcoming \u201cThe State Of Resilience, 2026\u201d), you can submit your email address; we won\u2019t use it for any other purpose.<\/p>\n<p>Take the <a href=\"https:\/\/forrester.co1.qualtrics.com\/jfe\/form\/SV_b7do2ra9EaoQ6Pk\">survey<\/a>, receive a free report, and help us and <a href=\"https:\/\/drj.com\/\">the DRJ<\/a> get a pulse on business resilience!<\/p>\n",
            "category": [
                {
                    "term_id": 2242,
                    "name": "Age of the Customer",
                    "slug": "age-of-the-customer",
                    "description": "",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/age-of-the-customer\/"
                },
                {
                    "term_id": 52023,
                    "name": "Agentic AI",
                    "slug": "agentic-ai",
                    "description": "AI agents promise to transform business processes, applications, and experiences, but realizing their value takes vision and discipline. Explore Forrester\u2019s agentic AI insights to help separate reality from hype, identify high-value use cases, and build the architecture, data foundations, governance, and controls needed to scale safely.",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/artificial-intelligence-ai\/agentic-ai\/"
                },
                {
                    "term_id": 2352,
                    "name": "AI Insights",
                    "slug": "artificial-intelligence-ai",
                    "description": "<p class=\"text-body font-regular leading-[24px] pt-[9px] pb-[2px]\">The integration of artificial intelligence (AI) is revolutionizing how organizations operate, offering unprecedented opportunities to boost efficiency and drive innovation. Yet, alongside this immense potential comes a layer of complexity that requires deliberate strategy. AI is doing more than just enhancing systems; it\u2019s reshaping how organizations allocate resources, advance capabilities, and achieve growth. Its influence touches every corner of an operating model, challenging leaders to not only capture the power of AI but to create meaningful value with it. The path forward is both exciting and intricate, filled with the promise of transformation and the need for thoughtful navigation. Get the latest AI insights and strategic perspectives from Forrester analysts and experts.<\/p>\r\n<a href=\"https:\/\/www.forrester.com\/technology\/data-ai-leaders\/\">Discover how Forrester supports data, AI, and analytics leaders. <\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/artificial-intelligence-ai\/"
                },
                {
                    "term_id": 51984,
                    "name": "AI model",
                    "slug": "ai-model",
                    "description": "",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/artificial-intelligence-ai\/ai-model\/"
                },
                {
                    "term_id": 14963,
                    "name": "Cybersecurity Trends",
                    "slug": "cybersecurity",
                    "description": "Stay up-to-date on the cutting edge of cybersecurity with insights on Zero Trust, vendors, regulations, and other privacy &amp; security topics.",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/cybersecurity\/"
                },
                {
                    "term_id": 51104,
                    "name": "GRC - Governance, Risk, And Compliance",
                    "slug": "grc-governance-risk-and-compliance",
                    "description": "Governance, risk, and compliance (GRC) trends are always evolving. Follow Forrester's latest research and insights on GRC trends.\r\n\r\n<a href=\"\/technology\/\">Discover how Forrester supports IT leaders.<\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/grc-governance-risk-and-compliance\/"
                }
            ],
            "meta_desc": "If you are a business resilience decision-maker or influencer at your organization, please take 20 minutes to complete our survey.",
            "author": "Amy DeMartine"
        },
        {
            "post_type": "post",
            "post_id": 307509,
            "permalink": "https:\/\/www.forrester.com\/blogs\/questioning-your-ai-roi-start-with-your-ai-strategy\/",
            "title": "Questioning Your AI ROI? Start With Your AI Strategy",
            "date": "Nov 3, 2026 14:09:44",
            "excerpt": "\u201cHow do we measure the ROI of AI?\u201d \u201cAI costs are going up. How do we prove the ROI?\u201d These questions \u2014 coming mostly from IT \u2014 start more of my client engagements than any other. As usage of AI credits ramps up and token costs roll in, it\u2019s IT that foots the bill and [&hellip;]",
            "body": "<p><em>\u201cHow do we measure the ROI of AI?\u201d<\/em><\/p>\n<p><em>\u201cAI costs are going up. How do we prove the ROI?\u201d<\/em><\/p>\n<p>These questions \u2014 coming mostly from IT \u2014 start more of my client engagements than any other. As usage of AI credits ramps up and token costs roll in, it\u2019s IT that foots the bill and it\u2019s CIOs who are on the hook to justify the spend.<\/p>\n<p>When I dig into AI ROI challenges with a client, I always uncover a strategy problem at the heart of them. Without knowing why you are investing in AI, where in your business it needs to show up, and having a plan to invest and measure the value, IT is left trying to prove the ROI of workforce enablement and individual worker productivity investments. You are going to have a hard time proving that helping employees write emails, schedule meetings, or produce PowerPoints actually lands in your P&amp;L. Lack of ROI then becomes a scapegoat for bad or missing strategy that forces hard choices about what to focus on and what to deprioritize.<\/p>\n<p>Our new report, <a href=\"https:\/\/www.forrester.com\/report\/your-enterprise-ai-strategy\/RES204067\">Your Enterprise AI Strategy<\/a>, addresses these pain points. It comes out of nine months of collaboration across Forrester and interviews with more than 40 leaders at 25 organizations, plus hundreds of client engagements. Another freshly updated report, <a href=\"https:\/\/www.forrester.com\/report\/introducing-the-forrester-ai-value-matrix-a-framework-for-measuring-what-matters\/RES194340\">Introducing The Forrester AI Value Matrix: A Framework For Measuring What Matters<\/a>, tells you what the right value looks like.<\/p>\n<h2>Your AI Strategy Must Answer Why, Where, When, And How<\/h2>\n<p>The enterprise AI strategy report introduces a three-part model in which:<\/p>\n<ul>\n<li><strong>The vision sets why and where you win with AI.<\/strong> Saving a bit of money isn\u2019t a vision, and neither is handing every employee a copilot. CITGO\u2019s CEO helped write his company\u2019s AI strategy, spelling out the expected outcomes in plain business language: Reduce cost per barrel, raise production output, and improve safety, each with a KPI target to which the board could hold him. A vision also says where you won\u2019t play.<\/li>\n<li><strong>An action plan commits to big bets, timing, scaling, and funding.<\/strong> Planning is what moves a firm from hundreds of use cases to a handful of investment portfolios, the way PepsiCo got to \u201cfour or five big bets.\u201d<\/li>\n<li><strong>Principles and policies set how the organization behaves.<\/strong> They\u2019re the part that most companies skip, because they force executives to decide who gives something up so others can gain, who pays for the change, and what people can expect for their jobs and skills.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-307510 size-full\" src=\"https:\/\/go.forrester.com\/wp-content\/uploads\/2026\/11\/Picture1.png\" alt=\"\" width=\"560\" height=\"213\" srcset=\"https:\/\/go.forrester.com\/wp-content\/uploads\/2026\/11\/Picture1.png 560w, https:\/\/go.forrester.com\/wp-content\/uploads\/2026\/11\/Picture1-300x114.png 300w\" sizes=\"auto, (max-width: 560px) 100vw, 560px\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Only The CEO Can Hold An AI Strategy Together<\/h2>\n<p>CEO ownership is what binds all three together. At Bank of New York, CEO Robin Vince drove the vision that took the bank from a common AI platform to AI agents that it calls digital employees. We\u2019ve found that when the CEO owns the strategy, the company makes the hard decisions: which investments move the business substantially and what gets deprioritized to pay for them. At an organizational level, only the chief executive can make those calls. With the CEO in charge, a CIO has the incentive to prioritize data and AI readiness for the CMO\u2019s growth ambitions and a chief AI officer no longer spends their day refereeing five executives who don\u2019t report to them and don\u2019t agree on what the business is after.<\/p>\n<h2>A Strategy Is Only As Bold As The Value It Targets<\/h2>\n<p>The Forrester AI Value Matrix provides a framework for value that crosses where AI value lands on your P&amp;L with how that value is delivered (productivity, engagement, and transformation). It gives you a three-by-three grid of nine value types. Productivity is the easy, quick kind of value. Engagement, how AI changes the way customers deal with you, takes longer and lasts longer. Transformational value is slow and hard to get, but it\u2019s the biggest payoff and the most durable.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-307511 size-full\" src=\"https:\/\/go.forrester.com\/wp-content\/uploads\/2026\/11\/Picture2.png\" alt=\"\" width=\"560\" height=\"342\" srcset=\"https:\/\/go.forrester.com\/wp-content\/uploads\/2026\/11\/Picture2.png 560w, https:\/\/go.forrester.com\/wp-content\/uploads\/2026\/11\/Picture2-300x183.png 300w\" sizes=\"auto, (max-width: 560px) 100vw, 560px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>AI strategy and value management work as a pair. Without a target value that\u2019s large and durable enough, organizations rarely find the wherewithal to create and execute a strategy bold enough for the disruption that\u2019s coming (our <a href=\"https:\/\/www.forrester.com\/blogs\/beyond-the-saaspocalypse-introducing-the-forrester-ai-disruption-model\/\">AI Disruption Model<\/a> lays that out for you).<\/p>\n<p>Once you understand why and where AI needs to show up in your business, and how large and durable the value needs to be, you can put an AI value management plan in place that tracks changes in business outcomes that create real, lasting advantage.<\/p>\n<p>Read <a href=\"https:\/\/www.forrester.com\/report\/your-enterprise-ai-strategy\/RES204067\">Your Enterprise AI Strategy<\/a>, check out our updated <a href=\"https:\/\/www.forrester.com\/report\/introducing-the-forrester-ai-value-matrix-a-framework-for-measuring-what-matters\/RES194340\">AI Value Matrix<\/a>, then <a href=\"http:\/\/forrester.com\/inquiry\">book an inquiry or guidance session<\/a> with me. Bring your use case list, and we\u2019ll see what value it\u2019s really aiming for.<\/p>\n",
            "category": [
                {
                    "term_id": 2352,
                    "name": "AI Insights",
                    "slug": "artificial-intelligence-ai",
                    "description": "<p class=\"text-body font-regular leading-[24px] pt-[9px] pb-[2px]\">The integration of artificial intelligence (AI) is revolutionizing how organizations operate, offering unprecedented opportunities to boost efficiency and drive innovation. Yet, alongside this immense potential comes a layer of complexity that requires deliberate strategy. AI is doing more than just enhancing systems; it\u2019s reshaping how organizations allocate resources, advance capabilities, and achieve growth. Its influence touches every corner of an operating model, challenging leaders to not only capture the power of AI but to create meaningful value with it. The path forward is both exciting and intricate, filled with the promise of transformation and the need for thoughtful navigation. Get the latest AI insights and strategic perspectives from Forrester analysts and experts.<\/p>\r\n<a href=\"https:\/\/www.forrester.com\/technology\/data-ai-leaders\/\">Discover how Forrester supports data, AI, and analytics leaders. <\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/artificial-intelligence-ai\/"
                }
            ],
            "meta_desc": "Struggling to prove AI ROI? Learn why a strong enterprise AI strategy is essential to connecting AI investments to measurable, lasting business value.",
            "meta_keywords": "AI ROI, enterprise AI strategy, AI value, AI value management, AI Value Matrix, AI investment, AI business value, AI productivity, AI transformation, AI strategy, generative AI, CIO",
            "author": "Brian Hopkins"
        },
        {
            "post_type": "post",
            "post_id": 307594,
            "permalink": "https:\/\/www.forrester.com\/blogs\/cresta-fills-an-important-gap-in-salesforces-customer-service-ai-story\/",
            "title": "Cresta Fills An Important Gap In Salesforce\u2019s Customer Service AI Story",
            "date": "Nov 3, 2026 14:06:04",
            "excerpt": "Salesforce has agreed to acquire Cresta, adding voice agents, real-time agent assistance, and conversation intelligence to its customer service portfolio. Salesforce already owns much of the customer context and many of the systems where customer service work gets done. What it lacked was a credible conversation intelligence offering to understand what happens within those interactions [&hellip;]",
            "body": "<p><a href=\"https:\/\/www.salesforce.com\/news\/stories\/salesforce-signs-definitive-agreement-to-acquire-cresta\/\"><span data-contrast=\"none\">Salesforce has agreed to acquire Cresta<\/span><\/a><span data-contrast=\"auto\">, adding voice agents, real-time agent assistance, and conversation intelligence to its customer service portfolio. Salesforce already owns much of the customer context and many of the systems where customer service work gets done. What it lacked was a credible conversation intelligence offering to understand what happens within those interactions and take action. Cresta, <\/span><a href=\"https:\/\/www.forrester.com\/report\/the-forrester-wave-tm-conversation-intelligence-solutions-for-contact-centers-q2-2025\/RES182915\"><span data-contrast=\"none\">one of the market\u2019s most technically innovative providers<\/span><\/a><span data-contrast=\"auto\">, fills that gap.<\/span><\/p>\n<p><span data-contrast=\"auto\">But Salesforce should resist treating Cresta only as a customer service AI asset. Cresta\u2019s conversation-derived feedback and predictive customer satisfaction score could also strengthen Salesforce\u2019s much weaker <\/span><a href=\"https:\/\/www.forrester.com\/blogs\/takeaways-from-the-forrester-wave-customer-feedback-management-and-analytics-solutions-q3-2026\/\"><span data-contrast=\"none\">customer feedback management<\/span><\/a><span data-contrast=\"auto\"> story, particularly for CX teams under pressure to consolidate their tech stacks and get more from platforms they already own.<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">Salesforce Is Buying The Missing Pieces Of Its Agentic Architecture<\/span><\/b><\/h3>\n<p><span data-contrast=\"auto\">The Cresta deal is the latest in a series of acquisitions Salesforce is using to fill gaps in its <\/span><a href=\"https:\/\/www.forrester.com\/blogs\/from-crm-to-the-agentic-enterprise-salesforces-biggest-dreamforce-2026-reveals\"><span data-contrast=\"none\">agentic architecture<\/span><\/a><span data-contrast=\"auto\">. Cresta is a smart addition, bringing sophisticated technology and expertise in an area where Salesforce had a meaningful gap. But Salesforce is layering these acquisitions onto an already complex and fragmented product estate, with overlapping capabilities and a <\/span><a href=\"https:\/\/www.forrester.com\/blogs\/how-to-take-back-control-when-negotiating-with-salesforce\/\"><span data-contrast=\"none\">complicated buying experience<\/span><\/a><span data-contrast=\"auto\">. A crisper architectural vision doesn\u2019t fix that.<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">Make Salesforce Prove That Ownership Creates Value<\/span><\/b><\/h3>\n<p><span data-contrast=\"auto\">As customer relationship management and contact center platforms <\/span><a href=\"https:\/\/www.forrester.com\/blogs\/frenemies-forever-the-tension-between-crm-and-ccaas-vendors\/\"><span data-contrast=\"none\">increasingly converge<\/span><\/a><span data-contrast=\"auto\">, customer service leaders must decide which platform should own which capabilities. The promise of that convergence should be less complexity for vendors\u2019 customers, not simply more functionality under one vendor\u2019s roof.<\/span><\/p>\n<p><span data-contrast=\"auto\">Existing Cresta customers should watch whether Salesforce preserves what made Cresta valuable: its product velocity, access to its teams, and the ability to work across the contact center technology they already use. Salesforce has committed to maintaining support for leading contact center and telephony platforms after the acquisition closes. Buyers should hold it to that promise.<\/span><\/p>\n<p><span data-contrast=\"auto\">Prospective buyers that already have Salesforce but still haven\u2019t invested in strong conversation intelligence capabilities have plenty of reasons to be excited. But Salesforce should clearly distinguish what they can buy and deploy today from capabilities that depend on future product integration.<\/span><\/p>\n<p><span data-contrast=\"auto\">Forrester customers seeking guidance on what the Cresta acquisition means for their organizations can <\/span><a href=\"https:\/\/www.forrester.com\/inquiry\/guidance-session\"><span data-contrast=\"none\">book a guidance session<\/span><\/a><span data-contrast=\"auto\"> with us.<\/span><\/p>\n",
            "category": [
                {
                    "term_id": 2242,
                    "name": "Age of the Customer",
                    "slug": "age-of-the-customer",
                    "description": "",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/age-of-the-customer\/"
                },
                {
                    "term_id": 52023,
                    "name": "Agentic AI",
                    "slug": "agentic-ai",
                    "description": "AI agents promise to transform business processes, applications, and experiences, but realizing their value takes vision and discipline. Explore Forrester\u2019s agentic AI insights to help separate reality from hype, identify high-value use cases, and build the architecture, data foundations, governance, and controls needed to scale safely.",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/artificial-intelligence-ai\/agentic-ai\/"
                },
                {
                    "term_id": 2352,
                    "name": "AI Insights",
                    "slug": "artificial-intelligence-ai",
                    "description": "<p class=\"text-body font-regular leading-[24px] pt-[9px] pb-[2px]\">The integration of artificial intelligence (AI) is revolutionizing how organizations operate, offering unprecedented opportunities to boost efficiency and drive innovation. Yet, alongside this immense potential comes a layer of complexity that requires deliberate strategy. AI is doing more than just enhancing systems; it\u2019s reshaping how organizations allocate resources, advance capabilities, and achieve growth. Its influence touches every corner of an operating model, challenging leaders to not only capture the power of AI but to create meaningful value with it. The path forward is both exciting and intricate, filled with the promise of transformation and the need for thoughtful navigation. Get the latest AI insights and strategic perspectives from Forrester analysts and experts.<\/p>\r\n<a href=\"https:\/\/www.forrester.com\/technology\/data-ai-leaders\/\">Discover how Forrester supports data, AI, and analytics leaders. <\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/artificial-intelligence-ai\/"
                },
                {
                    "term_id": 2364,
                    "name": "mergers &amp; acquisitions (M&amp;As)",
                    "slug": "mergers-acquisitions-mas",
                    "description": "Read analysis on mergers &amp; acquisitions: what they mean for the market and for your business.",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/mergers-acquisitions-mas\/"
                }
            ],
            "meta_desc": "Salesforce has agreed to acquire Cresta, adding voice agents, real-time agent assistance, and conversation intelligence to its customer service portfolio.",
            "author": "Christina McAllister",
            "coauthors": "Kate Leggett, Colleen Fazio, Max Ball"
        },
        {
            "post_type": "post",
            "post_id": 306612,
            "permalink": "https:\/\/www.forrester.com\/blogs\/your-application-vendors-control-the-meter-the-gate-and-the-referee\/",
            "title": "Your Application Vendors Control The Meter, The Gate, And The Referee",
            "date": "Nov 3, 2026 12:07:27",
            "excerpt": "Tech executives keep asking, \u201cShould we slow down AI adoption?\u201d It is the wrong question. Your application vendors have already answered a more consequential one: how much autonomy your agents will get, what that autonomy will cost, and who will control it.",
            "body": "<p style=\"font-weight: 400;\">Enterprise business application vendors are setting the terms for enterprise AI agents. They determine what you pay, what agents can access, and how you monitor and control them. What may be affordable in a pilot can become very expensive as charges accumulate quickly across the end-to-end business process. By the time you realize what has happened, the agents are embedded in your business. CIOs and heads of enterprise business applications need to negotiate the terms before adoption turns into dependency.<\/p>\n<h2>The Meter, The Gate, And The Referee Are Converging<\/h2>\n<p>New pricing models are emerging, moving away from per-license pricing to a meter on agent activities. <a href=\"https:\/\/www.salesforce.com\/agentforce\/pricing\/\">Salesforce Agentforce pricing<\/a> lists some actions at $0.10, while <a href=\"https:\/\/assets.dm.ux.sap.com\/sap-user-groups\/pdfs\/260611_ai_new commercilas_general.pdf\">SAP\u2019s AI commercial model<\/a> assigns 0.02 AI units to certain agent actions. <a href=\"https:\/\/www.workday.com\/en-us\/ai-agents\/ai-flex-credits.html\">Workday AI flex credits<\/a> price completed tasks at five times the rate of information retrieval. The models differ, but the commercial direction is consistent: As agent activity grows, vendor consumption revenue grows with it. A low per-action price can quickly escalate costs across your business processes.<\/p>\n<p>Accessing your enterprise business data just got a lot more difficult. <a href=\"https:\/\/www.forrester.com\/blogs\/sap-is-attempting-to-become-the-gatekeeper-of-enterprise-ai-cios-should-push-back\/\">SAP\u2019s April 2026 API policy analysis<\/a> describes restrictions on third-party agents planning or executing sequences of SAP API calls outside approved paths. In practice, an external finance agent may need to reach an SAP transaction through a Joule-mediated route. SAP has a legitimate interest in protecting application integrity. But when the required route is proprietary and billable, an API policy becomes an architecture and negotiating decision.<\/p>\n<p>As your organization merges multiple products across the technology stack, it\u2019s important to identify what is controlling the way that AI agents interact with other systems. Application and platform vendors increasingly offer to discover agents, enforce policies, monitor activity, and govern interactions across vendor boundaries. Enterprises will need many of these capabilities, but introductory pricing is not a control strategy.<\/p>\n<p>Together, these moves put the meter, the gate, and the referee in one vendor\u2019s hands. Concentration may improve control, but it also allows the vendor to price the work, govern its execution, and provide the evidence of its value. Once hundreds of agents depend on that platform, the enterprise may lose the ability to challenge the bill or change the terms without disrupting operations.<\/p>\n<h2><strong>Know Your Rights Before Agents Execute<\/strong><\/h2>\n<p>Before CIOs and heads of enterprise business applications turn over all control to a single provider, they should understand the agent cost impact end to end for critical business processes. For example, consider an invoice agent: It starts by summarizing a discrepancy. Soon, it will match the invoice to a purchase order, resolve exceptions, update the enterprise resource planning system, and prepare payment. The agent does not suddenly become more intelligent. It instead becomes more connected and more authorized. That expanded capability comes at a price.<\/p>\n<p>The enterprise\u2019s control should rise with its authority. Analyze your core business processes with these six key lenses.<\/p>\n<ol>\n<li><strong>Know who acted.<\/strong> \u201cAI did it\u201d is not an acceptable answer. Every production agent needs its own identity, owner, and bounded authority. If you cannot connect an action to the agent, initiator, source, and policy, the agent is not ready to execute it.<\/li>\n<li><strong>Keep the evidence.<\/strong> A transaction log will not tell the whole story. Preserve what the agent saw, which rules it applied, which tools it called, and what it changed. If the complete record lives only in the vendor\u2019s console, you have visibility on the vendor\u2019s terms.<\/li>\n<li><strong>Verify the value.<\/strong> A completed action is not a completed business outcome. Compare agent consumption with completed transactions, exceptions, human intervention, corrections, reversals, cycle time, and financial impact. Retain the telemetry needed to reconcile charges and dispute consumption. If you cannot verify the outcome independently, you are measuring activity, not value.<\/li>\n<li><strong>Know the real price.<\/strong> Eventually, the business will stop buying agents by the task and start buying them by the outcome. Include retrieval, API calls, handoffs, retries, approvals, exceptions, and reversals. If the business case works only at pilot volume or promotional rates, it is not a production business case.<\/li>\n<li><strong>Choose the route.<\/strong> Vendors should protect their applications, but they should not quietly dictate every intermediary in the process. Define supported routes, mandatory gateways, charges, and telemetry rights in the contract. What looks like an API condition today can become renewal leverage tomorrow.<\/li>\n<li><strong>Keep the off switch.<\/strong> Disabling the interface may not stop credentials, schedules, connectors, or downstream agents. Test whether you can revoke authority, halt execution, preserve evidence, and find unfinished work. If you cannot stop the agent independently, you do not fully control it.<\/li>\n<\/ol>\n<p>These rights are easiest to establish while the agent remains optional. Once people and processes rely on it, changing the terms becomes much harder.<\/p>\n<h2><strong>Pay Attention To What Is Changing<\/strong><\/h2>\n<p>Once an agent moves into production, you must continue to pay attention to how it works, what work it does, and how well it is governed.<\/p>\n<ul>\n<li><strong>Watch the price of execution.<\/strong> Retrieving information and completing work are not the same thing, and vendors may increasingly price them differently. Before scaling an agent, calculate the cost of the complete process, including retries, approvals, exceptions, and reversals.<\/li>\n<li><strong>Watch the route.<\/strong> A vendor may require outside agents to use its gateway, agent, or control plane. Some restrictions are necessary to protect the application. Others can create another charge and another dependency. Ask what remains supported if you choose a different agent or orchestration platform.<\/li>\n<li><strong>Watch the governance package.<\/strong> The agent inventory may be included while telemetry exports, evidence retention, policy enforcement, or shutdown controls require another license. Establish what the production environment will cost, not just what the pilot includes.<\/li>\n<\/ul>\n<h2><strong>Set The Terms Before Agent Dependency<\/strong><\/h2>\n<div>\n<p class=\"paragraph-in-scc-markdown-text ___1ngh792 ftgm304 f1iaxwol\">The risk is not simply that AI agents become expensive. It is that costs and dependencies grow together, leaving the enterprise with less control over both. As agents move from helping employees to executing business processes, the terms governing pricing, access, and oversight become harder to change.<\/p>\n<p class=\"paragraph-in-scc-markdown-text ___1ngh792 ftgm304 f1iaxwol\">Before scaling, CIOs and application leaders need to establish the full cost of a completed process, define what agents can do without approval, and retain the evidence and authority to stop them. Negotiate those rights while alternatives are still practical, not after everyday operations depend on the vendor\u2019s platform. In short, adopt agents for the value they deliver, but do not let adoption decide the terms for you.<\/p>\n<\/div>\n<h2><strong>Let\u2019s Connect<\/strong><\/h2>\n<p>Forrester clients can schedule an <a href=\"http:\/\/forrester.com\/inquiry\">inquiry or guidance session<\/a> to work through a specific agent use case and the decisions that should be settled before production.<\/p>\n",
            "category": [
                {
                    "term_id": 52023,
                    "name": "Agentic AI",
                    "slug": "agentic-ai",
                    "description": "AI agents promise to transform business processes, applications, and experiences, but realizing their value takes vision and discipline. Explore Forrester\u2019s agentic AI insights to help separate reality from hype, identify high-value use cases, and build the architecture, data foundations, governance, and controls needed to scale safely.",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/artificial-intelligence-ai\/agentic-ai\/"
                },
                {
                    "term_id": 2352,
                    "name": "AI Insights",
                    "slug": "artificial-intelligence-ai",
                    "description": "<p class=\"text-body font-regular leading-[24px] pt-[9px] pb-[2px]\">The integration of artificial intelligence (AI) is revolutionizing how organizations operate, offering unprecedented opportunities to boost efficiency and drive innovation. Yet, alongside this immense potential comes a layer of complexity that requires deliberate strategy. AI is doing more than just enhancing systems; it\u2019s reshaping how organizations allocate resources, advance capabilities, and achieve growth. Its influence touches every corner of an operating model, challenging leaders to not only capture the power of AI but to create meaningful value with it. The path forward is both exciting and intricate, filled with the promise of transformation and the need for thoughtful navigation. Get the latest AI insights and strategic perspectives from Forrester analysts and experts.<\/p>\r\n<a href=\"https:\/\/www.forrester.com\/technology\/data-ai-leaders\/\">Discover how Forrester supports data, AI, and analytics leaders. <\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/artificial-intelligence-ai\/"
                },
                {
                    "term_id": 2116,
                    "name": "Application Security",
                    "slug": "application-security",
                    "description": "Agile development's cycle of deployments and patches generates ample opportunities for hackers looking for a way in. Application security must be strong, vigilant, and nimble. Read our insights.\r\n\r\n<a href=\"\/technology\/\">Discover how Forrester supports technology executives. <\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/application-security\/"
                },
                {
                    "term_id": 2351,
                    "name": "CIO insights",
                    "slug": "chief-information-officer-cio",
                    "description": "The Chief Information Officer (CIO) plays a crucial and complicated role in today's enterprises. Read insights on how to balance innovation with practicality; the power of big data with customer privacy; and the opportunities of new tech with its accompanying risks.\r\n\r\n<a href=\"\/technology\/\">Discover how Forrester supports technology executives. <\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/chief-information-officer-cio\/"
                },
                {
                    "term_id": 51505,
                    "name": "Generative AI",
                    "slug": "generative-ai",
                    "description": "What is generative AI? <a href=\"https:\/\/www.forrester.com\/technology\/generative-ai\/\">Generative AI <\/a>or genAI is defined as set of technologies and techniques that leverage very large corpuses of data, including large language models like GPT-3, to generate new content. Inputs for generative AI may be natural language prompts or other non-code and non-traditional inputs. It is sometimes referred to as AI-generated content or AIGC and can be used by a variety of roles and functions in the enterprise. GenAI includes large language models, generative adversarial networks, diffusion models, and variational autoencoders. It provides the ability to create shortcuts for onerous workflow tasks, speed up delivery times, and enhance employee productivity across multiple enterprise workflows. It increases the scale and speed of analysis and knowledge synthesis for various roles such as developers, marketers, and data scientists. In the short term, it will expand the breadth of human creative expression and drive innovation in product development, design, and content creation.",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/generative-ai\/"
                },
                {
                    "term_id": 51104,
                    "name": "GRC - Governance, Risk, And Compliance",
                    "slug": "grc-governance-risk-and-compliance",
                    "description": "Governance, risk, and compliance (GRC) trends are always evolving. Follow Forrester's latest research and insights on GRC trends.\r\n\r\n<a href=\"\/technology\/\">Discover how Forrester supports IT leaders.<\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/grc-governance-risk-and-compliance\/"
                },
                {
                    "term_id": 2200,
                    "name": "vendor management",
                    "slug": "vendor-management",
                    "description": "Effective vendor management ensures that your firm makes the most of its relationships. Learn how to maximize the benefits and mitigate the risks.\r\n\r\n<a href=\"\/technology\/\">Discover how Forrester supports IT leaders.<\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/vendor-management\/"
                }
            ],
            "meta_title": "AI Agent Pricing: Vendors Control The Meter, Gate, And Referee",
            "meta_desc": "Your application vendors now control AI agent pricing, API access, and agent governance. Learn five moves to make before your next renewal.",
            "meta_keywords": "agentic AI, AI agent governance, AI agent pricing, AI agent security, prompt injection, SAP, Salesforce, Workday, ServiceNow, Microsoft, enterprise applications, software renewal",
            "author": "Faram Medhora"
        },
        {
            "post_type": "post",
            "post_id": 307558,
            "permalink": "https:\/\/www.forrester.com\/blogs\/php2shell-had-teeth-but-the-real-story-is-the-eclectic-mayhem\/",
            "title": "PHP2Shell Had Teeth, But The Real Story Is The Eclectic Mayhem",
            "date": "Nov 3, 2026 11:07:38",
            "excerpt": "The week of October 20 was unusually chaotic, even without the PHP news. Not only did teams need to scramble to identify and understand the impact of emergency PHP vulnerabilities, but there were also critical vulnerabilities in Node.js, cryptographically weak keys issues by a certificate authority, exploited vulns in network security equipment, and potentially accidental [&hellip;]",
            "body": "<p>The week of October 20 was unusually chaotic, even without the PHP news. Not only did teams need to scramble to identify and understand the impact of emergency PHP vulnerabilities, but there were also critical vulnerabilities in Node.js, cryptographically weak keys issues by a <a href=\"https:\/\/www.forrester.com\/blogs\/the-emudhra-certificate-authority-incident-is-a-wake-up-call-for-enterprise-pki\/\">certificate authority<\/a>, exploited vulns in network security equipment, and potentially accidental <a href=\"https:\/\/thehackernews.com\/2026\/10\/two-cvss-90-linux-ksmbd-rce-flaws.html\">distribution<\/a> of even more zero days from a security vendor.<\/p>\n<p>The PHP mayhem arrived under unusual circumstances: The vulnerabilities were made public before coordinated disclosure completed, when patches were not ready and mitigations were still underway. Given that PHP is omnipresent in every environment (leaving many to compare the event to Log4Shell), researchers, social media, government agencies, and vendors all had their own perspective on the significance of the threat. But two weeks later, the PHP2Shell vulnerabilities are the least interesting thing that happened that week.<\/p>\n<p>The week of October 20 demonstrated what happens when AI-led vulnerability discovery, attempts to use AI to write exploits, and uncoordinated vulnerability disclosure converge. We think these three things will continue to happen independently before converging to make each scenario worse. Here\u2019s what it all means for you.<\/p>\n<h2><strong>Any \u201cNon-Event\u201d Means That Defenders Won<\/strong><\/h2>\n<p>Web application firewall (WAF) vendors including Cloudflare and Akamai had to expedite protections due to the breach in coordinated disclosure, but this gave customers a preventive measure while they waited to patch. Other organizations took the aggressive step of temporarily <a href=\"https:\/\/www.bbc.com\/news\/articles\/cmly0lg3w5x2o\">shutting down websites<\/a>, including government sites from countries such as the Netherlands and Finland. Estimates of the number of sites taken down proactively range from hundreds to thousands.<\/p>\n<p>We are now seeing security take precedence over availability. Over the past few months, we\u2019ve had several conversations with security leaders on whether it was time to change risk appetites for availability versus security, which at that time were limited to updates, questions, and decisions that security and business\/technology leadership had to discuss with their organizations. We\u2019re starting to see those conversations evolve into actions.<\/p>\n<p>As of this writing, we still haven\u2019t heard of a successful breach leveraging these vulnerabilities. It\u2019s likely that mitigations disrupted or prevented breaches, but until or if there is a breach leveraging these vulns, it will be difficult to determine how successful and necessary all of these mitigations were. The absence of a known breach is evidence that defenses worked, despite thoughts that organizations overreacted.<\/p>\n<p>Hindsight is always 20\/20. Organizations that decided to take down sites were acting on incomplete information \u2014 incomplete information made worse by a breach in the coordinated disclosure process. Was PHP2Shell as bad as some of the predictions? No. Was it a nothingburger? Probably not. Did swift, decisive coordinated action play a role in keeping the worst predictions from coming to pass? Likely.<\/p>\n<h2><strong>AI Discovered The PHP Vulnerabilities \u2026 But Clarity On Their Impact Might As Well Have Been Coming From The Muppet\u2019s Swedish Chef<\/strong><\/h2>\n<p>The first day of the PHP2Shell announcement left security teams parsing through competing threat analysis and mitigation guidance. Some initial proposed mitigations provided <a href=\"https:\/\/securitylabs.datadoghq.com\/articles\/php2shell-critical-vulnerabilities-in-php\/\">incomplete protection<\/a>. PHP warned that configuration recommendations could reduce exposure, but it didn\u2019t make <a href=\"https:\/\/massivegrid.com\/blog\/php-cve-2026-109618-109619-mitigations-when-you-cannot-patch\/\">installation safe<\/a>.<\/p>\n<p>Meanwhile, teams had to deal with discovering multiple PHP branches, unsupported installations, two separate common vulnerabilties and exposures (CVEs), and reports of probing and exploitation from their security operations center (SOC) and different online sources. Whether the vulnerabilities could be reliably exploited remained <a href=\"https:\/\/unit42.paloaltonetworks.com\/cve-2026-109618-cve-2026-109619\/?\">difficult to establish<\/a>. Some security companies said they had working exploits but that AI-generated exploits published online didn\u2019t work. This left many SOC teams triaging nonfunctional exploits. Eventually, one pen tester put his own <a href=\"https:\/\/stealmybitcoin.com\/\">bitcoin up for grabs<\/a> on a site running vulnerable PHP to prove whether an exploit was possible.<\/p>\n<p>Many organizations rely on known exploited vulnerability (KEV) catalogs, especially the one maintained by CISA (which didn\u2019t <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/10\/26\/cisa-adds-two-known-exploited-vulnerabilities-catalog\">publish<\/a> the CVEs on its KEV until October 26), but these can no longer serve as the only trigger to kick off emergency remediations. The barrier to exploit is shrinking along with the barrier to discover vulnerabilities, and as AI models mature, knowing whether a vuln is a KEV will matter less. AI will continue to write bad exploits and will continue to proliferate online. A published POC alone does not constitute expediting remediation. Teams need to prioritize based on reachability and exploitability in their specific environment.<\/p>\n<p>As more researchers trust AI to generate exploits and don\u2019t fully validate them, we are likely to see more incomplete exploits. This will muddy the waters on what\u2019s possible, add misinformation in an already chaotic period, and (most dangerously) make some doubt the severity of the incident. <a href=\"https:\/\/www.securityweek.com\/php2shell-exploitation-moves-from-probes-to-working-shells\/\">On Monday morning after the incident<\/a>, it was still unclear where proven exploits existed, and we started to hear from security pros wondering if this entire thing was overblown \u2014 it wasn\u2019t.<\/p>\n<h2><strong>(Un-)Coordinated Disclosure: Kermit Vs. Miss Piggy<\/strong><\/h2>\n<p>Coordinated vulnerability disclosure is like the Muppets putting on a perfect show. Every puppet has a specific role: developing mitigations, writing and testing patches, coordinating communications, and working toward publication of a CVE. Not every disclosure has a Kermit trying to hold the production together and protect the broader community. Some have Miss Piggy, who just wants to make the show about herself.<\/p>\n<p>Vulnerability disclosure shouldn\u2019t be an object lesson in game theory. Even if it were, the strategy would be clear: Cooperation produces the best outcome for most participants. Unlike the prisoner\u2019s dilemma, coordinated disclosure doesn\u2019t even impose artificial constraints such as preventing the participants from communicating. Researchers, maintainers, and security vendors can coordinate. They just need to honor that process.<\/p>\n<p>But PHP2Shell began with a failure to do so. When Chainguard made the two CVEs public and <a href=\"https:\/\/thehackernews.com\/2026\/10\/php2shell-two-unpatched-critical-php.html\">the information reached The Hacker News on October 21<\/a>, the PHP team was still finalizing patches. The early announcement forced PHP to accelerate its release and security vendors to hastily deploy mitigations. Everyone else had to recalculate their response on an abbreviated timeline.<\/p>\n<p>When a company is trusted with embargoed information about widespread, novel, and potentially catastrophic vulnerabilities, breaking that trust leaves the rest of the security community cleaning up afterward. Chainguard said that it acted because it was aware of exploit attempts and wanted to protect defenders. It remains unclear whether the company was responding to credible evidence of working exploits or to the wider information chaos surrounding PHP2Shell. Whatever the intent, the result hurt defenders, damaged trust in the disclosure process, and demonstrated that reputation is a critical part of responsible disclosure.<\/p>\n<p>We will say this with zero ambiguity: The responsible disclosure process exists for a reason. Coordinated disclosure is critical when the potential stakes are as high as they were with the PHP vulnerabilities. The security community has thrived because of collaboration and trust between researchers and software providers. Breaking that trust has consequences: negligible upside for customers, deserved reputational damage for the organization that jumps the gun, and less time for everyone else to protect vulnerable systems.<\/p>\n<p>PHP2Shell wasn\u2019t the only recent example of irregular disclosure. Late on October 21 or early on October 22, TrendAI\u2019s Zero Day Initiative inadvertently sent information about unpatched Linux kernel vulnerabilities to public kernel mailing lists, rather than private vulnerability disclosure processes. The circumstances differed from those surrounding PHP2Shell. It\u2019s not clear whether emailing the public distribution list was intentional, since <a href=\"https:\/\/lwn.net\/Articles\/1073193\/\">the project has stated<\/a> that sending AI-discovered vulnerabilities to a private list is a waste of time and that AI-discovered bugs should not be defined as secret.<\/p>\n<p>But the operational effect was familiar: Defenders faced newly disclosed vulnerabilities, no available patches, substantial uncertainty, and another remediation effort layered onto the work already in progress. The faster disclosure moves and the more vulnerabilities the process must handle, the more opportunities there are for consequential mistakes.<\/p>\n<p>That pressure will increase as AI changes vulnerability research. Open-source and commercial maintainers are already receiving lengthy AI-generated bug reports, many of which are insignificant, incomplete, or wrong. The burden created by accelerated vulnerability discovery therefore begins before coordinated disclosure. Maintainers need to separate credible findings from noise, determine which reports deserve investigation, and identify which vulnerabilities require confidential coordination and remediation.<\/p>\n<p>For that reason, PHP2Shell marks a turning point in responsible disclosure in the AI age. AI will increase the volume of vulnerability reports and compress the time available to evaluate them. It will also make it harder to distinguish a credible exploit from an incomplete proof of concept. Responsible disclosure matters more than ever because AI is forcing the security community to more hastily decide which reports deserve triage, which vulnerabilities require coordinated remediation, and when releasing exploit details would put defenders at an immediate disadvantage.<\/p>\n<p>Some of us remember the days before responsible disclosure. Even with a much smaller internet footprint than today, it was the Wild West. Some researchers notified vendors; others didn\u2019t. Vendors were often caught unaware, while researchers trying to do the right thing sometimes faced threats of legal action. We cannot go back to that model. Setting the precedent that any researcher or company can unilaterally bypass coordinated disclosure is dangerous and damages trust across the security community. If an individual or organization believes a disclosure process is failing, it should escalate those concerns through the established channels, not appoint itself the exception.<\/p>\n<h2><strong>The Show Must Go On, But Animal Is Waiting Backstage<\/strong><\/h2>\n<p>PHP2Shell will be remembered as three things: 1) a near miss; 2) a well-defended critical vulnerability; and 3) a failure in responsible vulnerability disclosure. It will also get lost in the noise of more critical CVEs and a busy landscape that every team is now seeing as a reality. We learned that the response does not always match the severity of the bug or the presence, or lack thereof, of an exploit. It further cements the need for orgs to know what is true, know how they are exposed, and know the options for immediate defense. To prepare for the next emergency, you must:<\/p>\n<ul>\n<li><strong>Understand the current strain of the vulnerability disclosure process.<\/strong> Recognize that AI will increase both vulnerability discovery and exploit discovery. Some will be valid; some won\u2019t. Both scenarios will consume research and maintainer attention, complicate triage and disclosure, and compress time for responsible disclosure and response.<\/li>\n<li><strong>Define your sources of truth before the next emergency.<\/strong> Establish how you weigh CISA\u2019s KEV catalog, other vulnerability intelligence sources, maintainer guidance, attributes that make exploit evidence valid, and your own telemetry sources. Decide in advance what constitutes credible evidence and criteria for an emergency.<\/li>\n<li><strong>Treat mitigations as measurable risk reduction.<\/strong> WAFs and compensating controls should factor into vulnerability priority when they demonstrate reduced exposure or block viable attack paths. Track their deployment and effectiveness alongside patching service-level agreements and other emergency response metrics.<\/li>\n<li><strong>Invest in visibility before you wish you had it.<\/strong> Software composition analysis and software bills of material identify where vulnerable software exists. External attack surface management determines where they may be exposed to the internet. Threat intelligence and your own SOC telemetry determine when an exposure requires emergency action.<\/li>\n<\/ul>\n<p>Forrester clients can <a href=\"https:\/\/www.forrester.com\/inquiry\">schedule a guidance session<\/a> with any of us to discuss their vulnerability management, application security, or proactive security programs. Forrester clients can also access our report, <a href=\"https:\/\/www.forrester.com\/report\/ciso-board-update-php2shell\/RES204232\">CISO Board Update: PHP2Shell<\/a>.<\/p>\n",
            "category": [
                {
                    "term_id": 2352,
                    "name": "AI Insights",
                    "slug": "artificial-intelligence-ai",
                    "description": "<p class=\"text-body font-regular leading-[24px] pt-[9px] pb-[2px]\">The integration of artificial intelligence (AI) is revolutionizing how organizations operate, offering unprecedented opportunities to boost efficiency and drive innovation. Yet, alongside this immense potential comes a layer of complexity that requires deliberate strategy. AI is doing more than just enhancing systems; it\u2019s reshaping how organizations allocate resources, advance capabilities, and achieve growth. Its influence touches every corner of an operating model, challenging leaders to not only capture the power of AI but to create meaningful value with it. The path forward is both exciting and intricate, filled with the promise of transformation and the need for thoughtful navigation. Get the latest AI insights and strategic perspectives from Forrester analysts and experts.<\/p>\r\n<a href=\"https:\/\/www.forrester.com\/technology\/data-ai-leaders\/\">Discover how Forrester supports data, AI, and analytics leaders. <\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/artificial-intelligence-ai\/"
                },
                {
                    "term_id": 2116,
                    "name": "Application Security",
                    "slug": "application-security",
                    "description": "Agile development's cycle of deployments and patches generates ample opportunities for hackers looking for a way in. Application security must be strong, vigilant, and nimble. Read our insights.\r\n\r\n<a href=\"\/technology\/\">Discover how Forrester supports technology executives. <\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/application-security\/"
                },
                {
                    "term_id": 51787,
                    "name": "Security management",
                    "slug": "security-management",
                    "description": "",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/security-management\/"
                },
                {
                    "term_id": 2180,
                    "name": "security risk management",
                    "slug": "security-risk",
                    "description": "With the proliferation of data and the ubiquity of connected devices, organizations can move with unmatched efficiency, but simultaneously incur increased risks. Read our insights on how security &amp; risk professionals can succeed in this environment.\r\n\r\n<a href=\"https:\/\/www.forrester.com\/technology\/security-risk\/\">Discover how Forrester supports IT and security and risk leaders.<\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/security-risk\/"
                },
                {
                    "term_id": 51123,
                    "name": "Zero Trust",
                    "slug": "zero-trust",
                    "description": "Zero Trust is a security model that was developed in 2009 as an alternative to older perimeter-based security models. Since then, Zero Trust has evolved beyond its original focus on securing the network and is now being adopted by private-sector technology executives and by international and US government agencies.\u00a0It is based on the principle of \"never trust, always verify\" and requires continuous verification of every user, device, and network request. The <a href=\"https:\/\/www.forrester.com\/zero-trust\/\">core principles of Zero Trust<\/a> include eliminating implicit trust, enforcing least-privilege access, implementing comprehensive security monitoring, attaching cloud security to cloud management, and harnessing cloud-native deployment, rearchitecture, and migration initiatives. The model ensures comprehensive control over access to data and resources, regardless of where they are located. Learn more about Zero Trust and how it can be applied to your organization through <a href=\"https:\/\/www.forrester.com\/research\/security-risk\/\">Forrester Decisions For Security &amp; Risk<\/a>.",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/zero-trust\/"
                }
            ],
            "author": "Erik Nost",
            "coauthors": "Janet Worthington, Sandy Carielli, James Plouffe"
        },
        {
            "post_type": "post",
            "post_id": 307544,
            "permalink": "https:\/\/www.forrester.com\/blogs\/ai-capacity-scarcity-shifts-the-goals-of-finops\/",
            "title": "AI Capacity Scarcity Shifts The Goals Of FinOps",
            "date": "Nov 3, 2026 09:00:55",
            "excerpt": "AI capacity is the new FinOps challenge. Learn why securing and governing scarce AI infrastructure is becoming a business priority.",
            "body": "<p>For the past year, most of my client conversations have focused on managing AI costs. FinOps teams were focused on tracking token consumption, comparing model pricing, allocating AI spend, and identifying ways to reduce expenses. Those are still important priorities, but recent capacity constraint announcements from <a href=\"https:\/\/www.reuters.com\/business\/retail-consumer\/amazon-cloud-capacity-sold-out-through-2027-ceo-jassy-says-2026-10-23\/\">AWS<\/a>, <a href=\"https:\/\/finance.yahoo.com\/technology\/ai\/articles\/does-azure-ai-growth-microsoft-141500342.html\">Azure<\/a>, <a href=\"https:\/\/www.datacenterdynamics.com\/en\/news\/google-limits-metas-ai-use-due-to-capacity-constraints-report\/\">Google Cloud<\/a>, and <a href=\"https:\/\/investor.oracle.com\/investor-news\/news-details\/2026\/Oracle-Announces-Q1-Results-Driven-by-Triple-Digit-Growth-in-Cloud-Infrastructure-Revenues\/default.aspx\">Oracle Cloud<\/a> highlight a larger shift taking place in FinOps. When AI infrastructure is the limiting factor to innovation, FinOps becomes less about reducing costs and more about governing scarcity. The critical challenge shifts from optimization to deciding who gets access to limited capacity, when, and for what business initiative.<\/p>\n<p>Traditional practice is to schedule resources and eliminate waste, but capacity shortages have led to organizations holding or reserving massive amounts of idle GPUs because the risk of losing access outweighed the cost of carrying unused resources. In a landscape where companies are racing to launch AI products, improve customer experience, and automate operations, securing compute access can outweigh the benefit of reducing spend. What appears inefficient through a cloud cost management lens may be entirely rational from a business perspective. It also means that reserving AI capacity is becoming a core AI FinOps discipline.<\/p>\n<h3><strong>Throughput Capacity Reservations Are Not Your Average RI Or SP<\/strong><\/h3>\n<p>Every major cloud provider has introduced its own AI capacity reservation construct, ranging from provisioned throughput units (PTUs), model units (MUs), and generative AI scale units (GSUs) to reserved graphics processing units (GPUs). While these are helpful in securing access to scarce AI resources, they also introduce significant complexity. Each provider has specific capacity definitions, reservation units, billing models, commitment structures, and rules governing how reservations can be used across models, services, and regions. As a result, organizations often struggle to understand what they bought, what they committed to, and how it compares across providers. This challenge is amplified for multicloud and multimodel organizations that are managing commitments across multiple providers. Increasingly, the burden has fallen on FinOps teams to normalize these constructs, translate them into comparable business and financial terms, and ensure that the organization understands the cost, flexibility, and implications of its AI capacity commitments.<\/p>\n<h3><strong>A New Differentiator For Cloud Cost Management And AI Gateway Tools<\/strong><\/h3>\n<p>This also creates opportunity for AI FinOps tools and gateways. Currently, less than a handful of FinOps vendors can provide any visibility into PTU, GSU, or MSU reservations \u2014 none of them can normalize these units. This gap creates an opening to differentiate with capabilities that provide visibility and normalize capacity reservation usage, forecasts, and spend across cloud providers. As organizations adopt more providers, models, and AI services, a single view of capacity will become as important as a unified view of costs.<\/p>\n<h3><strong>Capacity Management Takes Center Stage<\/strong><\/h3>\n<p>AI FinOps isn\u2019t moving away from managing and optimizing costs. Governance, forecasting, and accountability remain foundational capabilities. The difference is that AI infrastructure is becoming a strategic resource in its own right. If major cloud providers are selling capacity years in advance, the primary FinOps challenge is no longer just optimizing costs, nor is it connecting spend to value. It\u2019s ensuring that the organization\u2019s demand for AI infrastructure doesn\u2019t outpace the capacity available to support it.<\/p>\n<p>If you would like to dive deeper, set up an <a href=\"mailto:inquiry@forrester.com\">inquiry or guidance session<\/a> with me. Until then, happy reserving!<\/p>\n",
            "category": [
                {
                    "term_id": 2242,
                    "name": "Age of the Customer",
                    "slug": "age-of-the-customer",
                    "description": "",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/age-of-the-customer\/"
                },
                {
                    "term_id": 52023,
                    "name": "Agentic AI",
                    "slug": "agentic-ai",
                    "description": "AI agents promise to transform business processes, applications, and experiences, but realizing their value takes vision and discipline. Explore Forrester\u2019s agentic AI insights to help separate reality from hype, identify high-value use cases, and build the architecture, data foundations, governance, and controls needed to scale safely.",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/artificial-intelligence-ai\/agentic-ai\/"
                },
                {
                    "term_id": 52019,
                    "name": "AI Consulting",
                    "slug": "ai-consulting",
                    "description": "",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/ai-services\/ai-consulting\/"
                },
                {
                    "term_id": 2352,
                    "name": "AI Insights",
                    "slug": "artificial-intelligence-ai",
                    "description": "<p class=\"text-body font-regular leading-[24px] pt-[9px] pb-[2px]\">The integration of artificial intelligence (AI) is revolutionizing how organizations operate, offering unprecedented opportunities to boost efficiency and drive innovation. Yet, alongside this immense potential comes a layer of complexity that requires deliberate strategy. AI is doing more than just enhancing systems; it\u2019s reshaping how organizations allocate resources, advance capabilities, and achieve growth. Its influence touches every corner of an operating model, challenging leaders to not only capture the power of AI but to create meaningful value with it. The path forward is both exciting and intricate, filled with the promise of transformation and the need for thoughtful navigation. Get the latest AI insights and strategic perspectives from Forrester analysts and experts.<\/p>\r\n<a href=\"https:\/\/www.forrester.com\/technology\/data-ai-leaders\/\">Discover how Forrester supports data, AI, and analytics leaders. <\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/artificial-intelligence-ai\/"
                },
                {
                    "term_id": 51984,
                    "name": "AI model",
                    "slug": "ai-model",
                    "description": "",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/artificial-intelligence-ai\/ai-model\/"
                },
                {
                    "term_id": 52018,
                    "name": "AI Services",
                    "slug": "ai-services",
                    "description": "",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/ai-services\/"
                },
                {
                    "term_id": 2139,
                    "name": "Cloud Computing Trends",
                    "slug": "cloud-computing",
                    "description": "Cloud computing is revolutionizing IT and enabling digital transformation. Read our insights on why it matters and how to get it right.",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/cloud-computing\/"
                },
                {
                    "term_id": 2209,
                    "name": "Cloud Security",
                    "slug": "cloud-security",
                    "description": "As both IT vendors and buyers explore the advantages of cloud-based solutions, they must also evaluate and manage cloud security risks. Read more to get the expert guidance required.",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/cloud-security\/"
                },
                {
                    "term_id": 51985,
                    "name": "open source AI",
                    "slug": "open-source-ai",
                    "description": "",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/artificial-intelligence-ai\/open-source-ai\/"
                },
                {
                    "term_id": 2187,
                    "name": "private cloud",
                    "slug": "private-cloud",
                    "description": "As public cloud use proliferates, firms are leveraging private cloud solutions to combine the benefits of the cloud with increased security and flexibility.\r\n\r\n<a href=\"\/technology\/\">Discover how Forrester supports IT leaders.<\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/private-cloud\/"
                },
                {
                    "term_id": 2208,
                    "name": "public cloud",
                    "slug": "public-cloud",
                    "description": "Use of the public cloud is accelerating, supporting enterprise digital transformation efforts. Read our insights on how firms can leverage the power of the cloud while mitigating security vulnerabilities and other risks.\r\n\r\n<a href=\"\/technology\/\">Discover how Forrester supports IT leaders.<\/a>",
                    "permalink": "https:\/\/www.forrester.com\/blogs\/category\/public-cloud\/"
                }
            ],
            "meta_desc": "AI capacity is reshaping FinOps as organizations shift from optimizing costs to securing and governing scarce AI infrastructure.",
            "author": "Tracy Woo"
        }
    ]
}