Decision Value

As technology spend increased, it was unclear how much cost each application created, which systems were needed and how technical debt affected investment. Decisions rested on the views of different teams rather than shared data.

The application portfolio, total cost of ownership and technical debt were assessed together. A technology cost management solution made application, infrastructure, licence and support costs visible. Systems to retire and contracts to renegotiate were identified. In the first year the application portfolio was simplified by 15%; cost improvement initiatives delivered EUR 2.5 million in savings. Leadership began setting investment priorities on a more concrete financial basis.

Software entitlements were tracked manually, and as subscription models changed the link between real need and purchasing weakened. The organization bought new subscriptions without considering the unused licences it already held.

The advisory work matched contracts, usage data and existing licence entitlements. Through a software asset management and licence optimization solution, unused entitlements were reallocated and purchases were tied to verified need. A 10% reduction was identified across the five largest enterprise software costs. Internal reviews moved from annual to quarterly at no additional resource cost, reducing spend while increasing the frequency of control.

Licence types assigned to ERP users did not match their real needs. Inactive accounts and incorrect assignments inflated the need for additional licences, and audit preparation took a long time.

ERP licences were restructured by analysing user roles and actual usage. A licence optimization solution made inactive accounts and unnecessary assignments visible. In the period reviewed, the cost of additional user licences fell from EUR 9.5 million to EUR 2.4 million, creating EUR 7.1 million in savings. The time needed to gather information for audit preparation dropped from up to a year to under six months. Existing technology was managed more accurately and used at lower cost.

Business units worked with different policies and processes. Without reliable inventory and usage data, duplicate software, underused systems and licence obligations could not be identified in time.

Technology assets and the software lifecycle were brought into a common management model. Usage, contract and licence data were validated to identify unnecessary spend and compliance risks. Savings and cost avoidance exceeding USD 14 million in total were reported. This figure is not cash savings alone; it includes avoided licence obligations. Central visibility accelerated purchasing and reuse decisions.

The existing asset management setup covered only a third of the global technology estate. Missing purchasing and licence data turned budget, contract and audit processes into manual workload.

Coverage and data gaps were assessed, and inventory, contract and licence information was consolidated in an integrated IT asset management solution connected to the ITSM platform. A managed service model kept the data current. Savings above USD 400,000 in maintenance, operations, support and licence costs were reported in the first year. Global scope became manageable with two external providers instead of the six that had previously covered a single region. Visibility reduced both cost and management workload.

Analytical models delivered early benefits; when production conditions changed, recommendations degraded and operators stopped using them. Internal teams had limited capability to update the models. The technology investment was not turning into lasting performance.

Model performance, data conditions, user experience and team capability were assessed together. Models were retrained; operators and analytics teams began working together with hands-on training. Adoption of model recommendations rose from 60% to 85% within a few months. Annual savings of USD 4 million from a single production optimization model, and USD 20 to 30 million in value with a 2 to 3 point EBITDA improvement from the wider program, were reported.

Security operations ran at regional and business-unit level. Shared visibility, responsibilities and response processes were not integrated enough, making global coordination difficult.

Cybersecurity maturity, capacity and the operating model were assessed. Regional operations were combined into a shared security operations center; endpoint detection and response and security automation were integrated. Threat response time fell by about 85%. Automation reduced the staff time consumed by false alarms, letting teams focus on significant incidents. No monetary savings were disclosed; the financial value lies in reducing outage exposure and manual response workload.

Around a dozen security solutions were in use, but risks could not be monitored in a single view. The fragmented setup increased management, licence and skills burden.

The security architecture was assessed and identity, device, privileged access, event monitoring and automated response processes were integrated. Continuous risk review and action validation were set up with specialist support. Licence costs fell and average availability reached 99.7% including maintenance. The organization stated that it avoided the investment in eight data centers and additional operations staff that an in-house growth scenario would have required. This is avoided investment, not savings from closing existing facilities.

Existing monitoring and response capabilities had to be strengthened against growing threats. Beyond new tools, the right architecture, capacity and analyst workflows were needed.

Lessons from earlier implementations were reviewed and architecture, fault tolerance and capacity planning were redesigned. Central event correlation, behaviour analytics and response automation were introduced. Potential threat detection improved fivefold; average detection time reached 10 minutes, triage 30 minutes and response 70 minutes. The financial value lies in more productive use of analyst time and in limiting the impact of incidents on critical services.

System access was provisioned manually and employees waited to be able to work. Insufficient monitoring of privileged user activity created security and accountability gaps.

Access risks were assessed and brought onto the leadership decision agenda. Solutions were compared against real usage and integration scenarios; identity governance, privileged access management and single sign-on were rolled out in phases. Access provisioning after manager approval was reported to drop from up to five days to seconds, 98% faster. Operational waiting and manual workload decreased. No monetary savings were disclosed, but returning employee time to work is a direct productivity gain.

Using AI in critical functions required clarity across the organization on model ownership, approval, evaluation and monitoring. Different applications needed to be managed under common control.

An organization-specific AI lifecycle and continuous monitoring framework was established. An AI governance solution brought together responsibilities, model evaluations, version control and performance tracking. Automated oversight helped reduce manual control effort and enabled faster response to drift. No numerical financial result was disclosed; the value lies in scaling AI initiatives in a more controlled way and seeing risks early. Some generative AI integrations were still in testing when the work was completed.

There were many AI opportunities; it had to be decided which areas came first and how they would deliver measurable benefit. In customer-facing applications, experience, data quality and running cost had to be managed together.

About 200 possible areas were assessed and roughly ten were prioritized first. For the shopping assistant, safety boundaries, data quality and unit cost were improved, and benefit was measured through comparative tests. Conversion was reported at twice the rate of sessions using search and five times the rate of sessions without the assistant. Before launch, cost per chat session was reduced by 93%. The commercial value of customer interaction and the operating economics of AI improved together; this result does not mean total sales increased fivefold.

The organization had invested in IT service management and strategic portfolio management platforms. Low use of licences and existing capabilities limited the benefit the investment could deliver. The existing platform had to be assessed before any new investment.

Platform configuration and licence usage were reviewed and practical improvements identified. The work delivered annual licence savings of USD 44,000. The freed-up budget was used for an employee service center, more consistent categorization, out-of-the-box platform capabilities and a virtual assistant integrated with the corporate communication channel. The advisory work did not only reduce cost; it increased the contribution of the existing investment to service quality and employee experience.

Because of manual processes, it was not clear which software was in use, which was unnecessary and which versions carried security risk. Licence reviews took long and purchasing decisions could not rely on verified usage data.

After a pilot assessment against technical and business requirements, software asset management and automated discovery solutions were deployed. Installation, usage and licence information was combined in a shared inventory. A 90% reduction in licence data collection time was reported. Potential annual subscription savings of USD 74,000 and potential cost avoidance above USD 740,000 in licence obligations were also identified.

Costs from multiple cloud providers were managed on separate screens. The central technology team absorbed the cost of services used by other units; resource ownership, budget forecasting and optimization opportunities were not visible enough.

A shared FinOps operating model was established with a cloud cost management solution. Oversized resources were rightsized, unused resources were shut down and suitable systems were stopped outside working hours. A 20% reduction in cloud spend within six months was reported. Tagging coverage that supports cost allocation to applications rose from below 30% to 80%. Forecast variance fell to about 3%. Finance, technology and business units began making decisions from the same cost view.

Distributed cloud accounts, inconsistent tags and low FinOps maturity made costs hard to understand. Unused servers, orphaned storage, old backups and inefficient network configurations drove spend up.

Cost and usage data were combined; resource sizing, backup and retention needs were reassessed with application owners. Cleaning up unused resources and optimizations delivered verified recurring annual savings above USD 1.4 million, as reported. Around USD 30,000 per month in avoidable network costs was also uncovered.

With business volume changing fast, technology resources and costs had to adapt at the same speed. Having moved to the cloud did not mean spend was managed according to business conditions.

Cloud costs were made visible at application and business-unit level. FinOps processes, cost ownership and resource sizing were addressed together. When demand fell sharply, consumption including test and development resources was reduced and cloud costs were halved without affecting business continuity. The gain came from adapting capacity to demand under crisis conditions.

Closed systems built for specific tasks made it difficult to improve operational processes and add new digital capabilities. In critical processes, security, usability and cost had to be addressed together.

Working back from business goals, technology investments and architectural direction were set. The organization moved from closed systems to a platform approach based on reusable capabilities; workflow automation, a data platform and user-centred tools were developed. In the first year the end-user usability score rose from 37 to 82. A potential annualized improvement of USD 15 million was identified in one critical process. This financial value is an opportunity, not disclosed as realized savings.

Teams involved in the financial close followed different procedures. Unclear handovers led to rework, and large, long meetings were held to resolve issues.

Process modelling and workflow automation made tasks, dependencies and handovers between teams visible. Progress and issues were tracked through a shared process. The number of participants needed for period-close meetings was halved. Savings of around USD 240,000 per quarter were calculated from reduced meeting time and attendance. The value came not only from automation but from turning unclear coordination into an orderly workflow.

Account opening, credit operations and customer information updates were document- and form-heavy. Re-entering the same data, correcting errors and manual checks lengthened processing times.

Processes were reviewed and steps suitable for automation identified. Robotic process automation was applied to document checks, data transfer, credit analysis and account opening. Processing times in the reviewed processes were reported to fall by up to 80% and costs by up to 20%. Employees could spend time on more meaningful work instead of repetitive transactions. These rates are not averages that can be generalized to all of the bank's operations.

Reviewing claim documents, re-entering data and switching between legacy systems limited staff capacity. Growing demand created more operational load under the existing way of working.

Workflows were mapped, and robotic process automation, workflow management and AI-assisted document processing were applied together. Data extraction from complex documents and repetitive steps were automated. Daily capacity was reported to rise from 15 claim files to as many as 288, with the processing cycle four times faster. No monetary savings were disclosed; the operational value is that existing staff can handle higher volume with fewer errors.

Manual threat detection relied on different tools and the individual effort of specialists. This setup was limited in speed, scalability and consistency; unnecessary alerts consumed time that could have gone to significant incidents.

Security event management, behaviour analytics and AI-assisted anomaly detection were brought into a common view. Organization-specific rules and more than 200 alert automations were created. Average threat detection time dropped from days or weeks to hours; false positives and the need for manual intervention decreased. Cost savings were also achieved. The financial contribution comes from reduced manual monitoring workload.

Production sites used different backup and recovery solutions. The complex setup made it hard to see whether all critical systems were fully backed up and whether data could be restored quickly.

Based on the needs of production systems, a standard data protection architecture was designed that can be sized to each site. High availability, automated backup, compression and detailed access controls were applied together. Thanks to the local design, backups could continue even if the internet connection was lost. Reduced management complexity and improved performance and resilience were reported. No numerical financial result was disclosed; the cost contribution comes from standardization, storage efficiency and right-sized capacity.

An infrastructure operator managed many sites through a central SCADA system. But systems that were running were not necessarily secure. Vulnerabilities in industrial control devices, external connections and third-party access were not visible enough, and it was hard for a small OT team to monitor all sites continuously.

In a pilot assessment with OT security specialists, the device inventory was mapped, communicating systems were identified and control device vulnerabilities were brought to light. The investment decision was then based on concrete findings rather than assumptions.

A central OT visibility and threat monitoring solution that used the existing network architecture made it possible to monitor 200 sites from a single sensor. A one-person OT team began tracking assets, network activity, vulnerabilities and anomalies from a shared view.

By limiting the need to build a separate security setup at every site, this approach kept investment and operating effort under control while extending the area a small team can manage. Readiness for industrial security standards became part of daily operations.

An electricity distribution operator wanted to improve the security and reliability of its industrial control networks. Monitoring and managing the networks took operations staff time, and investigating issues required field team visits.

An industrial network visibility and security monitoring solution strengthened oversight of control systems. The same setup, while monitoring cyber threats, also made operational issues easier to understand and systems easier to manage.

Administrative workload related to industrial control systems fell by 10 to 12 hours per week. The number of maintenance vehicle trips to the field was also reduced.

The time gained gave the technical team more capacity for maintenance and improvement work. Fewer field interventions limited travel, staffing and response load. The security investment became value that also supports the efficiency of daily operations.

A manufacturer growing through acquisitions had inherited different security practices and maintenance suppliers from different sites. The corporate IT security team tried to extend the tools it used on office networks to production networks, but these tools proved unsuitable for OT environments.

Suspicious activity in production systems could not be detected well enough, and remote maintenance access created additional risk.

After evaluating alternatives and a pilot test, a security approach suited to the industrial environment was rolled out to all production sites. OT asset inventory, continuous threat monitoring and secure remote access were combined under one management structure.

Shared visibility across sites was established; employee and maintenance supplier access was brought under control. Security monitoring was applied without affecting production processes and devices.

Choosing the right technology prevented existing tools from being pushed into environments they did not suit. Security resources were directed to the real needs of production, creating a stronger basis for managing the production loss and restart costs that outages can cause.

A chemical manufacturer had different network designs and inconsistent security practices across its sites. Some network connections did not match production logic; unmonitored connections and third-party remote access created risk.

These risks affected not only information security but also the availability, reliability and physical safety of production.

OT asset discovery, continuous security monitoring and controlled remote access were brought into a common structure. OT asset visibility was achieved across more than 60 production sites. Collaboration between central security operations and production security teams improved; supplier access began to be managed through permissions, policies and audit records.

Shared visibility made it easier to compare the security needs of sites and prioritize resources according to real risk. A management structure emerged that can reduce repeated site-by-site review and coordination effort.

Production continuity, secure maintenance access and more consistent risk management were addressed in one approach. Security investments thus supported operational reliability and the protection of existing production capacity.

A large energy company's IT operations were run by many service providers. Visibility and traceability of services were limited. Hundreds of enterprise application environments and critical production applications were managed within a complex support structure.

The fragmented service model made it hard to track performance and responsibilities as well as cost.

Application and infrastructure services were consolidated into a common service management model. Service levels, responsibilities and governance reporting were clarified. The model was designed in line with references such as ITIL, COBIT, ISO 20000-1 and ISO 27001.

The transition was completed in three months. By the third year, IT operations costs were 45% lower than the starting level. Consolidating enterprise application environments reduced critical incidents by 40%.

Simplifying the service model allowed costs to be managed in a more controlled way. Fewer critical incidents eased the support and response load; consolidation, governance and process improvements together created sustainable operational value.

An infrastructure operator needed a new operating model when its existing IT service contract ended. The goal was to reduce cost, improve support quality and align infrastructure with the business plan.

The critical requirement was that daily operations would not be disrupted while the service provider changed.

Needs were assessed and a phased transition plan prepared. ITIL practices, an ITSM solution, standard technical documentation, a continuous service desk and self-service channels for users were introduced. Three separate computer rooms were consolidated into a single data center.

Support services achieved 30% cost savings. The first-time resolution rate rose from 18% to a monthly average of 45% within three months. All service level targets defined for the stabilization period were met.

Resolving more requests at first contact reduced rework and handovers between support teams. With a simpler infrastructure and more efficient use of support capacity, cost and service quality improved together.

A large telecommunications operator wanted its service management practices to work consistently across teams and their value to be independently assessed. Defined processes were not enough; their effect on service quality and business continuity had to be demonstrated.

ITIL practices were supported by a common process structure and a process center of excellence. Service management capabilities were reviewed against the ITIL Maturity Model through an independent assessment, and level 4 maturity certification was achieved.

With the improvement in service management, the number of major incidents fell by 46% and 364 hours were returned to business teams compared with the previous year.

Fewer major incidents eased outage and response load. The time recovered increased the capacity business teams could devote to their core work. The independent assessment made the capabilities behind this progress visible and created a reliable basis for the next improvement decisions.

An organization managing critical metering and billing infrastructure had to change its IT service provider. The new contract had to be prepared quickly, but writing the technical scope was not enough.

Who approves changes, who owns which risks and which outputs the provider will deliver had to be clearly defined.

COBIT 5 was used as the common reference from bid evaluation to contract management. Process requirements, expected capability levels and deliverables were defined. A RACI responsibility matrix wrote the duties of the organization and the provider into the contract.

Issuing the tender, evaluating responses and signing the contract were completed in five months. A shared process language clarified requirements and reduced the risk of differing interpretations. The same structure continued to be used for governance and continuous improvement throughout the contract.

Defining scope, responsibilities and acceptance criteria from the start created a stronger basis for managing extra work, contract disputes and coordination costs. The purchasing decision went beyond price comparison and became manageable in terms of service quality, risk and long-term value.