IT Process Automation: What Actually Automates

Short answer: password resets, access requests and status lookups automate cleanly and account for a large share of L1 volume. Gartner benchmarks industry-average deflection at 20–30% with best-in-class at 40–60%, against vendor-published cases citing 50–75%. Budget for the benchmark, not the case study.

The arithmetic on IT process automation is unusually favourable, which is exactly why the claims around it are unusually inflated. Here is what holds up.

Start with your cost per ticket

The average North American service desk spends around $15.56 per ticket across labour, tooling and overhead, with cost per resolved incident nearer $22.50. The range across enterprises runs $6 to $40+, with an internal IT median around $22.

Get your own figure before anything else, because every downstream decision depends on it. Total service desk cost divided by tickets resolved, over a full quarter. If that number is at the low end, the automation case is weaker than the vendor assumes; if it is at the high end, marginal categories become worth doing.

Then the illustrative arithmetic is straightforward: automating 400 password resets a month at roughly $15 each is about $6,000 a month. Not transformational on its own — but password resets are rarely the only candidate, and they are the easiest.

What genuinely automates

Rank by how deterministic the answer is, not by volume alone.

Cleanly automatable. Password resets and account unlocks. Access requests against a defined entitlement model. Status lookups — ticket state, change windows, service health. Software provisioning from an approved catalogue. Standard onboarding and offboarding steps. These have one correct answer retrievable from a system you already have, and success is verifiable.

Automatable with care. Triage and routing, where the cost of a wrong route is a delay rather than an incident. Knowledge-base answers for common how-to questions. Diagnostic data collection before a human picks the ticket up — genuinely underrated, because it removes the slowest part of L2’s job without needing to resolve anything.

Leave alone in a first build. Anything requiring judgement about business impact. Anything where being wrong is expensive or hard to reverse. Anything whose answer depends on context the system cannot see. Novel incidents, by definition.

Reported figures put AI handling 40–60% of L1 tickets in the automatable categories. That is a meaningful share of a large denominator, and it is a much more defensible target than a headline deflection percentage.

Ticket categories like these are the usual entry point for business process automation work, because the decision rules are already written down in a runbook.

Deflection depends on your knowledge base, not your model

This is the finding that should reshape most project plans.

Teams with sparse, outdated documentation see 10–20% deflection. Teams with curated, regularly maintained knowledge base articles see 50–70%. Same technology, three to five times the result.

The variable is not the model. It is whether the answer exists in retrievable form. A retrieval system cannot surface an answer nobody wrote down, and no amount of model capability substitutes for that. Year-one deployments typically start at 20–35% and mature to 50–60% by month 12–18 — and that maturation is almost entirely knowledge-base investment, not tuning.

So if your documentation is thin, the honest first project is a documentation project. Sequencing it the other way round produces a disappointing pilot and a lost budget.

Automate the whole loop or you have moved the bottleneck

The most expensive mistake in IT process automation is automating the interesting step. A team automates ticket classification, declares a win, and finds the queue reformed one step later at the person who now checks the classification and does the actual work.

A loop is intake, interpretation, decision, action and record. Automating one link moves the constraint; it rarely removes it. Before scoping, walk the whole loop and count human touchpoints. More than one remaining means a partial win at full price.

Systems that take actions — resetting a password, granting entitlement, provisioning software — need the discipline any agentic system needs: idempotency so a retry does not grant access twice, authorisation so the automation acts only where permitted, and audit trails so you can reconstruct what happened. In an access-management context these are compliance requirements, not engineering preferences.

Measure resolution, not deflection

Same trap as customer support. A ticket closed without reaching a human is not the same as a problem solved. An employee who gets an unhelpful answer, gives up and walks to the IT desk was deflected on the dashboard and not helped in reality.

Four numbers worth a weekly dashboard:

True resolution rate, verified by whether the same user raises the same issue within a week.
Requests where retrieval returned nothing — your documentation backlog, ranked by frequency.
Escalation latency on tickets that did escalate. Pure cost when it is high.
Straight-through rate by category, so you can see which automations are actually working rather than an average that hides it.

Point two is the highest-value artefact the system produces and the one most teams never look at.

Sequencing that works

Measure cost per ticket and categorise a month of volume.
Pick the highest-volume deterministic category — usually password resets or access requests.
Fix the knowledge base for that category only. Narrow and deep beats broad and thin.
Build the loop end to end, including the exception path and the audit trail.
Measure resolution for a month before adding a second category.

Step five is the one under schedule pressure to skip, and skipping it means the second category inherits mistakes nobody has noticed yet.

The takeaway

The economics are good and the benchmarks are lower than the marketing. Establish your own cost per ticket, target the deterministic categories, and recognise that deflection tracks knowledge base quality far more than model capability. If your documentation is thin, that is the project.

Sources

EpochC builds AI workflow and business process automation, AI agents that act on your systems, and domain-grounded assistants. Start a project.

IT process automation: which tickets actually automate, and which do not