AI automation Managed IT Security Insights About Backup & recovery Microsoft 365 & cloud Connectivity & voice Log a support ticket Book a free check

Insights · AI automation

Why automation fails on shaky IT — and what to fix first

By the Cloud ITS team··5 min read
A concrete foundation with exposed steel rebar in the foreground and a glass office building rising behind it

There is a lot of genuine value in business automation and AI assistants. Invoices captured without retyping. Client onboarding that runs itself. Reports that assemble overnight. A helpdesk that suggests the right answer before an engineer has finished reading the ticket.

But there is a pattern we see often enough to write about. A business buys an automation platform or switches on an AI assistant, and within a few weeks something goes wrong. Not because the tool was bad, but because it was placed on top of IT that was not ready for it.

Automations and AI assistants inherit the state of your systems. If those systems are messy, the automation does not tidy them up. It moves faster through the mess.

What goes wrong on shaky foundations

Messy permissions get exposed

AI assistants, such as Microsoft 365 Copilot, typically work within the permissions a user already has. That sounds safe, and in principle it is. The problem is that most organisations have years of over-shared folders: a SharePoint site open to “Everyone”, a salaries spreadsheet in a folder half the company can see, an old project share nobody locked down.

Before AI, nobody stumbled across those files because nobody went looking. An assistant that can search everything you have access to will find them in seconds and happily summarise them. The permissions were always wrong; automation simply makes the consequences visible. Our Copilot readiness checklist covers this in detail.

Undocumented systems break flows silently

An automation that moves new client details from a web form into your practice management system depends on both ends staying the same. If someone changes a field, renames a folder, rotates a password or replaces a server, and nobody knows the automation depended on it, the flow stops. Often it stops without telling anyone.

In an undocumented environment, you do not know what depends on what. That is uncomfortable with people doing the work. With automations doing it, it becomes a stream of quiet failures.

No monitoring means failures go unnoticed

A person who cannot complete a task tells someone. An automation that fails usually just does not run. If nothing is watching, a 35-person accounting practice in Pretoria East might discover a month later that client documents stopped filing themselves on the 3rd, and nobody noticed until a client asked.

Automations need the same kind of monitoring as servers and backups: alerts when they fail, routed to a named person, tracked to resolution.

No backups means an automation can damage data at scale

People make mistakes one at a time. An automation with a faulty rule can make the same mistake ten thousand times in a minute: overwriting records, deleting the wrong files, sending the wrong document to every client on a list.

If you have verified backups and tested restores, that is an annoying afternoon. If you do not, it can be very serious indeed. Our backup self-check is a quick way to find out where you stand.

Weak identity security means an attacker gets your automations too

Automations run on accounts and connections that usually carry broad access: service accounts, API keys, app permissions with rights to read every mailbox or every file. If your identity security is weak, an attacker who gets in inherits all of that. They can read what your automations read and, in some cases, use your own workflows to move data out or send convincing emails on your behalf.

Automation does not create new problems so much as it multiplies the ones you already have. The same is true in reverse: on solid IT, it multiplies the benefits.

What to fix first

None of this is an argument against automation. It is an argument for doing things in the right order. These are the foundations we look at before recommending any workflow.

1. Identity

  • MFA on every account, with Conditional Access policies in Entra ID that block risky sign-ins.
  • Admin rights limited to those who need them.
  • Service accounts and app connections inventoried, given only the permissions they need, and owned by a named person.
  • Leavers’ access removed promptly.

2. Documentation

  • An up-to-date list of systems, integrations and who owns each one.
  • Credentials in a business password manager, not someone’s memory. Our IT handover checklist sets out a practical standard.
  • A change log, so that when something changes you can check what depends on it.

3. Backups

  • Servers, workstations and Microsoft 365 data backed up, with an off-site copy protected from deletion.
  • Restores tested regularly, so you know a bad automation run can be undone.

4. Monitoring

  • Alerts for failed backups, security events and failed automations, routed to someone who acts on them.
  • A ticketing system, so issues are tracked rather than forgotten.

5. Data hygiene

  • Sharing permissions reviewed, especially on SharePoint, Teams and file servers.
  • Stale data archived, duplicates removed, and a clear idea of where personal information lives. If AI tools will touch personal information, read our post on POPIA and AI tools.

Then pick one workflow

With the foundations in place, start small. Choose one workflow that is repetitive, rules-based and annoying for the people who do it. Good first candidates tend to be things like capturing supplier invoices, routing incoming enquiries, or preparing a standard monthly report.

Measure how long it takes today, automate it, keep a person in the loop to confirm the results at first, and watch it closely for a few weeks. Once it is reliable, move on to the next. Our post on where AI automation pays off has more ideas on choosing well.

Why we do both under one roof

Cloud ITS has been a managed IT provider since 2015, looking after businesses of roughly 30 to 100 users on a 24/7 retainer. We run Microsoft 365 and Entra ID, SentinelOne, Cove Data Protection, FortiGate firewalls and HaloPSA for our clients every day. That is why we now offer AI automation as well, rather than instead.

We use AI in our own operations: suggested ticket triage that an engineer confirms, and correlation of related alerts so that one underlying problem is not treated as five separate ones. We describe that in how we use AI in our helpdesk. It works because the systems underneath are secure, documented, backed up and monitored.

Doing both together means the person designing your automation can also see your permissions, your backups and your monitoring, and fix them first. It also means that when something changes in your environment, the people making the change know which automations depend on it.

A sensible first step

If you are considering automation but are not sure your IT is ready, that is exactly the question our free Automation & Risk Check is designed to answer. In 30 minutes we look at where automation would pay off for you and at the basics (backups, security and documentation), and you receive a one-page report. No obligation.

Keep reading

More insights

A relaxed South African businesswoman in her fifties sitting at a cleared desk at the end of the day, laptop open in front of her
AI automation6 min read

Where AI automation actually pays off in a 30-person business

Not every task is worth automating. Here is how a 30-person business can find the handful of workflows where AI genuinely saves time, and avoid the ones where it doesn't.
A young South African woman support engineer wearing a headset, looking at a list of helpdesk tickets on her screen
AI automation6 min read

How we use AI inside our own helpdesk (and where we don't)

Before recommending AI to clients, we put it to work in our own helpdesk. Here is what it does, what we deliberately keep it away from, and what we learnt.
A printed document lying on a desk with a glowing cyan padlock made of light hovering above it
Security6 min read

POPIA and AI tools: what your staff can (and can't) paste into a chatbot

Your staff are already using AI chatbots. Here is a plain-English look at how POPIA applies, and the simple rules that keep client information where it belongs.