On the Ground and in the Cloud: Observability and AIOps

William Blair tech analyst Jake Roberge joins the show to discuss the observability and AIOps software markets, including the increasingly important role these platforms are playing for businesses of all sizes, why they are gaining momentum over legacy monitoring tools, and some of the key trends he’s seeing in the market.

Podcast Transcript

00:24
Chris Thonis
Welcome back, everybody. On today's episode of William Blair Thinking Presents, we welcome research analyst Jake Roberge, who covers software and software as a service for our tech, media, and comms team. If you recall a few months back, we hosted Jonathan Ho, Arjan Bhatia, and Jason Ader for a deep dive into the tech team's quarterly publication On the Ground and in the Cloud. So this thing delves into trends impacting developer technologies across a wide scope of topics, including software development, DevOps, database analytics, and observability. Jake took on this last quarter's publication with a focus on observability and AIOps software markets. AIOps, by the way, for those who don't know, is artificial intelligence for IT operations, and the increasingly important role these platforms are playing for businesses of all sizes.

So, with that, Jake, appreciate you being here. To start do you mind just giving us a bit of background on this quarter's report? Mainly high-level, what the focus of the report is, and then maybe a quick dive into the history of the observability market. And then I'm thinking from there we move on to some of the key takeaways of the report.

1:28
Jake Roberge
Yes, definitely. And thanks for having me on to do the podcast today. In this report, we really dive into the observability and AIOps markets. Like you said, look at a deep dive and try to understand what are the pain points that these platforms are solving. What are the problems that they're solving for customers? Then really just why do these modern observability vendors have a place in this market? What are they addressing that the legacy vendors weren't addressing? And why are they taking share from those legacy vendors?

And then I think the most important part of the report is that we discuss a lot of the secular growth drivers behind this market. So what takes this from the market it is today to be this durable, long-term compounding growth market over not just the next three years, but thinking the next five years, the next 10 years. And I know we'll discuss a lot of those drivers in the report, but just as a quick teaser, those are things like increasing infrastructure complexity, the move to the cloud. There are a ton of secular tailwinds behind this market.

And then per your question around just the history of this market, I think the interesting thing here is observability or monitoring tools is it's not a new market by any means. The first observability acquisition actually took place back in 1996. So, this is a market that has been around but the difference is, we are now monitoring very different software paradigms.

When we were using on-premise software, a lot of those software applications were built on monolithic code bases. What does monolithic code base mean? Well, that means it's literally one code base. When we're thinking about the problems that pop up in those software applications, it was actually relatively easier to understand where the issues were within the software code or the software application. But as we start to migrate more workloads, and more applications to the cloud, that's where we get increasing infrastructure complexity I mentioned earlier, where you might have thousands and thousands of containers and microservices when you migrate to the cloud. And that's really what's presenting this need for these modern observability vendors and why the category has risen to prominence over the last five to 10 years.

3:44
Chris T.
Got it. All right. So one of the first key takeaways you mentioned in the report is that we are in the early innings of a large market. Can you just go through what that means exactly?

3:52
Jake R.
Yeah. So, going back to what I said earlier in that question is we are in this massive shift to the cloud. When we think about software applications that were first built on-prem, where each individual companies had their own data centers, their own servers, their own compute, and they manage the hardware and the software versus when we moved to the cloud, all of that's managed by the hyperscalers and you have these applications that can be split up into these modern infrastructure environments. And our viewpoint is that we are still in the very early innings of that transition. And as I mentioned earlier, when you make that transition, that is when the need for observability and AI ops becomes so much more important.

And some recent statistics out there show that about 50% of workloads are in the public cloud today, which you might hear that number and say, hey, that actually sounds pretty penetrated. So why are you saying that we're in the early innings of this market? And the reasoning behind that is while 50% of workloads are in the cloud, only 18% of IT spend is in the cloud. What that tells us is, the lighter weight workloads are actually moving to the cloud already versus a lot of these tier one apps that are much more mission-critical, that have a lot more important and larger budgets attached them are still largely in these on-prem environments.

When we think about the opportunity moving forward, as those applications start shifting to the cloud, those are the ones that really need to be observed. Those are the ones that really need to be monitored. Those are the ones that need to be secured. So that's kind of the thought process around the early innings of this cloud migration.

And then the other really big secular tailwind and why we view this as an early innings market is software is becoming a much more important aspect of every business. You've heard the moniker out there that software is eating the world. So when I think about the largest taxi company in the world that we can all think about, they don't actually even own a car. When we think about the largest hospitality, one of the largest hospitality vendors out there where we can book our stays using their applications, they don't really own much property at all. And so we see this across a lot of different industries where software is eating the world. And that's causing a lot of the more legacy industries to realize that we need to move to a digital world. And as we move to a digital world, software becomes a lot more important for you. And when software is running your business and driving revenue, that's where these observability and AIOps platforms really shine, because essentially, they help your software work better. And so, when your software works better, that allows you to increase revenue, and drive engagement with customers. We view those as really the two big secular tailwinds behind these observability and AIOps software markets.

06:52
Chris T.
Got it. Okay. So we touched on the cloud, but I know you also talk a bit about cloud consumption, touching on the fact that growth for observability vendors has experienced some headwinds lately, but that growth could return quickly as the macro normalized. Just how so? If you don't mind going through that a bit.

7:09
Jake R.
Yeah, of course.

So when we think about what's happened over the last few years, there's been a lot of IT budget sensitivity because in 2020 and 2021, a lot of companies adopted a lot of software applications and a lot of developers could try and buy software applications just by swiping a credit card.

And in 2020 and 2021, when funding environments were really robust and when investors frankly were a lot more focused on growth versus margin, CFOs and CIOs didn't really push back on that spending. But as we've moved into 2022 and 2023, a lot of CFOs and CIOs have been a lot more sensitive. And over the past two years a lot of CFOs or CIOs have gone to their 150 or 500 different software applications within their ecosystem and said, “Hey, do we need this? Do we actually need this? Does this make sense to be paying for? Could we get it somewhere else?”

And at the end of the day, they've been able to optimize a lot of those applications. And so that has created this headwind to growth. It's not that software is becoming less important. It was just, hey, in 2020 and 2021, we probably adopted more software than we needed and there was a nice healthy rationalization that needed to take place.

So that was step one in terms of what impacted growth. But step two was really around the storage mechanism in which a lot of this data that observability platforms collect for their customers is placed. And so when I think about a lot of the observability vendors, they operate within different storage buckets. And so maybe you'll have really sensitive security logs, metrics or traces going to a hot storage tier where you can index it really quickly, search it, really quickly, get to the answer to your problem more quickly.

But what vendors realized is that they were putting all of their data in that hot storage bucket. And the reality is you probably only need the most mission critical data in there. And maybe the more rudimentary compliance logs you can just put in a cold storage bucket where you can pay a lot less and maybe you can't as quickly access that data, but it still is available to you.

So maybe we'll put our sensitive observability out in hot storage or less sensitive compliance data in cold storage. And then we just have these user logs where we collect emails that we need to retain for six years. Do we really need that in any type of these platforms?

And so a lot of that data was just placed directly into the hyperscaler storage buckets. And so over the past two years, you've had this rationalization of software applications and you had this rationalization of the data that observability vendors obtain and consume to create their analysis. And our viewpoint is that there is only so much that you can rationalize.

As we return to that economy, getting in a normal, more normalized environment, we should see software application purchasing decisions pick back up again and we should see data start to grow again because there's only so much you can rationalize. You still have the sensitive observability data that you need to collect in hot storage or cold storage. And so, we view this as something that rebalances very quickly once the economy starts to normalize.

10:30
Chris T.
Got it. Okay. So let's talk a bit about the ways in which partnerships with cloud service providers and then global system integrators are increasing industry awareness for the observability category. Why is that so important?

10:43
Jake R.
This one is really all about mindshare. When we were putting together this report, we talked to a lot of the GSIs that are in the ecosystem. And the overall trend was observability is going from a nice to have thing to a mission critical. So if we flash back to that that large cloud migration that a lot of these companies are going through in the enterprise, a lot of times enterprises would migrate their applications and leave them almost unmonitored for three to six months or maybe they wouldn't leave them unmonitored, but they would just use the monitoring tool that a hyperscaler or a cloud service provider gave them right off the bat where it's not as robust or powerful as a true observability platform. But maybe it gets you the answers, the lightweight answers you need. I'll say that that way.

And what the initial purchasing decision for a lot of these observability platforms would be, frankly, when the first thing broke. When the first thing broke with their software application three or six months down the line. So, we had this statistic in the report where a large social media platform lost an estimated $65 million of revenue based off the misconfiguration of certain routers and storage systems in their data center.

So it was just down for 5 hours and they lost $65 million. And so obviously that's a large-scale event right there. But it shows that when things break, there's a lot of revenue and reputation harm that is at stake. When those things broke three to six months into your cloud migration, that's when a lot of these companies realized, okay, we can't keep monitoring these with lightweight tools. We need full scale observability platforms.

What we've seen from a lot of GSIs out there is they've started to implement observability into their recommended architecture for a lot of these enterprises as they migrate to the cloud. So you have observability solutions on day zero as you migrate applications of cloud instead of waiting three or six months until things break.

So that's the GSIs. In terms of the hyperscalers, this is a different dynamic because if you invest in infrastructure/software land, the first question you get is how are hyperscalers going to impact this market? Why can't I just buy it all from them? And I think the biggest reason why you can't in observability is most of these applications, there are statistics out there that 75% to 80% of workloads in applications span across multi- and hybrid-cloud environments, so you can't just use one hyperscale solution because they can't span across the other clouds and so that's why you need an observability vendor. But there is this concept from a partnership perspective that's been increasing over the last few years where the hyperscalers have almost created a similar app store that we all have on our mobile phones, but for the cloud environment.

And so what that allows you to do is purchase independent software vendor applications through their cloud marketplaces where they'll take a take rate and more importantly, it'll drive that consumption, that storage and compute over to their platforms. And so that's why a lot of the hyperscalers are now incentivizing their sales reps to buy from the ISV observability vendors. And so that is creating a really nice partnership opportunity for these observability platforms and mitigating a competitive threat out there. So that's kind of the dynamic on the hyperscalers, which is semi-different than the GSIs.

14:15
Chris T.
So staying on this topic of observability, you talk a bit about how monitoring tools are still being adopted in silos, but that platforms are merging. In short, you believe spaces are converging as vendors are building unified platforms, and customers look to consolidate point solution monitoring tools. Can you dive into this a bit deeper? I'm sure you know, there are some who are really interested in this area.

14:34
Jake R.
Yes, of course. If we take a step back, there are three big categories within observability, there's log management, there's infrastructure monitoring, and there's application performance monitoring. But within that, most enterprises today still use 10 to 15 different monitoring tools. When we think about the opportunity moving forward, it's a lot of these modern observability vendors are starting to build comprehensive platforms that don't just address log management, that don't just address infrastructure monitoring, application performance, mining, but they're building holistic platforms that address all of these core data types.

And so instead of just being the one or two different tools in the toolkit of a modern enterprise, they are able to consolidate 10 to 15 different applications. And when we think about that, that's an enormous revenue opportunity for them because space has become so fragmented. And why would an enterprise want that? Well, it's now these products are actually up to snuff. We no longer have the best of breed within each category. A lot of these modern vendors have created holistic platforms that can really compete best-of-breed within each category. And what that allows you to do is you have one integrated user experience, you have one throat to choke in terms of negotiations with the customer.

And then once that data is consolidated, it allows you to do more with it and really get into the execution and the workflow engine behind these observability data types. So that's why customers are interested. And then ultimately that's why companies are really interested because it's such an enormous revenue opportunity once you start to consolidate all of these different monitoring tools that are out there.

16:22
Chris T.
So AIOps, you touch on that a bit in your key takeaways. You call this area a new opportunity as vendors build these unified platforms, integrate gen AI into tech stacks, and become fully integrated into the workflow orchestration process. Do you mind, first and foremost, breaking down what AIOps is? And then from there, I figure we can walk through this this new “opportunity,” a bit.

16:48
Jake R.
Yeah, of course. So AIOps, at its core, is when you use artificial intelligence and machine learning to automate the IT operations process. So that's what it does here. And this term has been around for six or seven years at this point. But the reality is, AIOps has actually been more of a buzz word than a reality. When I look at this ecosystem here, I think a lot of the vendors have done a good job with causal AI, so thinking, hey, what caused this IT incident? What caused this issue with my software application? So really mining the data to find the root cause.

What I also think they've done well is predictive AI. So thinking how do I analyze a lot of these historical events and actions to predict future events, to predict future outages or future issues? But the big missing piece has been really the execution of actually fixing the IT Incidents. It's not just enough to provide the insight, companies want you to resolve the issues.

So now that observability vendors and AIOps vendors have started to break down those, those silos between log management, between application performance monitoring, between infrastructure monitoring, they have all of the data on their platform. And then when we think about the next step of adding generative AI into the workflow so that you can actually act more intelligently on this telemetry, we believe that a lot of these vendors aren't just addressing causal AI, they're not just addressing predictive AI, they're actually starting to get into the execution phase. And to us, that's the ultimate opportunity because when you start being able to understand what caused an outage on being able to predict the issue before it occurs and then actually being able to solve the issue autonomously, that's when that that mean time to resolution goes from three hours to five minutes. And that's a really big revenue opportunity for a lot of these platforms to target.

18:51
Chris T.
I can see that. So we only have a little bit of time left. I'm thinking it might make the most sense to quickly run through some of the other trends you layout in the report at a high level. This includes the point that there is still a large legacy base up for grabs in the observability market. And then the adoption of DevSecOps processes is what you say is creating new budget dollars for observability vendors to target. What would you say are the most important takeaways for each?

19:16
Jake R.
Yeah, I would say this was the biggest surprise to me when I was putting together this report is just how big of a legacy pie or legacy market share that is still out there for a lot of these platforms to target. My estimates point to close to $10 billion of revenue still tied up in these on-premise, more legacy monitoring and observability tools.

And I think that goes back to the earlier comment we talked about where 18% of IT spend is in the cloud. So even though 50% of workloads are in the cloud, 18% of IT spend is. And what that means is a lot of the more mission-critical apps are still on-premises and with that, if it's not broke, you don't really fix it.

And so as long as these applications remain on premise, they have continued to use these more legacy monitoring tools. But as those applications and infrastructure moved to the cloud, we think that's an incredible opportunity because, A, that's $10 billion of revenue, but then B, the prices that you're going to pay a cloud vendor versus an on premises vendor are going to be a lot more, which creates an even bigger revenue opportunity for these platforms to target.

And then when I think about DevSecOps, that's really the next frontier. Security has become so important in the modern IT operations process. So everyone is trying to shift left where security can't just be introduced when the product is launched. Security needs to be fully integrated into both the development and the operation of the application.

When I think about this market, DevSecOps and cloud security, this is this is going to be a market where a lot of the security and observability vendors are looking to target and converge on. So, I think it’s still pretty early here. I would say even much, much earlier than the shift to the cloud. We are probably even just in the start of the first inning for this DevSecOps opportunity and who actually wins this market is still to be determined. But just given the massive amounts of budget dollars that are being poured into solving this issue, I think this is a really large opportunity for these observability and security vendors to target as we move forward over the next few years. And so, I think those are some of the other interesting trends that we would be watching out for.

21:40
Chris T.
All right. Well, Jake, appreciate your time. It's been great having you here. Let's do this again soon.