Techaisle Analyst Insights

Worldwide IT spending by firms with 1 to 4,999 employees will reach US$1.667 trillion in 2026, excluding communication services, and the majority of it will go to IT services rather than to technology products. A market of that size, spread across every economy and every industry, sets the direction for commercial IT rather than following it. These firms are now spending more on the implementation, integration, management, and security of technology than on the technology itself, and the margin between the two is wide and widening.

That composition is the product of two forces working against each other. AI is pulling money up and forward, into software, infrastructure, and services that were not in the budget a year ago. Cost is pulling the other way, as component inflation, tighter budgets, and a higher cost of capital are pushing firms to defer what they can and to rent what they cannot. That second force is the quieter one, and it explains the tilt toward services better than any capability argument does. Buying an outcome instead of an asset moves cost from the balance sheet to the income statement, and it moves operational risk from the firm to the provider. In a year of expensive capital and unforgiving threats, that trade is worth paying for, which is why the money is moving toward services even where the technology itself is cheap.

Within services, the mix has shifted. Maintenance, support, and break-fix, the labor of keeping systems alive, once defined the SMB services market. The money is now concentrating in consulting, integration, and putting AI into production. Transformation work has overtaken recurring management, and it is not close.

On Monday morning, 1^st June, 2026, a total of 1,500 customers had self-onboarded onto Cisco IQ. By evening, it was 1,600. Tuesday morning, 1,700. By the time I left Cisco Live 2026 in Las Vegas, Tuesday evening, I was told the number had crossed 2,000.

But I am getting ahead of myself.

The Constraint Cisco IQ Removes

Enterprise support has been a reactive business for twenty years, and not for lack of ambition. It was reactive because it was blind. Between audits, no vendor had an accurate, up-to-date picture of what a customer was running, which devices were exposed, and which had drifted out of compliance. Support waited for the failure and billed to fix it. That blindness, not the absence of AI, is the constraint that defined the category.

Cisco IQ removes the constraint. At its simplest, it is an intelligence layer that sits over a customer’s entire Cisco estate. Strip away the module names, and what it does is make that estate continuously legible. It fuses asset telemetry pulled from the live network, contract and entitlement records, and two decades of support history into a single, always-current model of what the customer runs, and it reasons over that model without waiting to be asked. The AI is the visible part, but it sits atop the harder thing: a reconciled, constantly updated model of the estate. That model is what competitors cannot easily reproduce, because it is built from years of data rather than shipped as a feature.

Cisco Owns the Control Plane of the Agentic Era. Nobody knows it yet.

The market is currently operating under the assumption that the architectural gravity of AI belongs entirely to the orchestration layer of the hyperscalers or the workflow engines of SaaS giants. But those software surfaces only control logic within their own proprietary walls or virtual boundaries. When an autonomous agent goes rogue, encounters a looping cost explosion, or faces a machine-speed exploit, that liability manifests in the physical world as a network routing challenge, a telemetry event, and a data-fabric security crisis.

By building the infrastructure that unifies visibility and enforcement from the silicon to agent-action trust, Cisco has quietly captured the layer that governs how autonomous workloads actually execute.

Cisco did not join the AI conversation. It redefined it.

For 2 years, enterprises have funded the AI buildout as a capacity race, measured in GPUs, power, and capex, on the assumption that compute is the scarce input. It is not. Compute that cannot be connected, secured, and operated at scale is stranded capital, and most AI infrastructure budgets have underfunded the layer that decides whether the GPU spend ever produces a business outcome. Cisco used Cisco Live 2026 to name that gap and claim it. Capacity commoditizes. Control compounds. The contest that decides the next decade of enterprise infrastructure is the contest for the control plane of agentic AI, from programmable silicon to agent-action trust, and Cisco is the only company holding the full stack.

That reorders the buying decision. If control, rather than capacity, is where durable value accrues, the criteria most businesses use to select AI infrastructure are wrong-footed, because the vendor best positioned is not the one selling the most compute but the one that governs how compute is connected and trusted. Cisco just claimed that position, and every announcement at the event is a move to occupy it.

The swarm breaks the assumptions networks were built on

The Sub-OS Threat Landscape: Expanding the Perimeter

For the better part of the last decade, enterprise security operations centers (SOCs) have monitored, modeled, and mitigated hardware and firmware-level vulnerabilities. Yet for SMBs and midmarket organizations, this subterranean threat vector remains a massive blind spot. Most of these businesses allocate their cybersecurity budgets heavily toward operating system-level defenses - Endpoint Detection and Response (EDR), Next-Generation Antivirus (NGAV), and perimeter firewalls. Their entire security model inherently assumes the operating system is the foundational, immutable layer of their security posture.

This assumption is structurally flawed. Advanced threat actors are actively bypassing crowded OS-level defenses by dropping lower into the technology stack. Techniques like BIOS tampering, supply chain interdiction, and the deployment of persistent firmware rootkits - designed specifically to survive complete OS wipes and hard drive replacements - are proliferating rapidly. These are no longer bespoke, nation-state-only techniques. The malicious toolkits have been commoditized on the dark web, shifting the economics of cybercrime. Today, a 200-person regional manufacturing company or a mid-sized healthcare clinic is a highly viable target for the exact same class of sophisticated sub-OS attack once reserved for defense contractors.

For SMBs and mid-market enterprises, the calculus around endpoint security has shifted from standard technology procurement to a critical risk management challenge. SMBs are confronting existential threats from commoditized sub-OS attack kits that easily bypass legacy OS-level defenses, yet they operate without the financial shock absorbers or dedicated security headcount to survive a resulting breach. Conversely, mid-market organizations are caught in a severe compliance squeeze. As they integrate into larger enterprise supply chains or federal defense networks, they are held to stringent, auditable standards that their lean IT teams are ill-equipped to manage natively. This dual pressure creates a hard reality: these organizations cannot secure what they cannot cryptographically verify, but they also cannot operationalize that verification without external managed services. Sub-OS telemetry is no longer just a feature upgrade for these segments; it is a structural necessity that relies entirely on the channel ecosystem to deploy, monitor, and effectively manage.

Dell’s endpoint security roadmap, formalized as Dell Trusted Workspace, is a direct architectural response to this shift. The strategy is methodically organized around three intersecting layers: security “built with” the device (focusing on supply chain and component verification), “built in” to the native hardware (delivering firmware, identity, and BIOS protections), and “built on” through deep software integrations with third-party security vendors. The underlying technology in this stack represents a significant architectural shift, but the strategic imperative - and the core focus of this assessment - lies in how SMBs with zero dedicated security staff, lean midmarket IT teams, and the channel partners that serve them can actually operationalize these complex capabilities.