Two very different kinds of AI are turning up in operations. One is fluent. One reasons about cause. Knowing which is which is the difference between insight and a confident wrong answer.
I have watched an AI name a root cause in four seconds flat, be completely wrong, and get believed anyway, because it was written so well. That is the part nobody warns you about. The confident wrong answer does not look wrong. It reads like your best engineer wrote it.
The confident wrong answer does not look wrong. It reads like your best engineer wrote it. |
Someone asked me on the show recently how you work out which deploy actually caused an incident, without reconstructing the whole thing by hand from logs and alert timestamps at 3am. My answer was the one this piece turns on: start from the change, not the symptom, and do not stop at the first correlation. A deploy that landed near the trouble is a suspect. It is not the verdict. That refusal to accept the first thing that lines up is exactly what most AI in operations cannot do for you, and it is the real line between the two technologies everyone is now buying under a single word.
Every AIOps pitch now just says 'AI'. Underneath, two quite different technologies are doing the work, and they are good at opposite things.
Generative AI is the family behind large language models. It has learned the statistical patterns of language, code and images, and it produces the most plausible next thing. In operations it is the incident summary, the natural-language query over your logs, the drafted runbook. Fluent, fast, and genuinely useful for describing and suggesting.
Causal AI is built for a different job: modelling cause and effect. Instead of asking what usually comes next, it asks what made this happen, and what would happen if we changed it. In operations that is root-cause inference, dependency and causal graphs, and counterfactuals like 'if we roll back that deploy, does latency recover'.
The correlation versus causation problem
This is the crux, and it is an old one. Correlation notices that two things happened around the same time. Causation establishes that one made the other happen. Most AIOps tooling, and every large language model, is very good at the first and cannot do the second on its own. Trained on what co-occurs, it will hand you the cache flush because it usually sits near the latency, and never see the database migration quietly holding the locks. I have accepted the first thing that lined up before, more than once, and paid for it in the extra hour it took to admit the obvious suspect was innocent. Separating the change that caused an incident from the ten that merely happened nearby is the whole job, and it is the one thing pure correlation cannot give you.
Same incident, two answers. Generative AI names what co-occurred; causal AI reasons to what caused it. A coincidence is a suspect; a cause is the verdict.
Why it matters
They answer different questions, and using one for the other's job is where teams get hurt.
Generative shortens the distance to the first question. A summary, a likely area, the first thread to pull. Treat it as a fast first draft, not a verdict.
Causal interrogates the 'why'. When you need to separate the change that caused an incident from the ten that merely happened nearby, or test a fix before you ship it, that is causal territory.
Generative is a master of correlation in language. It does not know why anything happened, only what words tend to follow which. Ask it for a root cause and it gives you a confident, well-written one drawn from patterns, not from your system.
The catch
Neither is a free lunch, and the failure modes are opposite.
Generative AI can hallucinate a cause that never existed, in perfect prose. When it is wrong, it is wrong fluently, which is the dangerous kind.
Causal AI is only as good as the system model and data behind it. A bad model gives you precise nonsense.
Neither removes the need for a human to interrogate the answer. They shorten the first step; they do not own the conclusion.
The hybrid reality
In practice you do not choose one. The more mature platforms now run several kinds of AI in one engine: causal for precision root cause, predictive for capacity and anomaly forecasting, and generative for the natural-language explanation and the suggested next step. That is the sensible shape, generative to get you to the first question fast, causal to answer it honestly, as long as you know which layer is doing what and how far to trust each.
The real test
Here is the test I keep coming back to, and I said a version of it on the show when someone asked whether AI is actually improving operations or just adding noise. It is one driver among several. Not a revolution, not a fraud. It helps when it shortens the distance to the first question: the summary, the likely area, the first thread to pull. It hurts the moment you let it be the last question as well as the first. Let it retire your first question if you like. Never let it retire the first one. Generative gets you moving; the danger is trusting it to be the verdict too. That is the job causal AI, and a human who still asks why, are there to do.
It hurts the moment you let it be the last question as well as the first. |
Generative AI gives you the fast first draft. Causal AI gives you the answer you can act on. The one thing neither gives you is someone to own what you do next. The moment anything acts on the AI's answer, someone owns the outcome, which is the whole question in When The Agent Acts, Who Owns The Decision?
|
Get the next one One signal a week. No noise. | |
|
If this was useful, Metrics & Mayhem sends one short, practical piece like it to IT operations leaders most weeks. No fluff, no vendor noise.
Prefer to start with the book? Read a free chapter. |