The Member Signal is DoGood’s weekly peer-intelligence briefing for the member network. This issue went to members on July 29, 2026, and appears here lightly edited for the web.
The Signal
Sixty-three member companies submitted a priority in the last 30 days. Twenty-one of them named something they are moving off.
Not evaluating. Not benchmarking. Moving off. Between them they named twelve specific incumbent products, and the list does not cluster in one category: security awareness training, MDR, threat intelligence, vulnerability management, SIEM, ITSM, remote access, contact center, ERP, and infrastructure licensing. One in three of the companies that spoke up this month has an incumbent on the way out.
Only one product was named by three separate companies. Everything else was named once or twice. That shape matters more than the names do. This is not a market where one vendor is losing a bake-off. It is a network of buyers independently arriving at the same verdict about different parts of their stack in the same 30 days.
The Network’s Vendor Watchlist
Twenty-eight distinct vendors were named across the month. The most-named appeared in submissions from three member companies:
KnowBe4 (3) · Conceal (3) · Red Canary (2) · ServiceNow (2) · Oracle (2) · IBM (2) · Fable Security (2)
Plus a tail of twenty-one vendors named once each.
The fragmentation is the finding. No vendor cleared five mentions, which means there is no consensus shortlist forming anywhere in the network right now. If you are in an evaluation and wondering who else is looking at your finalist, the honest answer this month is: probably nobody you know. You are on your own for references, and the peer signal you want has to be asked for directly rather than inferred from a crowd.
From the Network
“The vendor’s browser-native approach may align with our 6-month initiative to replace AnyConnect VPN with a Zero Trust architecture. We want to restrict user access to specific applications instead of entire subnets without VDI overhead.”
IT Director, Software
“With everything related to IBM and the expenses, I’m trying to figure out ways to reduce the footprint and reliance. I’m really thinking about what the strategy is for licensing going forward for the next 3 to 5 years.”
Director, Information Technology, Hospitals & Clinics
“Looking to replace KnowBe4, revisiting our security stack”
Principal & Chief Information Officer, Business Services
Three different time horizons: six months, three to five years, and right now. The third one is the pattern worth noticing. One displacement decision opened a review of the whole stack.
Top Open Priorities This Week
“We are looking for a replacement of our current ITSM solution which we rely on service now to handle”
Senior Director, IT Infrastructure & Security, Nonprofit
“We have an MSSP in place and are looking to make a change in vendors”
Director of IT Operations, Consumer Products
Both of these are open right now, and neither member has named a replacement yet. If you have run either of these swaps in the last two years, your scar tissue is worth more to them than any vendor deck.
Deep Dive: IT Operations & Automation
Sixty-six member submissions over the last 90 days touched IT operations, from 40 different companies, and the dominant pattern is blunt: senior IT leaders are trying to buy their way out of manual work.
Where activity is concentrated
- Eliminating manual work — 41 of the 66 submissions, 23 companies. The largest cluster by a wide margin. A healthcare CIO submitted the same sentence five separate times in one week against five different vendors: everything is manual, what else is out there.
- Knowing what you actually run — 16 submissions, 15 companies. Observability, dependency mapping, asset visibility. A law firm running 350 VMs across 11 sites has up-down monitoring and no idea what traffic to its cloud apps looks like. A government technology director wants to map server dependencies. A software IT director wants agentless real-time mapping to “eliminate scream tests.”
- Replacing ITSM — fewer than ten instances. Small but loud. Two members are actively looking to move off ServiceNow, and one described hiring a developer just to keep the platform running while still spending more time managing tickets than solving problems.
What your peers are buying
Four vendors have real traction in this category across the network in 90 days, and the spread tells you what members are prioritizing.
- Datadog — six member companies. A pharmaceuticals infrastructure director committed over $100K on a 1-to-3 month timeline as primary decision maker. A library-sector ITIO director committed over $100K to move observability from open source to enterprise grade.
- Faddom — six, all dependency mapping. Two are committed projects: a software IT director and a healthcare IT director, both mapping hybrid estates inherited partly through M&A.
- Tines — five, workflow automation. A university IT director committed $25K to $100K on a 3-to-6 month timeline to automate legacy departmental processes, explicitly because staff are retiring without backfill.
- SysAid — five, four of them ITSM evaluations from members currently unhappy with what they have.
The pattern in the money: members are funding visibility first and automation second. The largest committed budgets went to seeing the estate, not to acting on it.
What’s still open
Two capability areas have clear demand and nothing good to buy. The first is governance for the agents doing operational work. Five companies described deploying agents into IT and security operations and needing to control what those agents can touch. A government deputy CISO wants orchestration where agents “can ONLY act within their given roles.” A software IT director is watching identity and compute costs climb for background agents doing network automation. They are all buying general-purpose workflow tools and hoping to bolt governance on, because nothing purpose-built showed up.
The second is prevention rather than detection. Eight submissions asked for predictive or proactive operations. Every dollar that actually moved went to tools that shorten the time to notice a problem. Nobody in the network has bought something that stops the problem.
What it means for your stack
Fund the map before the automation. Every committed dependency-mapping and observability deal above came from someone who had already tried to automate a system they could not fully describe. If you have an automation project scheduled for this half and no current dependency map of what it touches, move the mapping work in front of it and let the automation slip a quarter.
The Context
On July 20, The Register covered Gartner’s 2026 Hype Cycle for AI in IT Operations, and the headline finding runs against the sales pitch: AI operations tools will produce console sprawl, not consolidation, for at least the next several years. More layers, more control points, more specialized tooling. Gartner also projects that by 2028, 40% of infrastructure and operations organizations running agentic AIOps at scale in production will hit a business-critical service disruption, up from under 1% today, even as adoption climbs to 60% of enterprises by 2029 from under 10% now.
The headlines are catching up to what the network already knew. The members spending the largest committed budgets in this category are not buying autonomy. They are buying maps, inventories and dependency graphs, and the one member who is buying orchestration insisted up front that the agents be constrained to defined roles.
Bottom Line: Gartner frames the 40% disruption rate as a risk of moving too fast. The network’s buying pattern suggests it is better read as a prerequisite problem: the organizations that break are the ones automating an estate they never mapped, and the fix is a purchase order, not a slower timeline.
What to Do About It
Pull your renewal calendar for the next two quarters and mark every contract you would not re-sign today. For each one you mark, write down what you would need to know about your own environment before you could credibly run the swap, then start that discovery this week rather than at renewal. Twenty-one of your peers are already in that position, and the ones moving fastest are the ones who did the mapping before the contract came up.