Enterprise Software Watch: AI Control Planes, Agentic Security, and the SaaS Shift

The CODEW Enterprise Software Watch | September 7, 2026

AI Control Planes, Agentic Security, and the SaaS Shift

The CODEW Enterprise Software Watch cover

Executive Brief

The Shift From SaaS to AI-Native Control Planes

The biggest signal this week: AI-native infrastructure and governance layers are becoming the new battleground, as vendors race to control how agents access core systems, spend tokens, and execute transactions.

ServiceNow acquired Israeli AI startup Sweep for ~$400M to deepen CRM/workflow metadata indexing. Palantir and PwC launched an AI-native deals IT platform promising 50% faster M&A execution. CrowdStrike unveiled Falcon Guardian and an Agentic Identity Provider to secure AI agents. Boomi shipped an Agent Control Plane to govern agent access to SAP/Oracle/Salesforce/Workday and curb runaway AI costs. Underneath the headlines: the market is shifting from "AI features in SaaS" to AI-native control planes that sit above applications and govern agents, identity, spend, and risk.

Enterprise Software at a Glance

Top Developments

ServiceNow acquired Israeli AI startup Sweep for ~$400M to deepen CRM/workflow metadata indexing and agentic automation.
Palantir + PwC launched an AI-native deals IT platform promising 50% faster M&A execution and 45% lower one-time transaction costs.
CrowdStrike unveiled Falcon Guardian and an Agentic Identity Provider to secure AI agents at the endpoint and across cloud/SaaS.
Boomi shipped an Agent Control Plane to govern agent access to SAP/Oracle/Salesforce/Workday and curb runaway AI costs.
Workday authorized a $4B buyback amid reported Silver Lake takeover interest, signaling management's "stay independent" stance.
empirik.ai emerged from stealth with $21M to build an AI agent for infrastructure change management.
n8n hit a $5.2B valuation with deeper SAP Joule Studio integration and native AI agent nodes.

Platform Watch

ServiceNow: Buying the "Metadata Layer" for Agentic Workflows

ServiceNow's ~$400M acquisition of Sweep targets continuous indexing of Salesforce metadata so that downstream workflows can react in near real time to CRM schema and configuration changes.

Why it matters:

Agentic workflows break when underlying data models drift. Sweep's indexing reduces "silent failures" in automations tied to Salesforce objects/fields.
This complements ServiceNow's recent Israeli M&A (Pyramid Analytics, Traceloop, ai. work, Armis) to build an end-to-end agentic operations stack.
For buyers: expect tighter Now Platform + Salesforce + AI agent patterns, especially for IT, customer service, and finance workflows.

Workday: $4B Buyback vs. Takeover Pressure

Workday's open-ended $4B repurchase and packed investor calendar read as a defensive move against rumored Silver Lake interest.

Strategic takeaway:

Management is betting that AI-driven HCM/finance suites (plus new customer wins in government) can re-rate the stock without a sale.
For CIOs: near-term product roadmap likely stays focused on AI assistants, skills ontologies, and finance automation rather than radical platform shifts.

Palantir + PwC: AI-Native M&A as a Wedge Into ERP Modernization

The joint AI-native deals IT platform (Palantir Foundry + AIP + PwC services) targets:

50% faster deal execution (integrations, separations, carve-outs)
45% lower one-time transaction costs
Reduced ERP data risk in SAP transformations

Why buyers should care:

M&A is a high-visibility, high-pain use case where AI can show hard dollar ROI quickly.
Success here creates a wedge to modernize ERP, supply chain, and planning on Palantir post-deal.
For investors: this is a template for services + platform co-selling that could scale beyond M&A.

AI & Agentic Software

From "AI Features" to "AI Control Planes"

Three launches this week define the emerging category:

Boomi Agent Control Plane: vendor-neutral layer between agents and core systems (SAP, Oracle, Salesforce, Workday) with identity, rate limits, token caps, and human approval for high-risk actions.
CrowdStrike Falcon Guardian + Agentic IdP: discovers shadow AI agents, issues cryptographically verifiable agent identities, and enforces runtime policies across endpoints, cloud, SaaS, and browsers.
Walnut's enterprise-grade agent platform: adds governance controls before autonomy, with AI Mode for demos/playlists and "Walnut Xpert" buyer-facing agent.

Structural shift:

Enterprises no longer ask "Which AI feature?" but "Who controls the agents, their identities, and their spend?"
Vendors that position as neutral control infrastructure (Boomi, CrowdStrike, cloud providers) gain leverage over application-layer vendors.

Agentic Coding Fuels Build-vs-Buy Reversal

McKinsey's State of AI 2026 reports 32% of organizations now prefer building custom solutions with agentic coding tools instead of buying off-the-shelf software—especially among "high performers."

Implications:

Traditional SaaS categories face disaggregation as teams assemble agent-powered stacks.
Vendors must offer extensibility, governance, and integration or risk becoming data sources rather than workflow owners.

Cloud & Infrastructure Software

AI Infrastructure Spend Surges; SaaS Partners Grow Wary

A 2026 partner survey shows:

Networking growth sentiment up +20.7% vs. 1H 2026; 57.1% of partners see it as a major growth driver.
Infrastructure software (backup, virtualization, orchestration) remains a top growth engine at 56.5%.
AI execution bottlenecks are shifting budgets from legacy SaaS toward hardware, custom dev, and immediate operational priorities.

What this means:

CIOs are prioritizing AI-ready infrastructure (network, GPUs, orchestration) over incremental SaaS modules.
For investors: infrastructure and services layers may outgrow pure-play SaaS in the near term.

NVIDIA + MediaTek: Custom XPUs and Rack-Scale AI Factories

NVIDIA and MediaTek deepened collaboration to:

Use NVLink Fusion for hyperscalers and cloud providers to build custom XPUs integrated into NVIDIA rack-scale AI systems.
Enable "AI factories" with prevalidated paths for frontier model developers.

Strategic takeaway:

Cloud providers and large enterprises will increasingly co-design silicon + rack architecture rather than consume generic instances.
This accelerates the shift from "cloud regions" to AI zones with dedicated power, networking, and governance.

AWS Saudi AI Zone and Bedrock Observability

AWS announced:

A Saudi Arabia cloud region (Dec 2026) with >$5.3B investment and a partnership with HUMAIN to deliver 50 MW of AI compute by 2028.
An observable agentic retrieval stack on Bedrock with seven layers of observability and continuous evaluation.

For buyers:

Expect more sovereign AI zones tied to local partners and LLMs.
AWS is pushing governed, observable agent patterns as reference architectures for enterprises.

Enterprise Security

CrowdStrike: Securing the Agentic Enterprise

At Fal.Con 2026, CrowdStrike introduced:

Falcon Guardian: AI Detection & Response for agents at the endpoint and across cloud/SaaS, with agent discovery, access controls, and runtime enforcement.
Agentic Identity Provider (IdP): automatic registration of agents with cryptographically verifiable identities, making Falcon the identity control plane for agents.
Expanded Falcon Guardian via Google Agent Gateway to protect enterprise AI apps on Google Cloud from prompt injection, data leakage, and malicious agent activity.

Why it matters:

Security is moving from "protect users" to "protect agents and their identities."
CrowdStrike is positioning Falcon as the universal agent security + identity layer, not just an EDR tool.

Visa, Fortinet, Anaconda: AI Security M&A Heats Up

Recent cybersecurity M&A includes:

Visa acquiring BioCatch for $2.4B (fraud/behavioral biometrics).
Fortinet buying Virtue AI to strengthen AI security.
Anaconda acquiring Enkrypt AI for AI security and compliance.

Signal:

AI risk is now a core M&A theme, with buyers paying premiums for AI-native security capabilities.

Data & Analytics

Observability Consolidates Around OpenTelemetry and Managed Clouds

Key moves:

Dabble migrated from self-hosted Grafana to Grafana Cloud to cut incident response times and control observability costs as it scales.
OpenObserve reached v1.0 RC (Sept 3, 2026), offering logs/metrics/traces/session replay in a single Rust binary with a generous free tier.
Middleware is positioned as an OpenTelemetry-native observability backend competing with Datadog, Grafana, New Relic, and Honeycomb.

Buyer guidance:

Teams are choosing between managed depth (Datadog, New Relic), open-source flexibility (Grafana, SigNoz, OpenObserve), or OTel purity.
For AI-heavy stacks, LLM observability and agent telemetry are becoming must-have features.

AI Observability Becomes a First-Class Requirement

AWS's observable agentic retrieval stack on Bedrock and tools like OpenObserve and LangGraph/Langfuse patterns show that:

Observability now covers agents, prompts, retrievals, and evaluations, not just infra/app metrics.
Enterprises will demand continuous evaluation and drift detection for AI workflows in production.

M&A & Competitive Moves

Deal / Move	Parties	Value	Strategic Rationale
Sweep acquisition	ServiceNow → Sweep	~$400M	Index Salesforce metadata for agentic workflows
BioCatch acquisition	Visa → BioCatch	$2.4B	AI fraud detection for payments
Virtue AI acquisition	Fortinet → Virtue AI	Undisclosed	Strengthen AI security portfolio
Enkrypt AI acquisition	Anaconda → Enkrypt AI	Undisclosed	AI security and compliance
Strategic alliance	Palantir + PwC	N/A	AI-native deals platform; ERP modernization
Takeover defense	Workday (vs. Silver Lake)	$4B buyback	Signal independence; fund AI roadmap
Stealth exit + funding	empirik.ai	$21M	AI agent for infrastructure change management

Pattern:

AI security and agentic workflow infrastructure are the hottest M&A themes.
Large platforms (ServiceNow, Palantir, CrowdStrike) are buying or allying to own the control plane for agents, identity, and data.

Buyer Watch

What Enterprises Are Prioritizing Now

AI infrastructure and networking over incremental SaaS modules.
Governed agent platforms with identity, access controls, and cost management.
Observable AI stacks with built-in evaluation, drift detection, and LLM telemetry.
Custom-built solutions using agentic coding tools instead of generic SaaS, especially for differentiated workflows.

Build-vs-Buy: The New Calculus

Build when workflow is core to competitive advantage, agentic coding tools can deliver 80%+ capability quickly, or tight integration with internal data/ERP/CRM is required.
Buy when process is standardized (e.g., core HR, finance compliance) or vendor offers a governed agent layer with strong ecosystem and security posture.

Practical advice for CIOs:
• Treat agent governance, identity, and observability as platform requirements, not nice-to-haves.
• Favor vendors that expose open telemetry (OTel) and integrate with your chosen control planes.
• Re-evaluate long-term SaaS contracts where 32% of similar orgs are now building with agents.

Strategic Takeaway

The structural shift is clear: enterprise software is re-architecting around AI-native control planes, not just AI-enhanced applications.

Control planes (Boomi Agent Control Plane, CrowdStrike Agentic IdP, cloud provider governance stacks) are becoming the new operating system for the enterprise.
Traditional SaaS risks disintermediation unless it integrates deeply with these layers or becomes a data source within agent workflows.
M&A and partnerships (ServiceNow/Sweep, Palantir/PwC, Visa/BioCatch) are consolidating power around vendors that can govern, secure, and monetize agentic work.

For CIOs and investors: the question is no longer "Which SaaS suite?" but "Who controls the agents, their identities, and their access to my core systems?"

What to Watch Next Week

ServiceNow integration details for Sweep: how metadata indexing translates into agentic workflow reliability.
CrowdStrike Falcon Guardian GA timeline and early customer patterns for agent inventory and identity enforcement.
Boomi Agent Control Plane adoption in regulated industries (financial services, healthcare) and its impact on AI spend.
Palantir + PwC first public M&A transformation case studies and ERP modernization wins.
Workday's analyst day (Oct 13) for AI roadmap clarity and response to takeover speculation.
Additional AI security M&A as large platforms and payment networks hunt for agent-risk capabilities.

The CODEW Stat

McKinsey's State of AI 2026 reports that 32% of organizations now prefer building custom solutions with agentic coding tools instead of buying off-the-shelf software—a fundamental reversal of the SaaS-era "buy over build" consensus.

The CODEW