Rebuilding the Plumbing, Not the Paint

Every enterprise software vendor wants to tell you about its AI strategy. Almost all of them sound the same: bolt a chatbot onto the dashboard, wrap it in a press release, charge extra.

ManageEngine, the enterprise IT arm of Indian software giant Zoho Corporation, is doing something less common — actually rebuilding the plumbing, not just the paint job. And that story, told during a media roundtable in Jakarta, is worth diving into.

From ticketing software to AI vendor

To see the reinvention, you first need the baseline. ManageEngine was founded in 2002 as an IT service management shop — the software equivalent of grout: essential, unglamorous, and never Instagrammed. For most of its 24 years, that's what it was known for: ticketing systems, patch management, and network monitoring. It’s solid infrastructure tooling, not a security or AI brand.

It’s also an identity that doesn't fit the market it's now selling into. Every one of its customers is being asked to defend cloud, on-premises, and edge environments simultaneously, with AI agents from a dozen vendors reading and writing to the same systems. So ManageEngine spent a single quarter rebuilding four of its core products almost from scratch.

The company’s SIEM and log-management platform, Log 360, gained native Security Orchestration, Automation and Response — SOAR built into the platform's core rather than stitched on through a third-party integration. Its network observability platform, OpManager Nexus, added native support for gNMI and OpenConfig streaming telemetry, a bet on vendor-neutral infrastructure over a walled garden. Its endpoint suite, Endpoint Central, added EDR and secure private access, quietly retiring the idea that a VPN login is still the right way into the corporate network. And in May, the company rolled out Zia Agents, its agentic AI layer, across the entire product line, providing customers the ability to build autonomous agents that do what a human administrator used to do by hand.

Four product categories, rebuilt within a quarter, by a company that spent two decades being the reliable one nobody talked about at parties. That's reinvention with a paper trail, not a slide deck.

It's also, chief executive officer Rajesh Ganesan insists, deliberately incomplete. “We have been doing AI for 13 years using machine learning and deep learning, and we know that not every problem requires a frontier model or even AI at all,” he said at the sidelines of the media roundtable. “We make that call on behalf of our customers, deploying AI only where it is truly effective.”

Pressed on whether banks moving toward smaller, specialized models opened a business opportunity, Ganesan didn't hedge: “We could choose to focus purely on building and selling language models, but businesses do not buy LLMs off the shelf; they buy solutions to their business problems.” ManageEngine is also a company built for markets that don't get a blank check for technology spending — Southeast Asia, Africa, Latin America and India are its home turf, and paying by the token, in that context, is a luxury.

That same discipline shapes how the company talks about its own limits. Some vendors now pair frontier models with expensive consulting engagements to manage the complexity of deploying AI safely — Ganesan pointed to Microsoft and Palantir as examples — and ManageEngine has simply opted out of that business entirely. “We have no interest or bandwidth to play a consulting role,” he said. “We are a product company; we focus on building the products, not on consulting.”

Trust, not just capability

The two-layer AI strategy — Ask Zia for natural-language queries and Zia Agents for autonomous execution — puts ManageEngine in the same uncomfortable spot as every other vendor selling agentic AI: asking a CISO to trust software to act on its own. Flag a security incident, and an agent can trigger remediation across endpoint, observability and service-management tools with no ticket, analyst or pause for approval. That's either the future of SecOps or the plot of a very bad Tuesday, depending on how much you trust the model.

Ganesan doesn't oversell the trade-off. Asked how the company builds confidence around AI making its own calls, he skipped the perfection pitch. “It is impossible to give a 100% commitment that any technology system will always be right,” he said. “We tell them upfront: the system can make mistakes, there can be errors, and there could be bias.”

What he offers instead is expertise and paperwork, not promises. “We explain to our customers exactly how we build our models, how we train them, and how we use data,” he said, noting that customers can audit ManageEngine's infrastructure under its Master Service Agreement.

On the one question every CDO actually cares about — what happens to the data — he was equally direct: “We give a 100% commitment that we never monetize customer data or share it with third-party systems.” Take that pledge for what it is: a public commitment, not a claim independently audited by a third party.

The harder architectural problem doesn't have a tidy answer yet, and Ganesan says so directly. Pressed on a “swarm” of AI agents from different vendors reading and writing to the same systems, he laid out the open questions rather than a solution: “How do we handle identity and access management for agents? How do we handle auditing, compliance, and observability when multiple agents from different vendors are modifying data?” His candid answer: “We don't have all the answers yet, and we are continuing to build these frameworks. It is a shared journey of learning between us and our customers.”

The trust-building extends to geography, and here the reinvention is physical, not just verbal. With privacy law fragmented across ASEAN, ManageEngine gives customers three choices for where their data physically lives: on-premises, in a regional cloud, or inside a customer's own country. The company opened an office in Malaysia this January and is building out Indonesia, Thailand and Vietnam — the kind of infrastructure a ticketing-software vendor never needed a decade ago, and a sovereignty-first AI vendor can't do without. “We treat security and compliance as a shared responsibility,” Ganesan said.

It shows up again in how ManageEngine sells its unified endpoint platform, which splits into four separate pillars: autonomous management, attack surface management, EDR, and secure remote access. So, a CISO worried about vendor lock-in doesn't have to buy the whole car just to get the tires.

“If a CISO is concerned about putting all their eggs in the ManageEngine basket, they can choose to use us only for autonomous endpoint management and secure remote access, while continuing to use third-party tools like CrowdStrike, SentinelOne, or Qualys for EDR and attack surface management,” Ganesan said. “Our platform is open, modular, and integrates easily with these third-party tools.”

The takeaway for the C-suite

None of this reads like a company chasing headlines. Asked why so many businesses mistake automation for genuine transformation, Ganesan reached for the least Silicon Valley metaphor available: “Checking your weight every day without changing your lifestyle won't make you healthy — it's the wrong metric.” Technology, in his framing, is the last step, not the first. “Start with self-awareness and clarity about what you want your business to transform into, and once you have that, we can walk that journey together.”

That tracks with what Ganesan says he hears from his own customers: AI still ranks third on the average CIO's priority list, behind tool consolidation and basic security hygiene. For CDOs and CISOs sizing up vendors in 2026, that's the useful gauge — and not just for ManageEngine. Any vendor that can't tell you where AI shouldn't be used yet probably hasn't thought hard enough about where it should.

Image credit: iStockphoto/Flashvector