As organisations scale across SaaS, public cloud and AI, ITAM teams are being asked to do more than track assets: They’re expected to restore visibility, prove value and govern environments that are growing faster than policy can keep up.

Based on a global survey of 512 professionals, Flexera’s 2026 State of ITAM Report shows clear progress. But complexity continues to outpace control.

Flexera’s newly-released 2026 State of ITAM Report reveals a growing disconnect: Organisations are investing heavily in AI tools, yet many lack the visibility and governance needed to manage them effectively. This tension creates a new challenge, and IT leaders are asking themselves:

How do we govern AI usage without slowing innovation and limiting ROI?

Below, is a breakdown of the key AI-specific findings shaping enterprise ITAM strategies today.

After 5+ years of Flexera’s State of ITAM report, one thing’s clear: there’s no shortage of daily challenges faced by ITAM teams. Business units now buy applications directly. Teams experiment with unsanctioned AI tools. Free trials turn into paid subscriptions. All while overlapping apps stack up across departments. All of this rolls up under SaaS sprawl.

SaaS sprawl isn’t about having too many tools. It’s about losing control over:

Software audits aren’t new; nearly half (48%) of the organisations surveyed in Flexera’s 2026 State of ITAM Report said they had been audited in the last year. But they are becoming more frequent, more complex and more expensive. They’ve become a constant reality for IT leaders who are constantly asking themselves:

How do I reduce software audit risk while maintaining control across SaaS, cloud and AI?

The answer sits with governance, visibility and proactive ITAM practices.

Microsoft has quietly extended its free Windows 10 Extended Security Updates (ESU) program for consumers by an additional year, allowing enrolled devices to continue receiving security updates until October 12, 2027.

The change was made without a formal announcement and instead appeared in updates to Microsoft’s Windows 10 ESU documentation and as an “Editor’s note” to a Windows Experience Blog post.

“Editor’s note – June 25, 2026 – This post has been updated to reflect that the Windows 10 Extended Security Updates (ESU) program for personal use devices is being provided for an additional year, with coverage now available through Oct. 12, 2027,” reads the updated blog post.

“This extension provides customers with more time to transition to a new Windows 11 PC while continuing to receive critical security updates.”

On October 14, 2025, Windows 10 reached the end of support, and Microsoft no longer provides technical support, feature updates, or security updates for the operating system unless you are running a Windows LTSC version.

For those who are unable to upgrade to Windows 11, Microsoft originally offered consumers an extra year of security updates if they enrolled in a free extended security updates (ESUs) program that would expire on October 12, 2026.

Enterprise customers could also enrol in the ESU program for up to three years, bringing the total cost per device to $427 over that period.

With today’s quiet update, Microsoft has now extended the free consumer ESU program to October 12, 2027, giving users an additional year to upgrade to a newer operating system.

When asked why the free ESU program was extended, Microsoft shared the following statement:

“We understand that moving to a new PC can take time. As part of our ongoing commitment to helping customers stay secure during the transition, the Windows 10 Extended Security Updates (ESU) program for personal devices is being provided for an additional year,” explained Microsoft.

“Coverage will now be available through October 12, 2027. This gives customers more time and flexibility to find the best PC for their needs while keeping them protected.”

Consumers can continue to receive extended security for free using one of these methods:

Gartner has slammed AI vendors’ lack of transparency, saying developers are facing sharply increased costs from coding agents.

Since the main AI coding agent vendors have shifted from seat-based licensing to consumption-based pricing, developer teams now face highly variable cost structures.

Developer teams face an emerging problem of escalating costs, said Nitish Tyagi, senior principal analyst at Gartner. AI coding bills were leaping from $20 or $100 to $2,000 to $5,000 per developer per month, while in extreme cases, the bill might hit $20,000 in token charges.

However, software engineering departments get little insight into how token consumption is calculated and billed, making it difficult for them to forecast and control costs accurately. AI coding vendors have not yet delivered built-in features to allow developers to optimise costs in AI coding agents, resulting in cost escalation, Gartner said.

“None of the vendors have incredible features when it comes to cost optimisation,” said Tyagi. Instead, he said vendors were focusing on the concept of “tokenmaxxing” to “boost the high” of token consumption, suggesting that if

developers increase the number of tokens, they will increase productivity gains.

“There is no direct relation between the increase in token consumption and an increase in productivity gains,” he said.

Gartner recommends developer teams optimise token consumption and adopt strategies such as context engineering practices, where software engineers improve the input context provided to AI systems. Another recommended strategy is model routing, where engineering and platform teams direct simpler, high-frequency tasks to smaller models, using frontier models only for complex, high-value work

“All of these things will improve the output quality, and, therefore, will increase the productivity gains as well, so while there is no direct relation between tokenmaxxing and productivity gains, there is a relation between optimisation of token consumption with the output quality,” Tyagi said.

As a result of the lack of cost optimisation tools among vendors and consumption-reduction strategies among users, AI development is in a situation where a developer’s coding agents may cost more than they earn, at least in some parts of the world. Gartner predicts that by 2028, AI coding costs will overtake the average developer’s salary due to rising LLM token consumption and the shift to consumption-based licensing models.

“We’re not saying AI token cost will be higher than every developer’s salary on the planet, because US salaries tend to be higher than in India, for example. But current token costs are already more than most of the salaries in India,” he said.

However, the cost of coding agents does not vary according to where they are consumed, meaning AI coding costs for a developer in India may be equivalent to the salary of an engineer with four to six years’ experience, Tyagi said.

“We’re not saying AI token costs will be higher than every developer’s salary on the planet, because US salaries tend to be higher than in India, for example,” Tyagi said, adding that token costs do not vary by location, and in India they may already be equivalent to the salary of an engineer with four to six years’ experience.

Tesco are moving 40,000 server workloads off of VMware amid “abusive conduct” from Broadcom, recent legal filings claim.

Tesco filed a lawsuit in the UK’s High Court against Broadcom alleging breach of contract last year. According to a September report from The Register, the lawsuit claimed that in January 2021, Tesco bought perpetual licenses for VMware’s vSphere Foundation and Cloud Foundation, a subscription to VMware Tanzu, plus support services until 2026, with the option to extend support for four additional years.

But when Broadcom took over VMware in November 2023, it would not honour the deal and instead tried to get Tesco to pay “excessive and inflated prices for virtualisation software for which Tesco has already paid” and would not allow it to buy support services for its perpetually licensed software without buying “duplicative subscription-based licenses for those same Software products,” the initial complaint read.

Tesco, which reported 73.7 billion pounds (about $98.7 billion) in revenue in its fiscal year 2026, has since started migrating away from VMware and Broadcom’s mainframe products, according to late-May court filings.

In January, Broadcom stopped supporting Tesco’s VMware products, Tesco said, and Tesco has been paying for third-party support since. In its initial filing, Tesco also said that Broadcom refused to upgrade software or provide all security updates to customers without subscriptions.

One of Tesco’s recent filings reads:

New data from SAP Concur has apparently confirmed employees are still ignoring company policies, with three in four UK business travellers using (or would use) unapproved AI tools.

Data from the company’s Global Business Travel Survey shows that, while organisations are investing heavily in AI, they’re not giving workers access to the right tools.

As a result, employees are opting to use other, more suitable alternatives and often prefer publicly available chatbots such as ChatGPT and Gemini.

Two in five (43%) said they use unapproved tools because they prefer different options to what they’re provided, but one-third (32%) say their organisation doesn’t even offer any AI tools to support planning or booking travel, forcing them to look elsewhere.

The data shows that remote workers (81%) are more likely to use shadow AI than office-based employees (71%), as are younger workers like Gen Z (79%) and Millennials (76%) compared with Gen X (62%) and Boomers (49%).

As for what employees are looking for when it comes to AI supporting their travel needs, the biggest use case is planning itineraries (37%). Tracking expenses (30%), assessing travel risks (26%), making changes to their trip (24%) and completing expense reports (21%) are also common use cases for the productivity-boosting technology.

But business leaders already know the scale of the problem – 100% of CFOs are concerned about shadow AI in business travel, the report found.

“Leaders must educate workers on the risks and provide T&E tools that deliver the desired level of AI support,” EMEA VP for Concur Travel Paul Dear noted.

Looking ahead, the fix must come from organisations – workers clearly aren’t too keen on having to navigate to third-party tools, and are doing it out of necessity. More than a third actually want their AI tools integrated into their productivity software (38%), communications platforms (36%) and CRM systems (32%).

Azul deputy CTO Simon Ritter warns that enterprise Java teams are sleepwalking towards a support cliff.

Ritter, who joined Sun Microsystems in 1996 and now works at Azul, says four long-term support versions of Java will reach end-of-support between 2029 and 2032. Java 17 goes first in 2029, followed by Java 8 in 2030, Java 21 in 2031 and Java 11 in 2032.

Writing in Infoworld, Ritter said: “Between 2029 and 2032, every currently supported long-term support (LTS) version of Java will reach end-of-support within a single three-year window.”

On paper, this looks like a neat upgrade cycle, but Ritter says the reality is a nasty collision of timelines that most enterprises have failed to forecast. Organisations still planning to modernise slowly, moving application by application and version by version, are working from a model the calendar has already mugged.

“The primary danger here is the illusion of time,” Ritter said.

Traditional modernisation plans rely on sequential upgrades and controlled pacing. Ritter argues that once every major Java version expires in the same cramped window, sequential planning collapses.

By the time that becomes obvious, companies will be forced into reactive mode. That means rushed decisions, emergency projects and the usual corporate theatre with extra Jira tickets.

For organisations planning the familiar Java 8 to Java 11 to Java 17 to Java 21 slog, a maintenance task becomes a structural problem. Enterprises with large Java estates will need to upgrade multiple applications across multiple versions simultaneously. That is needed to maintain security compliance and business continuity.

“Waiting until the late 2020s to act guarantees a modernisation process under emergency conditions,” Ritter said.

Modern Java versions still have strong backwards compatibility, but Ritter says that will not offset decades of technical debt.

Large Java environments are stuffed with unused libraries, obsolete logic, forgotten dependencies and dormant features. Much of this stuff no longer runs in production, but it still eats developer time and security oversight.

As codebases age, the drag compounds. What looks like a tidy version upgrade on a roadmap turns into a sprawling operational headache.

Ritter says most modernisation strategies assume upgrades can be sequenced and absorbed gradually. That assumption is now dangerous.

“When multiple Java versions reach end-of-support in the same narrow window, enterprises don’t face a single modernisation project; they face parallel modernisation across their entire estate,” Ritter wrote.

That moves the problem away from frameworks and into people. A typical enterprise with 100 developers cannot afford to waste chunks of its capacity maintaining dead code that delivers no business value.

Multiply that across dozens or hundreds of applications, and the bottleneck becomes obvious. Modernisation is limited by people, not magic tools. Parallel modernisation needs parallel capacity, and most organisations have not budgeted for it, he said.

Ritter says tools that analyse code in isolation cannot tell what matters in production. Without that visibility, companies default to caution and turn their timelines into risk.

“The Java modernisation crunch is a crisis of resource allocation, not a technology problem,” Ritter said.

Every hour spent maintaining obsolete code or investigating unused dependencies is an hour stolen from modernisation. When organisations face simultaneous upgrades across multiple applications, human capacity becomes the hard limit. Sequential planning needs time, while parallel modernisation needs people. Most enterprises no longer have enough of either.

Those tackling technical debt now will still have a difficult transition, but at least it will be manageable. Those who do not will face rushed choices and permanent compromises.

“By the time 2029 arrives, the window for gradual modernisation will have closed. The calendar won’t wait for us to be ready,” Ritter said.