As organisations scale across SaaS, public cloud and AI, ITAM teams are being asked to do more than track assets: They’re expected to restore visibility, prove value and govern environments that are growing faster than policy can keep up.

Based on a global survey of 512 professionals, Flexera’s 2026 State of ITAM Report shows clear progress. But complexity continues to outpace control.

Flexera’s newly-released 2026 State of ITAM Report reveals a growing disconnect: Organisations are investing heavily in AI tools, yet many lack the visibility and governance needed to manage them effectively. This tension creates a new challenge, and IT leaders are asking themselves:

How do we govern AI usage without slowing innovation and limiting ROI?

Below, is a breakdown of the key AI-specific findings shaping enterprise ITAM strategies today.

After 5+ years of Flexera’s State of ITAM report, one thing’s clear: there’s no shortage of daily challenges faced by ITAM teams. Business units now buy applications directly. Teams experiment with unsanctioned AI tools. Free trials turn into paid subscriptions. All while overlapping apps stack up across departments. All of this rolls up under SaaS sprawl.

SaaS sprawl isn’t about having too many tools. It’s about losing control over:

Software audits aren’t new; nearly half (48%) of the organisations surveyed in Flexera’s 2026 State of ITAM Report said they had been audited in the last year. But they are becoming more frequent, more complex and more expensive. They’ve become a constant reality for IT leaders who are constantly asking themselves:

How do I reduce software audit risk while maintaining control across SaaS, cloud and AI?

The answer sits with governance, visibility and proactive ITAM practices.

Britain’s National Crime Agency (NCA) has been told to urgently overhaul an IT estate so dysfunctional that officers say they are fighting serious organised crime despite the technology rather than because of it.

A new report by HM Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) has delivered a bruising verdict on the National Crime Agency’s tech, concluding that the systems underpinning Britain’s fight against organised crime are no longer up to the job.

The criticism lands despite inspectors otherwise finding much to like. The NCA was graded “Good” in several operational areas, including tackling serious and organised crime and working with partners. But throughout the report, inspectors repeatedly return to technology as a fundamental weakness running through the entire organisation.

“The NCA’s IT infrastructure isn’t fit for purpose,” the report states. Inspectors backed that assessment with a long list of examples, from officers manually re-entering data and sharing information by hand to teams relying on spreadsheets and other workarounds due to a lack of confidence in official systems.

According to the report, around 70 percent of critical IT incidents each month are linked to that technical debt, the result of years spent prioritising short-term fixes over long-term modernisation.

Officers told inspectors they did not trust the agency’s systems, while others described technology as a major drag on productivity. One interviewee summed up the mood: “IT is a blocker; we achieve in spite of it.”

Another was even less flattering. “When I started in policing 15 to 20 years ago, I had better technology than I do in the NCA.”

The report paints a picture familiar to anyone who has worked in a large public sector IT environment. Officers told inspectors they routinely enter the same information multiple times, rely on manual processes, and manually transfer data to external partners. Some said the agency lacks even a basic personnel directory, making it difficult to find the right colleague when they need help.

While the NCA operates a corporate system called ATLAS CM, inspectors heard that officers are using as many as 50 different case management methods across the agency, including spreadsheets and other manual workarounds, often due to a lack of confidence in the official platform.

The agency’s security architecture has also produced its own headaches. Because data sits across multiple government security classifications, many officers reportedly require at least two laptops to do their jobs. Inspectors spoke to some staff who were using four separate machines and said they witnessed the resulting inefficiencies first-hand.

In a separate HMICFRS inspection published last year, inspectors found the agency was still relying on around 260 legacy IT systems more than a decade after beginning a project to modernise IT, with technical debt consuming roughly 80 percent of entire IT budget.