Splunk survey finds 55% of respondents cannot control AI costs

Monitoring AI is a priority for most respondents to Splunk’s new survey, yet basic spending controls remain elusive. Cisco released its State of Observability 2026 report on October 20: 55% said they could not control AI costs, while 60% said unexpected billing spikes caused more operational strain than high baseline costs.

Oxford Economics surveyed 2,050 IT operations and engineering professionals across 10 countries between February and March 2026. Participants ranged from developers and systems engineers to chief technology and information officers, representing 16 industries. The findings describe respondents’ own assessments, collected months before publication, rather than a measurement of every organization’s AI spending.

The bill for watching the bill

Observability means collecting and examining data to understand how software behaves. Cisco positions that visibility as a way to make AI spending traceable and controllable. But collecting the evidence has a price: 57% of respondents said their telemetry costs—the expense of gathering and handling monitoring data—exceeded the cost of the infrastructure being monitored.

Mitch Ashley, a vice president and practice lead at The Futurum Group, explained the mechanism to CIO Dive. AI workloads produce traces, or records of activity, for prompts, tool calls and model responses. As that activity grows, monitoring charges can rise alongside model charges. He urged buyers to examine how monitoring vendors price, sample and retain that data, not just the AI service’s own rates.

A monthly report can’t govern a cost that spikes in one afternoon.

Mitch Ashley, The Futurum Group, speaking to CIO Dive

Visibility without a clear measure of success

The survey also exposes a gap between wanting oversight and knowing what it should achieve. While 87% called monitoring AI an organizational priority, 54% lacked clear business outcomes tied to it. Another 56% said they could not measure AI workload metrics such as the quality of responses from large language models—the systems that generate text.

Detecting invented answers presents a similar mismatch. Although 85% said visibility into AI hallucinations was important, only 58% considered themselves effective at it. Cisco argues that monitoring agents requires measures of behavior and decision-making tied to business results, rather than relying only on the signals used to watch traditional applications.

Put controls before the next request

Ashley’s recommendations focus on intervening while an agent is working, rather than reconciling its spending afterward. He said useful controls connect consumption to the specific agent, workflow and team responsible. Budget thresholds and limits on request frequency should apply before a request is sent, placing the check where spending begins.

• Assign an owner and a named budget when an AI workload starts. Review the workload if it drifts, rather than leaving responsibility for its costs unclear.
• Route routine requests to smaller, cheaper models. This changes which model handles the work, instead of treating every request as requiring the same resources.
• Write consumption caps into contracts. Alongside controls inside the agent workflow, those terms can help constrain the amount of AI usage an organization pays for.

Oversight is also drawing more teams into the same work. In Splunk’s survey, 81% said monitoring AI workloads had increased collaboration between observability and security teams. Cisco links that shift to agents gaining access across business systems: assessing whether an agent is working well increasingly sits alongside checking whether its behavior reflects a security problem.