Most IT teams recognize the value of automation, yet in practice, many remain reactive, spending most of their time on tickets and outages rather than building automation.
Industry surveys paint a very different picture.
- Around 70% of organizations have already implemented some form of process automation in 2025, reflecting widespread adoption across industries.
- 86% of businesses report productivity gains from automation, with many also seeing measurable cost reductions and efficiency improvements.
- At the same time, only about 5% of companies are currently achieving significant value from AI and automation at scale, highlighting a gap between adoption and outcomes.
So, everyone is automating, right?
We decided to check. Instead of relying on surveys, we analyzed what actually happens in production using Acronis telemetry data. We examined 100 million automated script runs across 11,500 organizations and 44 data centers over four years. Larger environments naturally generate more automation activity, so part of the observed concentration reflects differences in workload size rather than adoption alone.
Across four years of production telemetry, three patterns appear consistently.
- Automation is highly concentrated. A small fraction of organizations generates most automation activity.
- Organizations that adopt automation tend to commit fully. Once teams begin scripting, most execution quickly shifts to scheduled runs.
- AI is lowering the barrier to entry. Organizations without prior scripting expertise are beginning to automate using AI-generated scripts.
Together, these trends reveal what automation looks like in IT environments.
The big picture
For SMBs and MSPs, automation is more than a productivity tool. It is one of the clearest ways to scale operations without scaling headcount at the same rate. Small internal IT teams use scripting to reduce repetitive work, catch issues earlier, and keep environments stable with limited time and staff. MSPs rely on the same discipline to manage more endpoints, standardize service delivery, and respond faster across many customers.
Key observations from our dataset:
- The top 10% of organizations produce the vast majority of automation activity, though this is partly influenced by differences in environment size and workload volume.
- Organizations that commit to automation schedule 99.5% of their script runs.
- AI-generated scripts are more likely to be executed in production than human-written ones.
- More than half of the scripts created are never executed.
- Eighty-five percent of scripts are inactive or abandoned, indicating significant accumulation of unused automation.
Even after accounting for differences in workload size, automation activity remains highly concentrated. One contributing factor is that many IT professionals still do not feel fully comfortable writing code. Spiceworks found that only 53% of IT professionals feel confident in their coding skills, which helps explain why so many organizations have access to scripting tools yet never move beyond occasional experimentation.
Without automation, many operational problems go undetected between manual checks. A server that begins running out of disk space on Tuesday might not be noticed until a manual check later in the week. A simple script scheduled to run daily could detect the issue automatically and generate an alert within hours.
Automation maturity often evolves in stages:
1. Writing simple scripts to solve immediate problems.
2. Discovering existing script libraries.
3. Combining both approaches to scale automation.
In practice, many teams remain stuck in the early stages. They solve individual issues with one-off scripts but rarely standardize, reuse or build shared automation workflows. As a result, automation remains fragmented and reactive rather than systematic, limiting its overall impact despite having the tools and opportunities to do more.
It is mostly PowerShell
Developer surveys often highlight Python and other programming languages, but real-world IT automation looks vastly different.
In managed IT environments PowerShell dominates automation activity. The Bash scripts in the dataset appear primarily in macOS contexts, while Python and Linux-based scripts appear rarely or not at all in this dataset.
In practice, most automation scripts are small and narrowly scoped.
- Seventy-seven percent are under 2KB.
- Ninety-seven percent take no parameters.
- Ninety-five percent use no stored credentials.
- Sixty-five percent have never been updated past the initial version.
Most scripts perform a single task such as checking a condition, restarting a service or collecting a metric. This simplicity helps make automation reliable and easy to schedule, but it also introduces another problem: scripts accumulate over time.
Your script library is probably a graveyard
Over time, automation libraries tend to accumulate scripts that are no longer actively used. As environments evolve and teams create quick scripts to solve immediate problems, many of those scripts are never revisited, updated or removed. In practice, this leads to a long tail of unused automation that sits quietly in repositories or management platforms. The dataset reflects this pattern clearly. Only about one in five scripts remain active, while the rest gradually become outdated or abandoned.
Beyond operational clutter, abandoned scripts can introduce real security risks. Many scripts embed credentials, API tokens or configuration details that remain valid long after the script itself stops being used. Industry research highlights how common this problem has become: GitGuardian detected 23.8 million new secrets in public GitHub commits in 2024 alone, and reports that 70% of leaked secrets remain active for years after exposure, creating a persistent attack surface. When automation scripts are forgotten but still contain valid credentials or scheduled tasks, they can become a convenient entry point for attackers or a hidden source of misconfigurations. Maintaining script inventories, reviewing old automation and rotating embedded credentials are therefore essential parts of managing automation safely.
AI is changing who automates
One of the most notable findings in the dataset is how quickly AI-generated scripts are moving from experimentation to real production use. When AI scripting features first appeared, it seemed reasonable to expect that many generated scripts would be created out of curiosity and then forgotten. Instead, the data shows that AI-generated scripts are frequently deployed and scheduled as part of regular automation workflows. This trend reflects a broader shift across the software industry: Surveys indicate that roughly three quarters of developers report using AI tools in their development workflow, and many rely on them daily for routine coding tasks.
One explanation is that AI tools dramatically reduce the friction involved in writing small automation tasks. Studies of AI coding assistants show that developers using tools like GitHub Copilot complete programming tasks over 55% faster in controlled experiments, largely because the tools help generate boilerplate code, remember syntax and automate repetitive work. In operational environments such as SMB IT or MSP operations, where many scripts are only a few lines long and designed to check a single condition or run a small maintenance task, this kind of assistance can make the difference between an idea and an implemented script.
AI tools are often used to recall syntax, complete code snippets and reduce the effort required to get started. In other words, AI is not necessarily replacing experienced scripters so much as enabling a broader group of IT professionals to participate in automation. The pattern seen in the dataset supports this interpretation: AI-generated scripts tend to be smaller, simpler and more focused, suggesting they are often used for straightforward operational tasks rather than complex engineering work. This aligns with a wider industry trend where AI is expanding participation in programming and automation, rather than simply accelerating existing experts.
Automation has become an attack surface
Automation has become one of the most powerful tools available to small IT teams, but it is also quietly expanding the attack surface. The same scripts that monitor systems, restart services, or deploy updates often run with elevated privileges and trusted access across large parts of the environment. When automation is well maintained, it improves resilience and reduces operational risk. When it is forgotten or poorly governed, it becomes an attractive pathway for attackers. The rise of AI-generated scripts adds another dimension to this dynamic. AI can make automation accessible to more teams, but it also increases the number of scripts entering production. Research shows that 45% of AI-generated code samples fail basic security tests, while 80% of developers assume AI-generated code is secure, creating a gap between trust and verification.
At the same time, attackers are increasingly exploiting legitimate administrative infrastructure rather than deploying traditional malware. Remote management tools and scripting environments now appear regularly in ransomware investigations. Microsoft reports that 79% of ransomware incidents involve compromised remote management tools, and security researchers have observed a sharp increase in abuse of these platforms. PowerShell continues to play a central role in real-world intrusions because it allows attackers to execute commands, move laterally and persist using tools that already exist inside the environment. For an attacker, modifying an existing scheduled script or abusing an automation workflow can be easier and less detectable than deploying new malware.
The lesson for SMBs and MSPs is not to automate less, but to automate more deliberately. Automation works best when it is treated as operational infrastructure rather than a collection of quick scripts. That means maintaining visibility into what scripts exist, reviewing AI-generated code before it runs in production, removing stale automation, and monitoring scripting activity the same way other privileged operations are monitored. The organizations that gain the most value from automation are not simply the ones that run the most scripts. They are the ones that manage automation as a discipline, ensuring that every scheduled task, credential and workflow remains intentional, reviewed and secure.
Essential items for an automation framework
The following framework summarizes the five essential practices for safe scripting, drawn from the patterns observed across 11,500 organizations.
These five practices apply at any scale. A team with one script benefits from scheduling it and reviewing it before deployment. A team with fifty scripts needs the full discipline of regular cleanup, credential management and monitoring. The framework scales with the environment.
Conclusions
While most organizations agree that automation is important, only a small fraction of environments rely on it at scale. In practice, automation activity is highly concentrated, with a small percentage of organizations producing most automated activity while many others experiment with scripting only occasionally. Results remain consistent after correcting for data quality issues such as tenant duplication, churn and failed executions, with only minor changes to absolute percentages.
Where automation does take hold, the pattern is clear. Scripts tend to be small, focused and designed to solve specific operational problems. Once teams begin using automation regularly, they tend to rely on scheduled scripts rather than manual execution. This suggests that the real barrier to automation is not complexity but adoption. The challenge is often getting started and building confidence in scripting workflows.
At the same time, automation environments evolve over time and can accumulate hidden risks. Script libraries grow, unused scripts remain in repositories and credentials may remain embedded in automation long after the original task is forgotten. As scripting becomes easier through AI assistance and modern automation tools, the number of scripts entering production environments will likely continue to increase. This makes governance, visibility and periodic review increasingly important.
Finally, automation itself has become part of the modern operational attack surface. Attackers increasingly rely on legitimate administrative tools and scripting environments to carry out intrusions without deploying traditional malware. When scripts run with privileged access across many endpoints, they become powerful operational tools for defenders but also attractive targets for attackers if poorly managed.
In summary, the organizations that benefit most from automation are not necessarily the ones that write the most scripts, but those that treat it as operational infrastructure and manage it with discipline.