How to Auto-Resolve 40% of L1 IT Tickets with AI

L1 IT tickets are a margin problem dressed as a support problem. The average cost per L1 ticket across MSPs is $22 (MetricNet 2024), and in most operations they represent 60–70% of total ticket volume. A single password reset at an enterprise account runs $70 in labor cost (Forrester). Multiply that by hundreds of resets a month, and you're looking at a structural inefficiency hiding in plain sight on every queue.

The answer isn't hiring more tier-1 analysts. It's making the tier-1 work automatic.

Broadcom's internal AI resolved 57% of IT issues in under 60 seconds at scale. That wasn't a magic product — it was a specific architecture applied to a specific category of work. This guide walks through that architecture so you can apply it to your own stack.

The Auto-Resolution Architecture

The core pattern is a five-stage pipeline. Each stage has a specific job; the failure mode for each is well-understood.

Ingestion — tickets arrive from email, portal, Slack, Teams, or API. Normalize into a standard payload: title, description, user metadata, channel, timestamp. This step is unglamorous but critical; garbage ingestion produces garbage classification.

Classification — the LLM categorizes the ticket against a known taxonomy. The taxonomy should be narrow — 4 to 8 categories maximum for initial rollout. Wider taxonomies dilute confidence scores and blow up your false escalation rate. The classifier also assigns a confidence score (0–1) at this stage.

KB Retrieval — on high-confidence classifications, query the knowledge base for matching resolution steps. "Password reset" hits the password reset KB. "VPN issue" hits the VPN troubleshooting guide. The match score between the ticket context and KB entries is the second gate.

Resolution Attempt — if both classification confidence and KB match score exceed their thresholds, the system attempts auto-resolution. This could be: sending a reset email, restarting a service, provisioning an account, providing step-by-step instructions via reply. The attempt is logged and tracked.

Human Escalation — if any gate fails, the ticket routes to a human with a full context package: classification result, KB entries queried, resolution attempts made, confidence scores. Don't escalate empty-handed — the human shouldn't have to re-read the original ticket.

The Four Ticket Categories Most Amenable to Auto-Resolution

What Good Looks Like: Checkpoint Thresholds

Auto-resolution only works if the failure modes are well-defined and enforced. These are the thresholds we use with clients — calibrate to your own risk tolerance, but don't skip the SLA breach gate.

The last checkpoint — human override signal — is underemphasized in most implementations. Every "not solved" reply should be fed back into the KB as a failure case. Build that loop early; it's what separates a system that gets better from one that stays static.