# How Mammoth Brands took first response from four hours to seven seconds _Mammoth Brands ยท 2026-09-09_ **Topics:** ITSM, Access Management, Security, Onboarding & Offboarding A three-person IT team supports 600 employees across the US and UK. After replacing a legacy ITSM that had no automation and no AI, Mammoth Brands went live on Harmony in two weeks - and now answers in seconds, including weekends. ## Results - **7 sec** - time to first response, down from 4 hours - **4.7** - employee CSAT - **2 weeks** - from live POC to full rollout - **322** - knowledge base articles, up from ~50 ## At a glance - **Industry:** Consumer packaged goods - personal care and grooming - **Headquarters:** New York - **Workforce:** ~600 employees across the US and UK, with Germany onboarding next - **IT team:** Three, covering identity, device management and workplace technology - **Where employees ask:** Slack, plus the Harmony portal - **Connected context:** Microsoft Entra ID (IdP), Intune, Kandji, CrowdStrike, Google Workspace, Confluence - **Replaced:** A legacy ITSM with no automation and no AI agent - **Beyond IT:** Cybersecurity impact-hours tracking and L&D stipend approvals, built by the team ## The challenge: three people, 600 employees, and no automation at all When Marce Ayala joined Mammoth Brands as Senior Manager, IT Infrastructure in September 2024, he inherited a legacy ITSM and, in his words, "no automation. We had no AI chat bot at all." A team of three - including him - covered identity, device management and workplace technology for roughly 600 employees across the US and UK, and did everything by hand: provisioning, support tickets, triage. The harder problem was visibility. Requests arrived in Slack, and the ticket in front of the team said almost nothing about the person or the machine. Intune and Kandji weren't connected to the ITSM, so "if the user had a Mac, we didn't know by looking at the ticket." CrowdStrike status, purchase date, warranty - each lived on a different dashboard, and getting the full picture meant opening all of them. So the loop for "my computer is slow" was: read the Slack message, ask the employee to come to the help desk, then start digging - research, quick fixes, driver updates - before anyone knew what was actually wrong. ## Build versus buy: the idea came out of a hackathon Mammoth Brands runs an internal hackathon every year, and Marce's team pitched a chatbot. One engineer pulled the back-end data on after-hours ticket volume to size the problem, and the team built a proof of concept across the company. That's also where they stopped. "Building it out means that we'd have to maintain it" - keep up with it, keep it working - so they turned the question around: what product does this today? They trialled several AI products. What separated Harmony wasn't the chat; it was asset management, and "the integrations that you guys have, how they connect, what they connect to, and how they pull that data in. So that when we go to look for and use that data, it just works effortlessly." ### Out of the box, not out of a builder The other AI products required building first. Harmony mostly didn't. > We tried other AI products and the thing that we found is that we had to kind of go in and build, whereas with Harmony, a lot of it came out of the box. So our time to deploy was a lot faster. > > - Marce Ayala, Senior Manager, IT Infrastructure, Mammoth Brands MFA reset came out of the box - all the team had to do was turn it on. Same for device lockout. Both simply worked. ## The rollout: two weeks in a private channel, then a weekend that never ended The integrations went in first, and fast: "I was in the product just flying right out the gate. Click, click, click, click, click, cool. Everything is already integrated." In parallel, Marce pushed his team to grow the knowledge base, because the agent can only resolve what it can read. Confluence went from about 50 articles when he joined to roughly 322. The POC ran live for two weeks behind a private Slack channel. Then came the decision that set the rollout. > One weekend, I was talking to my director and I was like, you know what? We don't have weekend support. Let's just see what happens. And so we essentially turned it on and never turned it off. > > - Marce Ayala, Senior Manager, IT Infrastructure, Mammoth Brands That weekend coverage is now real coverage. Recently an employee's machine ran an update and locked them out of their account without their password. Harmony alerted a team member, who stepped in the same day. Before, that person would have waited until Monday. What started as a US initiative expanded to the UK, with the German team onboarding next - not by mandate, but because other lean teams saw how the agent triaged and closed tickets. ## The results ### First response: four hours to seven seconds > Time to response, we went from four hours to seven seconds because the bot responds immediately. > > - Marce Ayala, Senior Manager, IT Infrastructure, Mammoth Brands Employee satisfaction sits at 4.7. Ticket volume went up too, and Marce counts that as the point rather than a problem: "Employees are submitting more requests because they're getting help faster. Whereas before, someone would submit a request and may not hear back for a while - and that kind of deters people from submitting requests." The feedback from employees is narrower than the team expected, and better for it: it's easier to get help, and help comes fast. ### The L0/L1 layer handles itself MFA resets, device resets, and the basic troubleshooting layer now run without the team. Access requests are the largest single category - "I need access to," across the board. A request for a Microsoft Excel license is two seconds of work; twenty of them a week is a process with no variation in it. "Can a human do it? Sure. But why not automate the process and have the agent do it? And also respond to the user and say, hey, I've actually completed this or fulfilled this request for you." ### One pane of glass - down to the battery Because the CMDB pulls from Intune, Kandji, CrowdStrike and Microsoft Entra ID, the agent answers questions the team previously couldn't answer without the machine in hand. An employee reported a draining battery and asked for a swap. > The bot was able to step in and say, hey, I see that your battery actually needs to be replaced. And that's information that we wouldn't have unless we actually got the machine, ran a diagnostic, took a look at it. > > - Marce Ayala, Senior Manager, IT Infrastructure, Mammoth Brands Upgrade eligibility works the same way. Someone says their laptop is three years old; Harmony checks the refresh policy and the purchase date, confirms eligibility, and opens a scheduling ticket - work that used to mean looking up a purchase date in one system and a start date in another. The same context runs the other direction, for the team rather than the employee: assets approaching end of life (over a hundred of them, in one pass), and CrowdStrike coverage and vulnerabilities per machine, so the team can act before anyone files a ticket. ### Querying the queue in plain language Marce uses Harmony's ask interface daily - open-to-closed ratio, how many tickets are pending, how long they've been sitting - which is enough to warn the team before an SLA breach. He also uses it to move, update and close tickets en masse. Their previous ITSM had nothing like it. ### Cost: left pocket, right pocket The business case didn't need much construction. "Numbers wise, it was an easy sell because it was like one to one to what we paid already. So it was really just left pocket, right pocket." ## Beyond IT: workflows the team built for themselves - **Cloud tool access, with forked approvals.** Marce's most complex build routes requests by product: some grant access automatically, others fork to different approval channels, and the workflow ends by sending a formatted HTML email. He built it on vacation, starting by drawing the access path and then adding conditions and forks. "Just rinse and repeat at that point." - **Impact hours.** Chris, on the cybersecurity team, built workflows for the company's impact team that track volunteering hours. - **L&D stipends.** Sydney, the lead infrastructure engineer, built a workflow where an employee asks whether they're approved for a learning stipend, the request routes to HR, and HR approves it in place. ### Why the builder worked Marce's read on other workflow tools: you type the wrong thing, it silently changes something else, and you're stuck in a back-and-forth dance of breaking and re-fixing. "With Harmony, they have both the natural language AI piece and the GUI where you can actually go in and physically fix it if you need to. So you can go in and click around and actually fix it the way you need to, to tailor it how you want." That mattered most for the people he was solving for. "The folks who I was trying to solve for was our international folks. I needed it to be easy for them to be able to get into the product and use it immediately." Other products he evaluated assumed everyone was fluent in prompting; a lot of people aren't yet. ### Pushing the bot One habit most users don't know they can copy: Marce asks the agent for troubleshooting steps a non-admin employee can run in Terminal themselves. It comes back with steps he can hand over - and if they don't work, it escalates to someone with admin rights. ## Where it still escalates The honest limit is tone, not capability. When the agent gets too chatty or returns too much at once, someone says "I just need help" and asks for a person. That happens, and Marce treats it as normal - the team steps in when the agent has exhausted what it can do, which is usually much further along than it used to be. ## Marce's advice to IT leaders evaluating agentic ITSM - **Start from requirements, not demos.** Ask what product you have today and what you need it to do. Write down your success metrics first. - **Check how it reads your knowledge base.** Can it reach the documentation you already have, and how does it reference it? That's what drives resolution without a ticket. - **Insist on a CMDB that works out of the box** and integrates with the major platforms - IdP, MDM, EDR. - **Ask what integrates out of the box, and at what price.** His previous product either didn't integrate or charged extra to. - **Run the POC live, for about three weeks.** Watching real employees interact with the agent is the only way to find out whether they'll accept it. "The last thing you want is to put an AI chatbot product out into the environment and people say, I want to talk to a human." ## What's next Marce's answer is end-to-end resolution: "Being able to have the agent not only intake the ticket, but at the end of the day, close it end-to-end. That is where I see the real value add." **Video:** https://www.youtube.com/watch?v=a6PkR8VOQtc