7.6 million events analyzed by the agents since January 2026.
Project context
The size of Pernambuco's state school network, what the Department's IT sustains with a five-person infrastructure team, and how the operation responded to incidents before AI agents.
AI agents inside the incident cycle, with the team at the center of the decision.
The Pernambuco Department of Education serves 513,000 students across 1,085 schools and 16 regional education offices. The IT that sustains this network manages 135,000 assets, more than 2,000 internet links and over 150 systems in operation, from online enrollment to benefit payments, with 10,000 support tickets a month and 24/7 availability required.
In partnership with Central IT, the Department built an operation assisted by AI agents running inside its own data center. The agents watch the environment, correlate events, open the ticket, propose the plan and execute the mitigation; the specialized team approves and decides. Since January 2026, 7.6 million events have been analyzed and about 55,000 incidents delivered with context already attached, and the noise reaching the specialists has dropped by 99%.
About SEDUC-PE
Data on the state school network and the IT environment that sustains it.
Location
Pernambuco State Department of Education, Brazil
Network served
513,000 students, 1,085 schools and 16 regional education offices
IT environment
135,000 assets, over 2,000 links and over 150 systems, with 10,000 tickets a month
Strategic priorities
- 24/7 availability of education systems
- Security of student data
- Governance and traceability of every action
Solution focus
- On-premises AI, with LLM and GPU in the agency's data center
- Autonomous agents inside the incident cycle, with human approval
- Tickets, audit trail and knowledge centralized in CITSmart
Results in numbers
7.6M
Events analyzed
by the AI agents since January 2026.
55K
Incidents with context
about 55,000 delivered to the team with probable cause and recommendation.
13K+
Responses executed
with human approval, since January 2026.
99%
Less noise
in what reaches the Department's specialists.
Strategic points
Challenges
The environment grew every year, and the team didn't. There are 135,000 assets between computers and printers, over 2,000 internet links and more than 150 systems constantly being born, with 10,000 support tickets a month. To analyze the logs and look after all of it, infrastructure had a team of five people, and the contract had already reached its 25% amendment: budget and procurement time were not growing with demand. The starting point of the project was the request Luiz Felipe Pereira, then infrastructure manager, made to Central IT: it was no longer possible to deliver without more people. The answer was that the way forward was not more people but automation with AI.
Two processes concentrate the risk. Online enrollment opens at seven in the morning with the network's schools connected at once, and a school can run out of spots ten minutes later: a failure there directly hits 513,000 Pernambuco families. And Pix Tênis, which in 2025 credited R$150 to 493,000 students, R$74 million in total, turned every policy announcement into a spike of attacks against the data center. The operation had already been forced to reorganize after a security incident and worked reactively: it discovered the problem after it happened, and a password reset at eight at night waited for the next day's five-business-hour SLA.
Solution
Central IT deployed an IT operation assisted by AI agents running on-premises, inside the Department's own data center: an LLM on a server with local GPU, monitoring with Zabbix and AIOps, an autonomous NOC with intelligent discovery, and the Hyper Agents AI engine connected through MCPs. The Hyper Agents continuously watch the different layers of the environment and talk to each other: what one agent cannot resolve goes up to the next. Because the environment handles student data, the model never leaves the building.
The incident cycle runs through two layers. The Autonomous Center centralizes the logs and applies an analysis that interprets and translates what's happening into plain language, instead of just storing the record. Repeated events become a single case: in one intrusion attempt, the same IP tried about 100 times, and the team received a single occurrence to analyze. Once the pattern is confirmed, Autonomous Action opens the ticket in CITSmart already classified by portfolio, contract, impact and urgency, and captures the configuration item tied to the occurrence to measure how critical that asset is.
The autonomy has a brake. Faced with an unprecedented event on a critical asset, the agent doesn't act on its own: it sends the manager, over WhatsApp, an action plan to be approved or rejected by a person. Once the plan is approved, the agent squad executes end to end: it rereads the logs to reconfirm the scenario, plans the mitigation route, executes it, retries the attack to validate containment, and assembles the executive report. The case becomes a knowledge base entry, and when the same kind of situation comes back, the action is taken automatically. Once the occurrence is closed, the analyst receives what happened and the final status over WhatsApp.
Every day starts with the morning call: the report on the last 24 hours shows, in one place, what happened, where it concentrated and which actions the agents have already taken. The data stays inside the Department's environment, with LGPD-compliant governance, traceability of every action and human oversight of critical actions.
Measurable delivery
Results and impact on the operation
What changed in the Department's IT routine since January 2026, when AI agents started acting inside the incident cycle.
Results
About 55,000 incidents delivered to the team with context, probable cause and recommendation.
More than 13,000 responses executed with human approval.
99% less noise reaching the Department's specialists.
A pattern nobody saw: 62% of incidents happen outside business hours, with the biggest peak at 5 a.m.
A brute-force attack against the Pix Tênis application server detected, escalated and contained by the agents, with the team acting only on approving the action plan.
Password resets resolved in seconds, any time, instead of the five-business-hour SLA.
The operation stopped being reactive: a link outage is flagged before the user opens a ticket.
Elastic capacity: new agents expand the operation without expanding the team's headcount.
Every action monitored and auditable, with the data inside the Department's data center, the case logged in CITSmart and the continuous compliance the public sector requires.
Incidents prevented: the AI learns patterns, anticipates failures and reduces the team's rework.
IT on the executive agenda, with an impact indicator for the Secretary instead of ticket volume.
Activity outside the security policy is also flagged to the team, which keeps the decision in its hands.
Impact
The result isn't measured in closed tickets. In 2025, Pix Tênis credited R$150 to 493,000 students, R$74 million that reached Pernambuco families, and online enrollment distributes spots to 513,000 students across 1,085 schools, with more than 700 schools visited each school year. Keeping these processes standing is what the operation delivers. What AI changed was where the team spends its day: from reading logs, searching and correlating to deciding with the scenario already translated, without swapping anyone out for an agent. With the agents also responding overnight, when the 5 a.m. peak happens, the team has become more specialized and responds to what is critical.
Digital transformation doesn't happen with technology alone. It happens when people, processes and purpose evolve together.
The case at Gartner CIO 2026
See SEDUC-PE's IT operation as presented at Gartner CIO 2026.
With Luiz Felipe Pereira, General IT Manager, Pernambuco Department of Education, and Fred Vasconcelos, President of ATI-PE. Video in Portuguese.
Talk to a Central IT specialist
See how a public operation of this scale puts AI agents inside the incident cycle without giving up the human decision. Our team helps design the path, from diagnosis to operation.