IT Support That Just Works, for Long Island & NYC Businesses

AI ROI is becoming a bigger priority as artificial intelligence moves from experiment to serious business investment. From AI assistants to automated workflows, organizations are finding new ways to incorporate these tools into their work.

But as AI becomes a regular business expense, an important question is emerging: Is the investment actually paying off?

Measuring AI ROI isn't as simple as counting how many employees use AI or how many hours they save. Businesses need to understand what they're spending, what they're gaining, and whether those improvements are making a measurable difference.

Research shows why this matters. A 2025 MIT Project NANDA study found that only a small percentage of the enterprise AI pilots examined delivered rapid revenue growth. Meanwhile, Deloitte's October 2026 research found that 81% of surveyed companies reported faster decision-making and execution, but only 28% reported revenue gains.

The takeaway? Using AI and getting measurable business value from AI are two different things.

From AI Adoption to AI ROI

For the last few years, businesses have focused on securely adopting AI: Which platforms should we use? Where can we introduce automation? How do we get employees started?

Now, the conversation is shifting toward results. Businesses are asking different questions:

• • What business problem are we trying to solve?
  • What does that problem cost us today?
  • Where can AI deliver measurable value?
  • How will we know if the investment is paying off?

A 2026 CIO survey found that fewer than one in five respondents said their AI initiatives had met or exceeded business goals. Challenges included unclear ROI metrics, a lack of an AI strategy, and limited in-house expertise.

Today's conversation isn't simply about adopting AI. It's about making sure the investment delivers meaningful results.

The True Cost of AI Goes Beyond Licensing

Most businesses can easily identify their monthly AI subscription costs. But licensing is only one part of the investment.

Depending on how AI is used, additional expenses may include:

• • Implementation and integration: Connecting AI tools to existing applications, data, and business processes.
  • Employee training: Helping teams use AI effectively and understand its limitations.
  • Security and oversight: Protecting sensitive information, managing access, and reviewing AI-generated work.
  • Usage-based costs: Paying for AI processing or automated interactions that increase with activity.
  • Ongoing management: Monitoring performance, maintaining integrations, and making adjustments as business needs change.

AI Tokens and Usage-Based Costs

Some AI platforms charge based on usage, often measured in "tokens," which represent pieces of text processed by the system. While individual interactions may cost very little, expenses can grow as businesses automate document processing, customer service, reporting, and other routine tasks.

A 2026 article in MIT Technology Review highlights the importance of looking beyond the cost of AI usage and considering the cost per useful business outcome.

According to research cited by Computing, 51% of surveyed CIOs expected AI to increase their total technology costs rather than reduce them.

That doesn't mean AI isn't worth the investment. It means businesses need to understand the full cost before expanding their use of it.

Why Time Saved Doesn't Always Translate Into AI ROI

One of AI's biggest selling points is productivity. But saving time doesn't automatically mean saving money.

Consider an employee who spends two hours preparing a weekly report. With AI assistance, that same report takes 45 minutes. That's 75 minutes saved each week. But what happens to that extra time?

If the employee can serve more customers, complete additional projects, or take on more billable work, the business may see a measurable financial benefit. If nothing else changes, the return is much harder to demonstrate.

This helps explain why employees may feel more productive while business leaders struggle to see the financial impact.

Looking Beyond Hours Saved

A 2026 Wharton and GBK Collective study, reported by Forbes, found that 80% of enterprise leaders reported positive AI returns, but only 28% described them as strongly positive. Hours saved remained the most common way to measure AI ROI.

Of course, productivity gains can have benefits beyond immediate financial returns, including less repetitive work, faster access to information, and improved employee satisfaction.

The key is understanding what happens to the time saved and whether it creates measurable value for the business.

What Should Businesses Measure?

Not every AI initiative is designed to increase revenue directly. Some are intended to reduce administrative work, improve accuracy, or help employees respond to customers faster.

The right metrics depend on the business problem you're trying to solve.

⚠️ What many businesses measure	✅ What actually shows ROI
Number of AI licenses purchased	Cost per business outcome
How many employees use AI	Improvements in specific workflows
Hours saved (self-reported)	Additional capacity put to productive use
Number of AI tools deployed	Reduced processing time or errors
The overall AI bill	Cost per completed task or transaction

Different industries may measure AI success in different ways:

• • Accounting firms: Reduced document review time, fewer errors, and increased capacity during busy periods.
  • Construction companies: Faster access to project documents, less administrative work, and fewer delays.
  • Law firms: More efficient internal research, improved document review, and faster turnaround times.
  • Nonprofits: Less time spent preparing grant reports and more resources available for programs and services.
  • IT Teams: Faster ticket resolution, easier access to documentation, and improved help desk efficiency.

What Makes an AI Investment Worthwhile?

Not every workflow offers the same potential return. Before investing in AI, businesses should consider how often a task is performed, whether the process is clearly defined, and how the improvements will be measured.

Factor	✅ Stronger ROI potential	⚠️ Lower ROI Potential
Volume	Frequent, high-volume, repetitive work	Occasional, one-time tasks
Data	Organized, accessible, and properly permissioned	Scattered across servers, inboxes, and personal drives
Process	Clearly defined and measurable	Inconsistent or undefined
Baseline	Current time and cost are known	No baseline to compare against
Time saved	Redirected to customer or billable work	Absorbed with no change in output
Users	Specific roles with clear use cases	Licenses purchased for everyone “just in case”
Security	Approved tools and proper controls	Unapproved tools and unclear policies

These factors don't guarantee a positive return, but they can help businesses identify where AI is most likely to deliver measurable value.

How to Calculate AI ROI

Once you've identified a promising use case, the next step is determining whether the benefits justify the investment.

Start by measuring how the workflow performs today. Consider the time required, number of tasks completed, labor involved, error rates, and overall operating costs. These figures provide a baseline for evaluating improvements after AI is introduced.

The basic AI ROI formula is:

AI ROI (%) = (Financial Benefits − Total AI Costs) ÷ Total AI Costs × 100

An Example of AI ROI in Practice

Imagine an accounting firm introduces an AI tool to help employees research and summarize client documents.

After several months, the firm measures the following results:

• • Employees save a combined 10 hours per week.
  • The firm values that additional capacity at $50 per hour.
  • Over 52 weeks, that represents $26,000 in potential annual value.
  • AI licensing, implementation, training, and ongoing management cost $8,000 annually.

If the firm can turn all that additional capacity into measurable financial value, its potential annual ROI would be:

($26,000 − $8,000) ÷ $8,000 × 100 = 225%

Of course, this is a hypothetical example. The actual return depends on how the saved time is used. If the firm doesn't generate additional revenue, reduce expenses, or achieve another measurable financial benefit, its realized ROI could be considerably lower.

The important distinction is between potential productivity gains and financial results.

Start Small, Measure Results, Then Expand

Businesses don't need to introduce AI across every department to see value. Starting with a smaller, well-defined project can make it easier to evaluate the results before committing additional resources.

A practical approach includes:

1. Identify a specific opportunity. Choose a workflow where AI could make a meaningful difference.
2. Establish a baseline. Document current performance, including time, cost, and quality.
3. Test the solution. Introduce AI to a small group of employees with a clearly defined use case.
4. Evaluate the results. Compare performance before and after implementation, including accuracy, costs, and any additional work required.
5. Expand where it makes sense. If the benefits justify the investment, consider applying the solution to additional workflows.

Not every employee needs premium AI tools. Start with the roles and workflows most likely to benefit, then expand when the results justify the cost.

Why AI Governance Matters for ROI

Even when AI improves productivity, poor oversight can introduce security risks, unexpected expenses, and other challenges that reduce its overall value.

Employees may already be using AI tools without their organization's approval. A 2026 Flexable report found that 57% of respondents had used AI applications their employers hadn't approved, a practice often called "shadow AI." This raises concerns about sensitive business information, customer data, and intellectual property.

Effective AI governance helps businesses establish approved tools, clear usage policies, appropriate access controls, and human oversight. It also provides a way to monitor AI spending and usage.

Protecting your AI investment means managing both its benefits and its risks. Learn more about TCI's Managed AI Governance services.

Making AI Investments Work for Your Business

Getting value from AI takes more than purchasing software. It requires choosing the right opportunities, understanding the costs, and evaluating the results.

Choosing the right platform is part of the equation. Businesses also need reliable data, appropriate security controls, and a clear understanding of how AI will fit into their existing operations.

At TCI Technologies, our AI Advisory Services help organizations assess AI opportunities, compare platforms, and plan implementation. Whether you're considering Microsoft Copilot, another AI platform, or workflow automation, we help you make informed decisions about where to invest.

Is Your Business Ready for AI?

Before investing in more AI tools, make sure you understand where they can deliver the greatest benefit. TCI can help you evaluate your AI readiness, identify opportunities, and develop a practical approach to implementation, security, and ROI.

Take our free AI Readiness Assessment or contact a TCI AI advisor to discuss your organization's goals.

Business password security goes beyond creating strong credentials. Most organizations already encourage employees to use unique logins, enable multi-factor authentication (MFA), and follow safer sign-in practices. But there’s another risk that’s much easier to overlook:

What happens when a credential is stored somewhere it should never have been?

A recent security issue involving Applebee’s is a powerful example.

What is Business Password Security?

Business password security is the practice of protecting the credentials that provide access to company systems, applications, and data.

It extends beyond what employees type at a login screen. Organizations also need to consider where sensitive credentials are stored, who has access to them, how privileged accounts are controlled, and what happens when something is compromised.

Ultimately, the goal is simple: make credentials difficult to steal, misuse, or overlook.

What Happened at Applebee's

According to a report from TechCrunch, a security researcher discovered a credential for an internal database embedded in Applebee’s Android app. The credential provided access to the company’s customer database.

The affected database reportedly contained customer names, email addresses, dates of birth, phone numbers, ZIP codes, and recent login IP addresses. The researcher said the credential could potentially have been used to change customer data. Applebee’s parent company, Dine Brands, told TechCrunch it had addressed the issue and that its ongoing investigation had not found evidence of unauthorized access.

The Problem With Hardcoded Credentials

Embedding a password, API key, database credential, or other secret directly in software is known as hardcoding credentials. In this case, TechCrunch reported that the credential was buried in thousands of lines of the app’s code, and the researcher used AI to help find it.

Sensitive credentials don’t have to sit in a document labeled “PASSWORDS” to be exposed. They can find their way into:

• • Applications and scripts
  • Configuration files and source code
  • Automation processes
  • Documentation and shared folders
  • Old employee accounts
  • Service accounts
  • Cloud applications

Effective business password security means understanding where these credentials exist and how they’re protected, not simply requiring users to create stronger logins.

AI Makes Hidden Credentials Easier to Find

The researcher said AI helped find the exposed credential among thousands of lines of code. That ability to analyze large amounts of information quickly means businesses should assume exposed credentials and other security mistakes can be found faster than ever.

Security through obscurity is becoming even less effective. Don’t assume sensitive information buried in code, documentation, or configuration files is safe simply because it would be difficult for a person to find.

Business Password Security: 6 Best Practices

Even a highly complex credential offers little protection if it’s exposed in an application or other accessible location. Effective business password security requires multiple layers of protection:

1. Use Multi-Factor Authentication

Wherever it’s supported, protect sensitive accounts with multi-factor authentication (MFA). The additional verification step is especially important for cloud services and administrator accounts.

But MFA isn't the whole solution. Application credentials, service accounts, tokens, and database connections work differently from an employee signing in to Microsoft 365, so they require their own controls.

2. Stop Sharing Passwords

Shared administrator logins and password spreadsheets create unnecessary risk. Give each person an individual account where possible so access can be controlled and activity can be traced to a specific user. Just as importantly, have a clear process for removing access when employees, vendors, or contractors no longer need it.

3. Use a Business Password Manager

Employees shouldn’t have to remember dozens of complex passwords. A business password manager, such as Bitwarden, generates and securely stores unique credentials to reduce the temptation to use predictable or repeated passwords.

Your IT team should also understand how administrator credentials, service accounts, and other privileged secrets are managed.

4. Protect Privileged Credentials

Not every credential carries the same level of risk. A login for a low-risk application shouldn’t receive the same level of protection as a credential that provides access to a customer database.

Pay particular attention to credentials that provide access to:

• • Microsoft 365 administration and Microsoft Entra ID
  • Servers, firewalls, and network equipment
  • Backup platforms
  • Financial applications
  • Customer databases
  • Remote access systems
  • Cloud environments and business-critical applications

These privileged credentials deserve stronger controls, tighter access, regular review, and monitoring.

5. Monitor Identity, Not Just Devices

Traditional cybersecurity focused heavily on protecting devices. Today, attackers increasingly target the identities behind them. A stolen credential can give an attacker access to email, cloud apps and company data without ever installing malware on an employee’s computer.

That’s why TCI recommends a layered approach. Endpoint detection and response (EDR) protects computers and servers, while identity threat detection and response (ITDR) watches for suspicious activity involving user accounts and credentials. The goal isn’t to replace MFA, endpoint security, email filtering, or training. It’s to make sure your business doesn’t depend on a single control to stop every attack. See how TCI provides 24/7 security monitoring across endpoints and identities.

6. Secure Application and Service Credentials

The Applebee’s story highlights something easy to overlook: cybersecurity isn’t only an IT department problem. If your organization builds applications or connects cloud platforms, passwords, database credentials, and API keys shouldn’t be embedded in software just because it’s convenient. Secure development should include secrets management, access control, code review, vulnerability testing, and logging.

Interestingly, the researcher reportedly had trouble notifying Applebee’s or Dine Brands because neither offered a way to report security issues. The researcher eventually turned to TechCrunch for help. That’s another lesson: have a plan for receiving security reports, not just for preventing incidents.

Business Password Security Checklist: 7 Questions to Ask

1. 1. Do all employees use unique passwords for business systems?
   2. Is MFA turned on everywhere it’s practical and supported?
   3. Are administrator accounts separate from everyday user accounts?
   4. Are credentials being shared by email, spreadsheets, documents, or Teams messages?
   5. Do you know which service accounts and application credentials exist?
   6. Is unnecessary employee and vendor access removed promptly?
   7. Can you detect suspicious account and sign-in activity?

If the answer to several of these is “we’re not sure,” that’s a cybersecurity issue worth investigating.

Password Security Is Really Identity Security

The Applebee’s incident reinforces an important lesson: effective business password security is part of a broader identity and cybersecurity strategy. TCI Technologies takes a layered approach to cybersecurity, bringing together identity protection, Microsoft 365 security, endpoint protection, email and phishing protection, vulnerability management, and security awareness.

Not sure where credential or identity risks may be hiding in your organization? Take our free Cybersecurity Risk Assessment to uncover gaps before they become incidents, or call us at (516) 484-5151.