Mid-Market Technology Trends: Who Approves the Work When Systems Act on Their Own?
Welcome to Mid-Market Technology Trends, a roundup of the technology and business developments most relevant to middle-market organizations.
Every issue, we cut through the noise to highlight the developments we believe are most likely to shape technology decisions, along with our perspective on what they mean for middle-market businesses.
Payments Are Moving Inside the ERP
SAP announced SAP Pay on October 6 at its SAP Connect conference. Built into SAP Cloud ERP, it pays a supplier when the invoice comes due and reconciles the transaction in the same workflow, with no bank files to upload and no outside payment processor in the middle. It handles ACH, wires, and checks, plus stablecoin settlement for cross-border payments. SAP also plans to open more finance assistants, covering close, treasury, and receivables, to early adopters in early 2027.
Our Take: For decades, paying a supplier has meant approving in one system, executing in another, and reconciling the two after the fact. Pulling execution into the ERP closes that loop and gives finance a faster read on cash. It also moves payment risk closer to the system of record, which makes ERP governance more than a reporting concern. Approval rules, payment authority, and separation of duties carry more weight when the system that approves a payment is also the one that sends it. Other ERP vendors are heading the same direction, so expect this to come up in your next roadmap conversation.
What If Your Team Didn’t Have to Open the CRM?
Microsoft made 30 prebuilt Dynamics 365 CRM skills generally available on October 8 inside Copilot Cowork, part of its new Copilot experience. The skills draw on more than 180 tools across Dynamics 365 Sales, Customer Service, and Customer Insights. In practice, a seller can ask Copilot to dig into why a deal has stalled, or turn meeting notes into proposed updates to the opportunity record, without switching screens. The connection runs through Model Context Protocol (MCP), a standard for letting AI assistants work with business systems. It also respects the Dynamics 365 and Microsoft 365 permissions already in place. A more autonomous Autopilot mode is still in private preview.
Our Take: AI in CRM has mostly meant features added inside the CRM. Here, the CRM stays the system of record while the work moves to wherever people already are. For companies that have spent years building out Dynamics 365, that’s a way to get more from the investment without building every workflow by hand. It also raises the stakes on data quality, because inconsistent stages, duplicate accounts, and stale contacts flow straight into what Copilot recommends. Microsoft draws a clear line between what the AI suggests, what a user approves, and what actually changes in the system, and that line deserves testing before rollout.
Read more (Microsoft Dynamics 365 Blog)
Only 5% of Companies Have Automated Controls for Their AI Agents
A 2026 survey of 858 executives found a wide gap between how ready companies feel for AI agents and how ready they are. Agents, in this case, are AI that takes actions across systems on its own rather than just answering questions. Most respondents (82%) believe their organizations can keep pace with governing, integrating, and monitoring them. Only 26% say they’re well prepared to resolve conflicts when agents, systems, and automated workflows collide. Just 5% have automated controls, audit trails, and formal human review points in place. Integration with existing systems was the top priority at 74%, and 62% want the freedom to switch AI models or vendors later.
Our Take: For most companies, AI readiness still means a written policy and a review meeting. That holds up while agents are few and their work is simple. It breaks down once several agents are acting across ERP, CRM, and finance systems at the same time. A more practical starting point is a short list of what an agent can do on its own, what needs a person to sign off, and a record of everything in between.
Exits Are Slowing But Buyer Standards Aren’t
Middle-market M&A volume fell 9.1% in the second quarter, snapping three straight quarters of growth, though first-half volume still ran 9.3% ahead of last year. Private equity exits dropped 17.8% to 213 deals. The median holding period for active buyouts hit a record 4.2 years. More firms are using continuation vehicles to keep companies past the original fund’s life, and capital raised in those vehicles rose 126% year over year to $12.6 billion. Private strategic buyers did fewer deals but paid more for each one, with average value up 16% to $71.2 million.
Our Take: When the exit keeps moving out, returns have to come from how the business runs rather than when it sells. Buyers paying up for larger, established companies points the same way. Clean financials, connected systems, and a credible security posture are increasingly what draws bids. For acquirers, bigger deals also mean bigger post-merger IT integration work. That work is far easier to scope with a technology assessment done before close than one done after.
Remote-Support Tools Hold the Keys to Everything They Touch
On October 15, BeyondTrust disclosed a vulnerability in its Remote Support appliances, which IT teams use to access and troubleshoot employee devices. Incident responders found that a suspected China-linked espionage group had been exploiting it as early as late August, before a patch existed, which makes it a zero-day issue. BeyondTrust patched its cloud-hosted customers on October 9. Self-hosted appliances have to be updated by the customer, and any that sat unpatched on the internet should be treated as potentially compromised.
Our Take: A remote-support tool is built to reach everything, which is exactly what makes it valuable to an attacker. One compromised point can expose the credentials for every system it connects to. What leadership needs is a quick answer to three questions. Which privileged-access tools does the company run, including any managed by an outsourced IT provider? Are they patched? Who would notice if one had been tampered with?
Read more (Google Threat Intelligence)
What This Means for the Middle Market
Across ERP, CRM, AI governance, dealmaking, and cybersecurity, this issue’s developments point the same way. Automation continues to move into the core of how businesses run. Payments now execute inside the ERP, CRM work is happening outside the CRM screen, and AI agents are taking actions across systems. Even private equity is holding companies longer and counting on operations, rather than timing, to carry returns.
The controls around all of that haven’t kept pace. Approval rules, audit trails, data quality, and visibility into privileged access are still mostly manual. The companies that come out ahead will be the companies that build those controls in as new capability arrives, instead of waiting for an incident to force the issue.
Whether the next step is AI in your CRM, a change to finance workflows, or preparing for a future transaction, Ascendex helps organizations decide what’s worth doing and carry it into execution. Then we stay involved to make sure it keeps working as the business grows.
Contact us if you’re looking for help deciding what technology initiatives to prioritize and how to execute them with confidence.