Weekly signal

Three supplier announcements this week make the business case for agentic rollouts concrete — and show the immediate workforce questions companies must answer: integrators selling "100% agentic" blueprints to mid‑market firms, and security vendors shipping endpoint and browser controls to manage "shadow AI."

What changed

1. Mid‑market delivery blueprints: CBTS (and its OnX/OnX Forge AI unit) published a blueprint for "100% agentic delivery," citing an internal rollout across ~2,300 employees with claimed ROI in under three months and an emphasis on embedding governance and reskilling into deployments. This turns agentic deployment from an R&D conversation into a packaged go‑to‑market offer for smaller enterprises.

2. Real‑time browser control for "shadow AI": KnowBe4 expanded its Agent Risk Manager with a native Chrome/Edge browser extension (Early Access) that can allow, warn, or block employee access to AI sites in real time — surfacing a vendor strategy to put enforcement at the browser where many agents are invoked. That shifts some control from post‑hoc detection to active prevention at the user surface.

3. Endpoint AI visibility: Bitdefender launched GravityZone AI Visibility & Control — an endpoint‑agent that inventories online LLMs, agent frameworks, IDE extensions, local models, and MCP components and ties discovery to enforcement. Together with browser controls, this signals that security tooling is moving to inventory-and-control models for agentic risks.

What to do with it

1. Inventory first, policy second. Run an immediate 30‑day discovery project (browser + endpoint + cloud API keys) — these vendors’ products are built for that problem, but you can start with existing endpoint and identity logs. Use that inventory to classify which agent uses are approved, which are risky, and which require redesign.

2. Reframe workforce planning. Treat agent adoption as a change to job design: identify roles that will shift from execution to oversight, create new "agent ops" and "agent safety" responsibilities, and budget reskilling hours for affected teams (sales, service, accounts, finance) rather than only hiring external integrators. CBTS/OnX explicitly link their blueprints to role redesign and reskilling.

3. Prioritize security controls. Deploy browser‑level controls (block/warn/allow), tighten endpoint discovery, rotate and treat agent API keys as production credentials, and add audit trails for agent actions. Start with high‑risk functions (sales/service data, engineering CI/CD, HR/payroll systems).

4. Pilot, measure, iterate. If you trial agentic automation, measure reclaimed hours, error rates, customer experience delta, and downstream compliance touchpoints. Insist on short evaluation cycles (90 days) and measurable ROI before wider role redesign.