The Rise of Agentic Capital Management

Note: This is post #1 of Forcepoint's 2027 Future Insights series, providing predictions and analysis of developing shifts in the cybersecurity landscape.

###

I've spent thirty years operating in and building security organizations for some of the most scrutinized companies in the world: the U.S. Air Force, law enforcement, chief security officer at EMC, a decade as global CSO at ADP and then global chief security officer at TikTok and ByteDance during a period when our data posture became a geopolitical question. If there's one lesson that holds across all of it, it's this: you can't protect what you don't know you have. Agentic AI is about to test that lesson at a scale none of us have planned for.

The Math Nobody's Running

If an organization is moving from one human managing one machine, or one human running one or two processes, to one human directing anywhere from 100 to 1,000 agents, the whole concept of headcount stops making sense. A company with 40,000 employees isn't simply that any longer. That same organization may soon be running something closer to 4 million entities. And the majority of that population isn't doing technical work. It's doing finance tasks, HR work and work across every function a business runs. Most organizations don't have a way to count that workforce, let alone manage it.

Every agent you deploy without agentic guardrails is an employee with no manager, no file, and no exit interview. Agentic capital management is how you close that gap.

Nobody Owns This Workforce

Security teams watch technical activity. HR teams manage human capital. Neither one owns the agent population sitting between them. That's not a tooling gap; it's a structural one. We built our organizations around the assumption that every actor doing work for the business is either a person with a manager or a system with an administrator. Agents don't fit cleanly into either category. They act on behalf of a human, through a prompt or a mission. Then they go operate with whatever access they inherited, across whatever systems that access touches, including the employee's own laptop, where much of that activity never crosses the network at all.

If nobody can tell you how many agents your company is running, who owns each one or what function they sit in, you don't have a security gap. You have accounting and accountability gaps, and those are exactly what regulators and courts care about most when something goes wrong.

Where the Old Detection Model Breaks

For people, preventing an insider threat was rarely about one clean signal. Usually, it required the coordination of multiple points of data from places nobody was specifically watching for that purpose. HR records, a person quietly job-hunting on LinkedIn, an access log showing someone who'd never touched a particular file share suddenly hit it 600 times, while the investigation was focused on something else entirely. Add to that the behavioral baseline layer: typing cadence, login timing, the pattern of a person drifting toward data they don't normally touch. None of that infrastructure transfers directly to an agent. You can't establish a baseline of "normal" for an agent in the same way you do for a person, because the signals simply don't exist.

Here's what does carry over: the definition of insider threat itself. Insider threat was never only about malicious intent. An insider threat is any negative outcome that an insider's access made possible; whether they meant it or not. That definition applies just as well to an agent as it does to a person.

So the real question is whether the agent is in control or out of control. An in-control agent is guardrailed and deterministic, meaning its behavior stays inside fixed limits. If something still goes wrong with an in-control agent, you trace it back to one of three things. Did a person override it? Was it given an extra instruction it shouldn't have acted on? Or were the guardrails themselves the problem, built wrong or just not strict enough?

If it's out of control, having free rein toward a mission, that's when you spend time to understand the original intent behind that mission. We have to learn to separate impact from intent from causation, because collapsing them into one judgment is how agents get blamed for decisions a human actually made.

A Scenario Worth Taking Seriously

Picture a departing employee with admin-level reach. Before leaving, they instruct an agent to quietly accumulate permissions across infrastructure, systems and applications. They then construct a negative impact event timed to trigger after they're gone. Until the day it fires, the agent's activity looks unusual, not alarming. Nothing it does is achieving anything yet. Even a well-instrumented behavioral monitoring system may not flag it, because it's watching for the wrong signal entirely. What would have caught it earlier isn't better behavioral detection. It's knowing the agent existed, who owned it, what function it belonged to, why it had that level of access in the first place, what sensitive data that access exposed, and the ability to enforce those constructs and constraints. That's an ownership and management question, not a monitoring one. And it is one that many organizations currently struggle to answer.

It's worth being precise about what's new here and what isn't. The attack path is different, the method is different, but it's still the use of technical infrastructure and capability to cause a negative impact event, the same as it has always been. What's changed is how much access that infrastructure can reach, how autonomously it can act on that access and how long it can sit quiet before any of it matters. That's why this can't be a feature bolted onto an agent deployment after the fact. Ownership has to be designed into the process before the agent goes live, not discovered afterward.

A New Need: Agentic Capital Management

This is why organizations need a discipline that doesn't fully exist yet: agentic capital management (ACM). It's an operating practice, built on the foundations of human capital management. Explicit ownership for every agent. A real headcount model instead of an assumption. Accountability by job, job family, and expected deliverables the same way a business tracks accountability by department. ACM also requires a working definition of what's normal and what's not, across every function agents touch, not just the technical ones. It runs alongside a second, parallel track that belongs to the security side: instrumentation of agent activity from the edge to the endpoint, with real baselining, investigation and detection capability built for how agents operate. These are two different teams' jobs. Neither one works without the other.

The Cost of Waiting

Here's what's at stake if this gap doesn't close. Historically, only a small fraction of a workforce, essentially system administrators, had enough access to cause catastrophic damage to a company. Agentic tools hand that same level of capability to effectively the entire population of a company, all while lowering the bar for what it takes to misuse it. If organizations don't solve for this in 2027, I'd expect the first visible failures to be a mass data exfiltration of protected information or intellectual property, with zero ability to reconstruct how it left. We've built real capability to answer who took it when the actor is a person with credentials. Yet we have almost none of that capability when the actor is an agent acting on someone else's behalf.

None of this makes agentic AI fundamentally new or unprecedented. It's a new approach to the same discipline I've spent my career on: knowing what you have, who can reach it and what happens when that goes wrong. Organizations focused on building that discipline now will be the ones still standing in a few years. The ones that don't will find out the hard way.