The parts of agent governance that look easy are commodity, and the parts that look hard are the entire product.
Why Build vs Buy Matters Now
Every CISO with a competent platform team has had this meeting. AI agents are deploying across the estate — Cursor and Claude Desktop on developer laptops, Microsoft 365 Copilot in finance, local MCP servers wiring models into source trees — and someone senior says the tempting sentence: “We have a platform team. eBPF exists. How hard can it be?”
It’s a fair question, and it deserves a quantitative answer rather than a vendor’s reflexive no. So here is the mark-to-market on the in-house position.
| Input | Value |
|---|---|
| Shadow share of enterprise agent estates (Ospiri published research) | 88% |
| Incremental incident cost when agents are involved (Ospiri published research) | +$670K |
| Window before agent governance is table stakes (Ospiri published research) | 12–18 months |
| Realistic in-house timeline to production-grade kernel enforcement | ~3 engineer-years |
The asymmetry is the story. The risk is compounding on a 12–18 month clock, and the build option doesn’t pay out until well after the window closes. That’s not a build-vs-buy debate; that’s a duration mismatch.
The Easy Parts Are Commodity, the Hard Parts Are the Product
When a platform team scopes this project, the first sprint plan always looks achievable — because the visible surface of an agent firewall is genuinely commodity engineering. The trouble is that the demo-able 20% of the product is roughly 5% of the work.
| Component | Looks like | Actually is |
|---|---|---|
| Inventory dashboard | A weekend of Grafana | Commodity — buy or build, doesn’t matter |
| SIEM/Splunk connectors | A REST integration | Commodity — days of work |
| Process telemetry | “eBPF exists” | Linux-only; your agents live on macOS and Windows laptops |
| Signed Windows kernel driver | A driver | WHQL signing, ETW pipelines, crash-loop insurance for a fleet |
| Inline enforcement | An if-statement | Block/sandbox decisions in-line, at machine speed, that never blue-screen an endpoint |
| Verdict currency | A blocklist | A standing threat-research feed: new agents, new MCP servers, new skills files, weekly |
The first two rows are why the internal estimate comes in at two quarters. The last four rows are why the honest estimate is three engineer-years — and why the security market prices kernel-level enforcement as a product category rather than a feature.
Where the Three Years Actually Go
Let’s step back and itemize the position, because the cost isn’t one big line — it’s four compounding ones.
- The driver itself. A signed Windows kernel driver plus a macOS endpoint extension is 12–18 months of specialized systems work before the first policy fires. This is the same class of engineering that EDR vendors — CrowdStrike, SentinelOne, Defender — staff with dedicated kernel teams, because one bad update bricks a fleet and the July 2024 CrowdStrike outage showed the whole market what that failure mode costs.
- The classifier regression treadmill. Deciding “this process is an AI agent acting outside policy” is a classification problem, and every false positive that blocks a legitimate build pipeline burns political capital. Tuning that classifier against regression is a permanent workload, not a milestone.
- The verdict feed. New agents, renamed binaries, and over-permissioned MCP servers ship weekly. Without a standing research pipeline keeping verdicts current, your enforcement layer is a snapshot that starts decaying the day it ships.
- The opportunity cost. Three engineer-years spent reaching visibility-only is three engineer-years not spent on the roadmap your platform team was hired for — while agents deploy across the enterprise this quarter, not in 2029.
The Opportunity-Cost Formula
The build decision should be priced the way a desk prices any position — expected carry against expected drawdown:
Build Cost = (Engineer-Years × Loaded Cost) + (Exposure Window × Incident Probability × Incident Severity)
| Factor | In-house build | Buy the substrate |
|---|---|---|
| Engineer-years to enforcement | ~3 | ~0 (integration weeks) |
| Exposure window (ungoverned) | 24–36 months | Weeks |
| Incident severity carry | +$670K incremental per incident | Bounded by enforcement |
| Maintenance tail | Permanent internal team | Vendor’s problem |
The second term dominates. Even a conservative incident probability, held open for an extra two years across an estate where roughly nine in ten agents are unsanctioned, swamps whatever license fee you were negotiating against.
The Sane Split: Build the Content, Buy the Substrate
None of this is an argument for outsourcing your judgment. It’s an argument for splitting the book the same way you already did for EDR — nobody’s platform team writes their own kernel sensor, and everybody’s security team writes their own detections on top of one.
| Layer | Build in-house | Buy |
|---|---|---|
| Enforcement substrate (kernel driver, sandboxing, inline blocking) | — | ✓ |
| Policy content (what your org allows, per team, per data class) | ✓ | — |
| Integrations (SIEM egress, ticketing, identity graph) | ✓ | — |
| Verdict/reputation feed for agents, skills, MCP servers | — | ✓ |
Your team owns the governance logic — the policies that encode how your business actually works. The vendor owns the part that can blue-screen a laptop. That division survives SOC 2 and NIST AI RMF audits, and it survives your best kernel engineer resigning.
What CISOs Should Do This Quarter
| Step | Action | Output | Effort |
|---|---|---|---|
| 1 | Price the in-house option honestly: engineer-years, loaded cost, exposure window | A build TCO memo the CFO can read | 1 week |
| 2 | Inventory the estate before debating control of it | Ranked agent inventory with shadow share | 1–2 weeks |
| 3 | Pilot bought enforcement on one high-exposure team | Live block/sandbox evidence from your own fleet | 2–4 weeks |
| 4 | Assign policy authorship in-house | Org-specific policy set riding the bought substrate | Ongoing |
The Bottom Line
Building your own agent governance stack is a three-engineer-year position against a risk that compounds on a 12–18 month clock — a duration mismatch no desk would hold. The dashboards and connectors your team can build in a quarter are commodity; the signed kernel driver, the false-positive regression discipline, and the standing verdict feed are the product, and they’re why this is a category and not a feature. Split the book: author policy and integrations in-house, buy the enforcement substrate — the same call you already made when you chose an EDR vendor instead of writing a sensor. If your team is sizing this for next quarter’s budget cycle, request a working session. We will walk through your environment, price the build option against your actual estate, and scope a deployment. 90 minutes.