Runlayer

Fortune featured Runlayer and interviewed our CEO, Andrew Berman, on our latest fundraise, the future of AI enablement, and how Runlayer is the “Switzerland business, a neutral, cross-provider control layer” for the future of agents performing work. Link in the comments.

"How do you deal with agent risk? Get Runlayer." - Jonathan Jaffe, CISO Lemonade I could not sum it up any better. Lemonade came to us with 1700+ employees who wanted to use AI safely. 90 days later, they have full visibility of shadow AI, MCPs, skills, and agents. Their employees have made 300K MCP tool calls. Runlayer has governed every single one of those calls while performing 25M+ security checks. 1,700 employees are now building, sharing, and working with agents. Securely. Be like Jonathan. Enable the business. Lemonade is doing it right.

I've been in ~40 enterprise AI calls in the past 2 weeks, and exactly 0 of them mentioned headcount reduction. All of them mentioned something much more important. How to stop their runaway train of a token bill. It's pretty bad out there, and getting worse. One company told us their token spend is outpacing their AWS bill. Another thinks they're shooting themselves in the foot by relying on one model provider for everything, and paying handsomely for it. There's a mass retooling happening in the enterprise to avoid this. Some of the most effective strategies I've seen (and our customers get to use) aren't telling their employees to stop using AI. They're more "Let's fix things behind the scenes, so employees always get the right, cheapest, most effective path." Concretely: 1. Cadence tuning - adjusting how often an agent runs 2. Model downshifting - moving an agent from a Fable 5-level model to a Sonnet 4.6-level model when it makes sense 3. Tool-surface reduction - giving the agent the right tools, APIs, and context instead of all available tools, APIs, and context 4. Zombie-agent reaping - detecting agents that are stuck, abandoned, looping, or still consuming resources after their useful work has ended 5. Cache accounting - tracking how cached prompts, context, tool results, or model outputs affect cost and performance These strategies all work without making your employees jump through hoops. They're not trivial to do on your own, but they make a huge difference on your token bill. And they do work. Savings I've seen from these: 1. $65K/year from downshifting just one agent to a cheaper model 2. $4,000/year from changing one bot's cadence from every-15-minutes to daily 3. ~$40K/month for agent right-sizing You'd probably see a small change by asking your team to use Sonnet 4.6 more, but to be honest, that's not something they should be thinking about. I don't think you'll see a meaningful impact to your token bill until you do more work behind the scenes, or route your traffic through a platform that does it for you (like Runlayer.)

My prediction: within 18-24 months, every enterprise will have an AI platform team. The same way every enterprise eventually formed a data platform team. 15 years ago there was no cloud infra team. Now every company has one. 10 years ago there was no data platform team. Then all of a sudden you have Databricks and Snowflake, and there's a data platform team. It took a while for these teams to form, as we all realized cloud and data were strategic pillars for any modern company. The AI platform team need will form much quicker. If you asked 50 Fortune 500s today "Where does this all live?" They'd say it lives somewhere between security, IT, or we have no idea. There's too much infrastructure here that has to be controlled, coordinated, aligned. And over the next 18 to 24 months, you're going to see a new function. That's the AI platform team.

How Lemonade Governs Agentic AI

"If a peer comes to ask me how to deal with the agentic risk that we're all seeing the first thing I'd tell him or her is to get Runlayer." - Jonathan Jaffe, CISO at Lemonade Bringing on Runlayer gave Jonathan and his team full visibility of shadow AI, MCPs, skills, and agents across Lemonade without slowing down the business. Over the past 90 days, over 1700 Lemonade employees have made 300K MCP tool calls. Runlayer has governed every single one of those calls while performing 25M+ security checks. "Runlayer has allowed Security to enable the business rather than be a source of friction."

Learn more

We realized that enterprises need help with AI early on, and completely adapted our AI platform's model around it. I probably shouldn't spell this out for the labs to copy, but it's pretty simple. We basically use FDE + secure platform to get this done: 1. We pair an FDE with an AI champion. Every rollout starts by embedding one of our forward-deployed engineers with the person on the team, actually building agents. 2. At the same time, we map what's already running. A discovery scan shows every AI client, MCP, and shadow connector across the company. In almost every org, 3–5 MCPs drive 85%+ of agent traffic, so we know exactly what to build on. 3. They build agents with their team, live. We run working sessions where their team drives. The team builds the agent in a local session (Claude Code, Codex), wires in their connectors, then uses the platform to see what it did, audit the run, and iterate. We end this with a working agent, always. 4. The platform (Runlayer) makes the good agents reusable. Build a skill privately, iterate on it, then share it org-wide and invoke it from Slack. Literally, one person's S-tier workflow becomes everyone's. 5. The platform also optimizes every run. An agent optimizer audits each run for tool usage, prompt quality, and model choice, right-sizing Opus or Fable down to Sonnet where it makes sense. This happens automatically, employees don't need to be micromanaging this. 6. Now (and only now) do we turn controls on. Never as a hard stop: start in alert mode, build the allow-list, flip to enforce once a better path exists. RBAC on every agent, full session visibility, nothing yanked. TL;DR is let the most AI-pilled experts go crazy, give them a platform, and share their agents and expertise with everyone else at the company. Everyone else learns from these experts. Labs don't need 100 million more FDEs to make this happen, but they do need the right platform an enablement to make it safe and easy. Enterprises are full of smart people who don't have a safe and easy path to use AI tools. Enable them, and you have a golden path to AI adoption.

Whenever an AI rollout fails, I can usually point to one thing: there's no owner. Here's how we structure our customer rollouts so ownership isn't a blocker: Agents span security, IT, AI enablement, developer experience, and just about every other team. So basically, you've got a bunch of teams jockeying to understand who has accountability, they escalate to some executive, and 4 meetings later, things have gone nowhere. To prevent this, we define ownership before rollout. What's worked for us: 1. Phase 1 (MCP governance + shadow AI): owned by IT or security. This is a control function. 2. Phase 2 (agents + skills): owned by AI enablement. This is an adoption function. Combine these two phases with granular admin role definitions. Instead of "super admin or not," you can assign specific permissions (MCP management, policy editing, skills management) to different teams. All of this needs to become a document with ONE accountable executive owner, with every component mapped to a team. You have to do this before you start. Otherwise, someone's going to come along and be like "I also want skill management" and now you have to go back and figure out what ownership and management looks like. When we lead with this, we see squabbling drop. Can't recommend it enough if you're in a similar spot.

%FIRSTNAME%, explore relevant opportunities with Runlayer

Visit life