The playbook for a security product is so settled that nobody bothers to argue it anymore: start with visibility. Deploy read-only. Show the CISO the risks he didn't know existed, land on insight, expand into control. Every vendor deck in the industry has this arc.

This week, in a room of CISOs and security veterans we convened, a 25-year operator killed the playbook in two sentences: "I'm tired of buying visibility tools. If your tool tells me here are all the problems and doesn't propose a better way to do it, that is a waste of my time and money."

Nobody in the room pushed back. And the reason nobody pushed back matters, because it's the same reason the insider threat model is about to split in two.

Why visibility stopped being a product

It's worth being precise about the mechanism. Visibility tools made sense when seeing was expensive: it took real engineering to inventory an environment, so the inventory itself was worth paying for. That's over. What a visibility tool produces today is a list of liabilities, and a list of liabilities is not an asset. It's unfunded work. The scarce thing was never the finding. It was the capacity to fix.

Nowhere is this more true than in human risk. Every security team already knows its people click things. A dashboard that scores employees on how likely they are to click adds a number to a problem everyone already believed in. The product is not the score. The product is what changes behavior: the simulation that finds the weak point, the training built from your own incidents rather than a generic library, the intervention that arrives before the click rather than the report that arrives after.

We ran a multi-turn SMS phishing campaign with a large customer. Three insider risk hits surfaced within hours of launch. That number, on its own, is a finding. What the security team actually bought was everything that happened next: the specific people, the specific pretexts that worked on them, and a remediation path built from that evidence. Visibility was the exhaust. Action was the product.

The column that's forming next to your people

Here's what's changing underneath that. The insider threat model, human risk's home turf, is splitting into two columns.

A security leader at one of the largest travel companies put it plainly this week: his team's attention is going to five new AI standards while thirty traditional policies sit six months stale. Agent-to-agent workflows are emerging where no human invokes anything. Agents carry the biases of their creators, the model labs' training decisions, not just the habits of the employee who deployed them. That's an insider class with no badge, no manager, and no security awareness training on its calendar.

The board question is moving the same direction. The security leaders we sat with described it shifting from "what are you doing with AI?" to "how are you protecting us from agentic risk?" The first question is about adoption. The second is about insiders that don't badge in.

The comfortable response is to treat agent risk as a derivative: score the human, and let every agent they touch inherit that score. That works exactly as long as a human is in the loop, and the loop is open. But read the split carefully, because it is not a story about human risk becoming legacy. Humans remain spectacularly phishable; our SMS campaign is proof from this quarter, not last decade. The point is that the two columns need the same discipline applied with different instruments, and the discipline is the one the CISO in our conversation this week demanded: don't show me the risk, change it.

Where this goes

This is the thesis we're building Cimento around. Human risk was never a dashboard category; it's a behavior-change category, and the companies that treat it that way are the ones whose boards stop asking about it twice a year. The same muscle: simulate, find the weak point, fix it, prove it, is exactly what the agent column will demand, because you cannot send an agent to training and you cannot rely on it getting suspicious.

The narrow version: audit your Human Risk program this quarter and ask two questions. For the human column, which of your controls acts rather than observes? For the agent column, which of your controls can see it at all? If the honest answers are "few" and "none," that's not a gap in your tooling.