Why Wood Partners Chose Geordie for Its Multi-Vendor Agentic Operations
Wood Partners gives every employee access to AI across multiple agent platforms, governing them from a single view with Geordie. The result: a 98% accurate inventory across platforms, critical risks enforced before they appear, and a technology team that can expand agent adoption with confidence.
- 98%
- inventory accuracy in a single view across platforms
- 100%
- of critical risks covered by Beam policies in enforce mode
- 0
- blockers to employee work reported since enforcement began
- ~1 day
- from customer feedback to shipped product change
Overview
Wood Partners is a national multifamily real estate company based in Atlanta that develops, builds and owns apartment communities across the US.
Adapting to the agentic era
Wood Partners' leadership wanted AI in every employee's hands, but agents raised harder questions: what they do, and what happens if one goes wrong. The company chose a measured path: AI for everyone, with agentic use expanding as the controls to support it matured. Jacob Sweat, VP of Technology, approached agents the way he would new employees: capable and always on, but only as safe as the access and oversight they're given.
That move surfaced a structural gap. Wood Partners' AI program runs across several platforms. Each platform showed the team its own environment, and each defined an agent differently. None of them showed the whole estate.
Wood Partners brought in Geordie to see every agent in one place. Over time, that visibility grew into a risk framework the team relies on and Beam controls that stop critical risks before they reach the environment.
Today, Wood Partners has a governance layer it trusts across its full agent estate, and is working toward opening agent building to employees across the business.
The challenge: a multi-vendor program with no unified oversight
Wood Partners had already taken a measured approach to AI, consolidating employees onto two sanctioned platforms and running enterprise endpoint security and a full productivity suite across the organization. The existing security stack could see individual signals, connections made, resources accessed, users involved, but nothing that pulled those signals together into a coherent picture of what their agents were actually doing, what they were connected to, and what risk they carried.
Jacob framed agent risk in familiar terms.
Consider an agent an employee. If you wouldn't give an employee access to delete a database, you shouldn't give an agent access to delete a database. Treat them as employees, just very limited employees that work 24/7 and can very quickly make mistakes.
Applying that principle required knowing what agents existed. An inventory is the foundation for everything else in security: you can't measure, evaluate or control what you can't see. That was where the existing picture fell short. Each platform offered its own view, and endpoint and network tools each held fragments. The team knew MCP servers and tools were in use, but there was no single inventory, and building one by hand would never keep pace.
Wood Partners feeds its agent platforms into Geordie, which handles discovery and classification. Every agent now sits in one inventory, along with the MCP servers, knowledge bases and connectors it uses. That level of detail would be hard to track consistently any other way.
It solidified our view of what's in the environment and confirmed what we had suspected, while also providing us assurance that our other technical controls are functioning.
Visibility alone would not be enough. At an industry conference, Jacob heard a principle that shaped his thinking: manage the risk agents introduce, rather than counting the agents themselves.
The team needed to answer a set of questions across the whole estate. What agents exist, and who owns them? What are they connected to? What are they doing? And which of the risks they introduce matter most?
The solution: moving from inventory to controls
Much of the market Wood Partners evaluated approached AI as a compliance category. The team was looking for something operational.
Geordie was one of the first platforms we saw that approached the problem from an agent-centric, operational perspective instead of treating AI as just another application or compliance category.
For the first time, the team had evidence rather than estimates. Wood Partners had restricted employees to two sanctioned platforms and enforced that through its existing security stack. Geordie confirmed the policy was holding: no unsanctioned AI tools were running, and no data was flowing to them. It also surfaced more agents than expected on one platform, turning a rough sense of the estate into a precise one.
We'd rather not wait to see a risk exploited and then take action. If Geordie classifies something as critical, we've already blocked it. We're controlling for those risks before they're ever in the environment.
Geordie's risk framework as the foundation
Once the inventory was in place, the question of which risks matter most became the priority. Wood Partners aligns its program to industry best practice, starting with NIST. But broad frameworks don't say which agentic risks matter today, and new ones were appearing week by week, faster than any in-house team could track them.
It made it a lot easier to ingest the data and then action it, and that's the important part. Geordie is able to give me the information I want.
Wood Partners made Geordie's AI risk framework the foundation of its risk program. The framework defines each risk, how to find it and how serious it is, and maps each one to NIST, OWASP and ISO. Jacob now spends most of his time in NIST or the Geordie framework. The framework sets the team's priorities and underpins every enforcement decision that follows.
The field is moving so fast, week by week. From an AI risk perspective, we lean on Geordie. We hand it to Geordie to say, here's what is important that you need to be looking at.
Inline remediation in enforce mode, from the start
That framework gave the team the confidence to act early. Before turning on enforcement, they spot-checked every critical classification and ran deep-dive evaluations on several. Each held up, whether it was actively exploited in the wild, tied to a zero-day or an easy exploit with a high blast radius.
We did an independent evaluation of several of the critical risks and came to the same conclusion. We would block this type of attack, this category, even if Geordie didn't label it as a critical.
Wood Partners now runs Beam in enforce mode on every risk Geordie classifies as critical, including vulnerable MCP servers, recently disclosed wormable AI vulnerabilities and recursive deletes. Policy packs let the team deploy sets of policies at once.
Since enforcement began, no one has reported a blocker to their work.
Across the deployment, Geordie delivered
- Vendor-agnostic discovery and a single inventory across agent platforms and local AI tools
- Mapping of the MCP servers, knowledge bases and connectors each agent uses
- A built-in AI risk framework mapped to NIST, OWASP and ISO
- Beam policies enforcing against critical risks before they appear
- Cost intelligence that connects agent spend back to the agents driving it
Why Geordie over the alternatives
Wood Partners chose Geordie because it was built around agents and how they operate. As the program grew, two more reasons became clear.
Built for a multi-vendor reality
Each platform governs its own agents. Wood Partners' program spans several.
So long as we have a multi-vendor agent setup, I feel like we're always going to need some kind of visibility tool. It goes back to being able to see the risk across our entire estate, which no other single tool is able to do at the moment.
A team that moves with the field
Agentic AI changes week by week, and Wood Partners needed a partner that could keep up. During the evaluation, the team watched Geordie ship new functionality that addressed gaps as fast as agent platforms introduced them. That pace has continued since deployment. Improvements the team asked for, including cost intelligence, better inventory views and policy packs, arrived in days or weeks rather than being scheduled for a future quarter.
It's rare to feel like you're actively influencing the product roadmap. With Geordie, we've had multiple examples where feedback from our team translated directly into shipped functionality.
The impact: from fragmented visibility to operationalized governance
- One trusted view of the agent estate Manual reviews, platform-by-platform exports and detective work gave way to a single inventory the team trusts and can report from.
- Technical validation of the program Geordie gave Wood Partners evidence that its approach was working and that the risks it had worried about were under control.
- Governance built into operations Geordie became part of Wood Partners' operational control framework rather than a dashboard checked from time to time. That has changed how the technology team approaches new agent use cases.
Geordie gives us that ability to validate that the risk we were afraid of isn't there. Not peace of mind, but, hey, what we're doing is actually working.
The visibility and control Geordie created made me much more comfortable supporting broader adoption across the business.
Looking ahead
Wood Partners' next step is to open agent building to employees across the business.
I'd like to get to a point where everybody's building their own agents, and Geordie would be the key tool around managing that risk and making sure those agents aren't going off the rails.
Along the way, Wood Partners plans to work with Geordie on agent approval, governance in production and the reporting leadership will use to measure success. Within twelve months, Jacob wants agent usage to be unremarkable: simply part of how people work.
The product is good. The partnership is better. If you're evaluating agent governance, you're probably operating in a space where best practices are still being written. Having a vendor that's willing to learn alongside customers and adjust quickly is worth more than any individual feature.
Take control of AI agent uncertainty
Get a single source of truth for every autonomous agent your organization runs.
“We're seeing the iceberg that rocked the Titanic — weeks in advance rather than the moment it appears on screen. We're able to take a snapshot of the entire ecosystem and have adult, grown-up conversations about what's responsible and what's not. We can quantify everything now.”
