Value Intelligence: Connecting agent spend to security, the work, and value it returns
What do agents cost and deliver? Spend tied to the work agents perform, the value it returns and the risk security teams manage.
The first wave of AI programs was measured by adoption, so the goal was to get as many people as possible working with agents, and the bill grew alongside that success. Leaders now want to know what that spend is buying, yet most spend reports break the bill down only by model, platform or invoice line, which shows the total without the work behind it.
Graeme Cantu-Park, CISO and CIO at Matillion, saw this shift first-hand. His team could tell each department how much it was spending on AI, but not which use cases sat behind those numbers, so growing budgets came without context or measurable outcomes. With Geordie, they can now see use cases by department, business unit and individual user, with costs mapped to the work delivered, and that granularity surfaced thousands of dollars in monthly spend that could run on alternative models. As he put it, the leadership conversation moved “from getting everyone to use AI to what value we’re getting from it.”
Value Intelligence was built for exactly this problem, connecting the cost of each session to the work it served and to the teams and people responsible, so leaders can make informed decisions about investment, coaching and optimization. Because it runs on the same understanding of every agent that powers Geordie’s risk intelligence, it also gives security teams a richer picture of the agent activity they are already responsible for.
What: Spend tied to the work agents perform
Value Intelligence is designed for security and AI leaders, finance teams, and operational managers implementing and measuring agent performance. Operating alongside risk intelligence, it forms a core component of Geordie’s intelligence layer. Built upon Cost Intelligence (launched in September), Value Intelligence expands visibility into operational outputs by combining:
- Spend by use case: Cost and activity tracked against your business’s focuses, categorized using your organization’s internal taxonomy.
- Spend by owner and agent: Broken down by team, user, model, or individual agent across platforms.
- Early waste detection: Identification of excess token consumption, oversized model selection, idle agents, and rate limit constraints, attributed directly to system owners.
In the previous post, we described the behavioral activity record Geordie keeps for every agent session at runtime. Value Intelligence leverages the same underlying capability, eliminating the need for additional setup or deployment.
How: From agent activity to spend you can act on
Geordie’s intelligence architecture provides comprehensive oversight based on a unified model of agent operations: capturing agent identity, integrations, and session activities. While risk intelligence evaluates potential operational hazards, Value Intelligence quantifies delivered output tied to financial cost.
The value attribution workflow follows four core steps:
- Collect at the source. Geordie reads activity where agents run, so there’s nothing new to deploy. For each session it records the tokens used, split into input, output, cache reads, cache writes and reasoning.
- Attribute to the work. Each session is tied to the agent, its owner and the use case behind it, then rolled up by the team and organization unit from the company directory. The use case catalog is built automatically from the organization’s own recent activity, and a session that doesn’t fit any of them is left Unclassified instead of guessed.
- Price with confidence. Geordie prices each kind of token at its own rate for the model that used it, so the number reflects how the work actually ran, including what caching saved and what each choice of model cost.
- Act on what you find. Efficiency detections reach the owners behind them with guidance, and a dedicated cost management role, gives finance and AI leads this view without wider platform access. Beam shapes agent behavior at runtime, and this quarter it’ll add in-the-moment enforcement of approved model policies, so agents run only on the models an organization has approved.
Why: Understand the context behind every action, and the cost behind every outcome
Organizations typically track two types of AI metrics: financial spend from invoices and gateways, and adoption metrics such as active seats and login counts. Value Intelligence differs fundamentally from these approaches across three areas:
- Contextual evaluation: Geordie analyzes session context, including execution plans, tool interactions, and output responses. This classifies use cases based on actual task objectives rather than basic application usage.
- Cross-platform unified record: Unlike vendor-specific analytics, Value Intelligence standardizes task classification, ownership, and risk metrics across all connected platforms into a single operational record.
- Value-aligned metrics: As highlighted in our Agent Economics research (based on interviews with over 50 enterprise organizations), relying strictly on token volume can create distorted incentives. Measuring adoption through functional use cases ensures metrics reflect true work output.
Early customers have observed immediate operational impact. A private equity firm identified that 19% of its 30-day estimated AI spend originated from unmanaged personal accounts, which is as much a security finding as a cost one, since that usage sits outside the organization’s data controls. Similarly, a professional services enterprise uncovered thousands in weekly spend tied to an unoptimized execution loop, while team-level reporting identified target areas for enablement and training support.
"There are very few platforms that give you that real holistic view, whether it's from the frontier models' APIs or from the endpoints themselves. Having value, cost, risk and security all tied together in one platform makes Geordie a really powerful tool."
What this means for security teams
Security teams were the first to ask what agents are doing across the organization and for most of them Geordie started as a way to discover agents, understand their posture and catch risky behavior at runtime. Value Intelligence builds on that same understanding, which means the trace a security team already uses to investigate an agent now also shows the work the agent was doing and what that work cost. A credential usage alert for example reads very differently when the session belongs to a revenue-critical use case versus when it belongs to a test account nobody touched for weeks. This context makes risk decisions more proportionate, since teams can judge what’s acceptable for a given business activity based on how much it matters to the business.
It also changes the role security plays in the wider conversation about AI. The same platform that answers the security team’s questions now answers the ones finance, AI leaders and business owners are asking, so security can be the team that brings this intelligence to the business, sharing spend and use case views with an AI council or with people managers, while the risk picture stays connected to it. One early customer is already working this way, with AI operations and security operating in tandem and preparing to open usage views to an internal AI council that represents every business unit.
Evaluation: Questions to ask about any measure of AI value
Ahead of your next AI budget review, consider evaluating internal dashboards or third-party monitoring tools against these essential questions:
- Can the platform categorize historical AI spend by specific internal business functions and use cases?
- Does visibility cover all agent environments (including local developer workflows), or is tracking restricted to specific API gateways?
- Are adoption metrics derived from actual task execution rather than raw token counts or active login seats?
- Does the reporting clearly surface unclassified activity and unrated models rather than aggregating incomplete data?
- Can system policies enforce optimization rules at runtime without disrupting ongoing operations?
- Is session telemetry unified across both financial valuation and security risk assessments, so security teams can weigh risk against the business value of the work?
Teams that want to see what their agent spend is delivering can get in touch through geordie.ai.
