Sunny Rao, SVP of APAC at JFrog
Anyone who has spent 10 minutes pressing “0” to escape a voice bot knows how the last automation wave ended. Call centres were promised dramatic savings from IVRs and chatbots. Customers got phone trees that went in circles, and companies got a fresh layer of complaints to manage.
Sunny Rao sold that promise from the inside. Before becoming SVP of APAC at JFrog, he spent years at Avaya, Genesys and Nuance, three firms that defined the contact-centre automation era. Now he is watching Southeast Asia fall for AI agents, and he thinks the region risks repeating an old mistake: confusing a faster task with a more productive business.
Also Read: Singaporean founders’ Lightsage bags US$4M to decode how AI agents choose software
“An agent completing a task faster does not necessarily translate into greater productivity, particularly if it creates additional review, remediation or security work downstream,” he tells e27 in an email interview.
The adoption-readiness gap
The enthusiasm is not in doubt. A recent Agoda AI Developer Report found that 53 per cent of developers in the region say agents are already in production or broad use. Only 38 per cent believe their codebase is ready for that autonomy, a readiness gap e27 has examined before, and one that explains why regional tech leaders are learning to trust agents, but not with production.
Rao, who speaks regularly with CIOs in Singapore, Jakarta and Bangkok, frames the problem as one of control rather than capability. Coding agents now select dependencies, pull tools, modify code and interact with enterprise systems at machine speed. A company may know an agent is running without knowing what it consumed, which permissions it used or whether its actions complied with policy.
“The real readiness test is not whether an enterprise can deploy autonomous agents, but whether it can detect and control unintended actions before they become business risks,” he says. The worry has only sharpened since OpenAI shelved GPT-6.1 Astra, a model built to handle complex tasks with less human supervision.
Tokens are the wrong yardstick
Most companies still measure AI spend in seats or tokens. Rao thinks both miss the point. If a CFO could track one number, he would pick cost per successful, production-ready outcome.
The logic is simple arithmetic. An agent that is cheap to run but needs repeated prompting, produces unusable work or creates hours of human clean-up may cost more than a pricier one that gets it right first time. Tokens and licences are inputs, not value, a point that echoes e27‘s look at the hidden economics of autonomous AI agents.
Also Read: Agentic AI ambitions in Singapore run into legacy systems and data quality gaps
Take a pull request an agent writes in two minutes that a senior engineer then spends 45 minutes fixing. For software teams, Rao says, the better measure is Mean Time to Release, how long code takes to reach production, weighed against the company’s overall security posture. Code that introduces vulnerabilities or regressions can delay a release rather than speed it up.
In regulated industries, checks once run after deployment are becoming mandatory release gates, and two-minute code that cannot clear them is worth little.
The blind spot: what agents eat
Ask Rao where APAC enterprises are most exposed, and he points not at access but at consumption. Access is increasingly treated as an identity and permissions problem, which security teams broadly understand. Less visible is what agents pull in to finish a job: open-source packages, MCP servers (connectors built on the Model Context Protocol that plug agents into tools and data), skills and plugins. Any of these can carry vulnerabilities or malicious code into enterprise infrastructure before anyone notices.
“The critical control point is where an agent consumes a component,” he says.
When that control fails, the blame does not get diluted. If an agent pulls a compromised MCP server into production at a fintech regulated by the Monetary Authority of Singapore, Rao says the institution deploying it remains accountable, not the model provider or the governance vendor. That means being able to reconstruct which agent acted, under whose authority, what it consumed and why it was allowed. Many firms cannot do that yet: a Sumsub study found Singapore companies’ AI audit trails remain thin.
The vendor in the room
There is an obvious catch. JFrog sells exactly the controls Rao describes, through its MCP Registry, AI Catalog and Agent Guard. “Agents are risky, so buy our governance” is a convenient story for a vendor to tell.
Rao’s defence is that headcount no longer tracks risk. A 30-person startup running agents may operate workflows once associated with a far larger engineering team. If it builds for a bank or insurer, it inherits that client’s security and regulatory demands regardless of size. He concedes startups do not need bank-grade architecture, but argues the minimum, verifying what agents consume, limiting permissions and keeping evidence of how software was built and approved, becomes a commercial requirement long before any breach.
Pricing is harder to pin down. JFrog does not publish list prices for AI Catalog or Agent Guard; Rao says they are integrated capabilities within the JFrog Platform, not standalone products. That may be so, but it leaves buyers calculating governance ROI without a visible line item, an awkward gap for a company urging CFOs to measure cost per outcome.
JFrog is not alone in this race. Sonatype and Snyk have long pitched software supply chain security, and Snyk bought agent-security startup Invariant Labs in 2025. GitHub and Docker run their own MCP catalogues inside platforms developers already live in. For Southeast Asian teams, the question is less whether to govern agents than whose platform gets to hold the keys.
Singapore’s next exam
Rao expects Singapore to get agent governance right first, citing its regulatory track record and concentration of multinationals in regulated sectors. JFrog’s own 2026 Software Supply Chain State of the Union research found 71 per cent of Singapore respondents carefully review AI-suggested security fixes, the highest of eight markets surveyed.
Also Read: SEA’s insurers face a new question: what happens when customers have agents?
The same data shows the cracks. Some 18 per cent have policies against unauthorised AI tools but no way to detect violations, and 59 per cent wait a week or more for open-source package approvals. That is fertile ground for Shadow AI, employees quietly bringing in tools without IT’s knowledge, which Rao says worries organisations more than any rush to hand agents critical decisions. The one call he would keep with humans: which sensitive systems an agent may touch, and how far its permissions stretch.
The lesson from the IVR years still holds. Automation that merely made old processes cheaper disappointed; automation that rethought them paid off. Singapore’s next test, Rao says, is turning governance rules into automated enforcement inside developer workflows. Until then, the agent that writes code in two minutes may still be the slowest route to production.
The post Tokens are the wrong yardstick for AI agents, says JFrog’s Sunny Rao appeared first on e27.