Let’s keep this simple

There are two ways to roll out agentic automation.

1. Build and run a stack of VDI or DaaS, agents, and extra tools.
2. Deliver apps through a secure workspace in the browser where users and vision AI agents follow the same rules.

This post helps you explain the difference in clear, practical terms.

Let’s be clear on scope

When we say “infrastructure heavy,” we mean more than VDI or bot VMs. Traditional RPA stacks add orchestrators, desktop or unattended runners, OCR add-ons, and test tooling, plus the people time to keep all of it alive. We compare that to a browser-delivered workspace where users and vision agents share one enforcement boundary.

What each path really feels like

Infra heavy: you manage images, tune pools, keep certificates updated, bolt on DLP and recordings, and juggle tickets from three teams. It can work. It also eats time.

Browser delivered: you stream the apps into a secure session that runs in a browser. The same policies apply to users and agents. Fewer moving parts, fewer surprises.

What finance actually wants to hear

They’re listening for three things. Hit these and you’re most of the way there.

• What you buy and keep alive. VDI or not. Agents or not. RPA licenses and orchestrators or not. Extra DLP and recording tools or not. Desktop/unattended bot runners, OCR and computer vision add-ons, test tools, extra DLP and recording tools—or a single platform subscription that covers sessions for users and vision agents.
• How many people hours it takes. Image and VM care, bot break/fix, patching, device logistics, and cross-tool policy work versus one place to manage sessions and policies.
• How fast you get value. Time to first workflow. Time to scale from 10 to 100. What you didn’t have to build or license to get there.

Line items to call out in conversations

RPA + infra-heavy model:

• RPA platform licenses (design, orchestrator, desktop or unattended runners)
• Computer vision or OCR add-ons and test tooling
• VDI or DaaS capacity, gold images, bot VM pools
• Endpoint agents, proxies, certificates
• Separate DLP and recording tools
• Ongoing bot maintenance (selector fixes, packaging, retries)
• Support and change-management across systems

 Browser-delivered workspace with vision agents:

• Platform subscription
• Identity and SSO already in place
• No VDI, no device deployments, no proxies
• DLP and recordings at the session for users and agents
• Lower support load due to fewer moving parts

Tell it with four quick stories

Pilot that stalls: five automations prove value, then image updates, VM pools, and DLP add-ons slow everything down. Six months later you’re at ten.

Clean rollout: apps are streamed to a secure browser workspace, first agent runs with the same policy as users. No device deployments. Security signs off because sessions are recorded and data controls are on. Three months later you’re at fifty.

The bot treadmill: the team renews RPA seats, orchestrator HA, and OCR even though most new flows click UIs where no API exists. Moving those flows into the browser workspace cuts tools and reduces break/fix time.

Audit call: with agents you chase logs across systems. With browser sessions you open the recording, search for the event, and answer on the call.

The hidden costs that flip decisions

• Idle VM capacity that sits around "just in case".
• Gold image drift that steals senior engineer time.
• Proxy chains and certs that generate tickets.
• RPA license floors and “starter packs” you don’t fully use.
• Bot runner sprawl and high-availability pairs for orchestrators.
• Duplicate tools for bots and for people.
• Incident hours spent stitching logs together.
• Shipping devices to short-term contractors.
• Change control for automations that live outside IT.

How time to value really changes

Think in phases, not formulas.

• Week 1 to 2: connect identity, publish a first app to the browser workspace, run one workflow with a human in the loop.
• Weeks 3 to 6: turn on recordings, lock down clipboard and downloads, move to unattended where risk allows.
• Quarter 2: scale. With no VDI or device rollout, the work shifts to picking good workflows and setting guardrails, not buying hardware.

One slide your CFO will appreciate

• Automations live by quarter (simple line).
• Mean time to first automation (before and after).
• Support tickets per 100 automations (trend down).
• Time to answer "who did what, when" (trend down).
• What we stopped buying: VDI capacity, bot VM pools, RPA orchestrator HA, OCR add-ons, separate DLP/recording tools.

Common objections, straight answers

“We already pay for VDI.”
Use the browser workspace for new automations and external teams. Retire capacity over time as usage shifts.

“What stops data from walking out?”
Clipboard and download controls, watermarks, and step up MFA on sensitive actions. Same rules for users and agents.

“We already have an RPA platform.”

Keep it for API-first or system-level automations. Use the browser workspace for UI-driven flows and vision agents where APIs don’t exist. You reduce runner sprawl and license floors while keeping one policy model.

“Will Audit get evidence?”
Yes. Provide a session recording and an event export. Agree on retention up front.

“Our devs want APIs.”
Use APIs when they exist. Use vision agents where they don’t. Keep the same security model either way.

Bottom line

The expensive part isn’t always the license. It’s the time and overlap from running one stack for people and another for bots. Put users and agents in the same secure browser session and you cut parts, cut tickets, and speed up the path from idea to production. Explore the solution.