Trellix Research Reveals the True Cost of Ungoverned AI

New Trellix Mind of the CISO report reveals AI accounts for nearly one-third of all insider incidents, a 15-hour detection and response gap, and average organizational cost of $2.4M

FRISCO, Texas--(BUSINESS WIRE)--Trellix, a global leader in cyber resilience for the AI era, today announced a new report, Trellix Mind of the CISO: The New Insider, which finds AI and autonomous systems as the new insider threat vector, with 74% of CISOs agreeing the use of AI tools introduces risks traditional security controls are not designed to address. The result is a growing gap between the operational speed of AI within enterprise environments and how quickly organizations can detect and respond to the risks it introduces, driving a fundamental shift toward autonomous, agentic SOC capabilities to close it.

"A 15-hour detection-to-response window isn’t just a gap; it's an open invitation,” said David Soto, Chief Information Security Officer, Trellix. “When AI agents operate inside your trusted boundary at machine speed, the resilient organizations will be the ones governing them like the privileged identities they are, while simultaneously building an agentic SOC to respond at the speed of the threat, not a human workflow.”

Six hundred CISOs and senior security leaders reveal the scale of AI-driven insider risk: Almost all (95%) experienced an insider incident linked to the actions of an AI or autonomous system in the past 12 months, with AI actions accounting for 28% of all insider-related incidents, on average. Insider risk incidents also cost organizations $2.4 million on average, alongside data loss (56%), operational disruption or downtime (49%), compliance or legal violations (48%), and reputational damage or loss of customer trust (46%).

AI has redefined the insider
Seventy-eight percent of organizations now include AI agents, autonomous systems, and machine identities in their definition of insider risk, and 42% report this as the most important security risk to address over the next 12–24 months. Yet half (52%) lack a fully implemented insider risk strategy. The majority (94%) are concerned about the risk of actions taken by AI within their security environments and often operate with limited visibility.

The visibility gap
Sixty-three percent of CISOs say their organization lacks sufficient visibility into how employees use AI tools, and 99% agree they need to improve visibility across users, devices, and environments. On average, organizations take 15 hours to detect and respond to insider-related incidents, a window attackers can exploit. Eighty-three percent of CISOs agree AI is accelerating attackers' ability to discover and exploit vulnerabilities, and 78% agree traditional security controls are becoming less effective against these attacks. Additionally, 79% expect to be targeted by an AI-assisted attack exploiting trusted identities or systems within the next 12 months.

AI is central to machine-speed defense
Organizations need to meet AI-speed threats with AI-speed defense, not adapt yesterday's controls to today's adversary. Nearly all (99%) of CISOs agree AI and automation will be essential to managing insider risk over the next 12 to 24 months, and 41% plan to prioritize investment in AI-related detection and response. At the same time, adopting AI for defense also introduces its own risk, as public cloud models can actively impede a security team's own breach investigation. As AI adoption continues to scale on both sides of the fence, increasing visibility across an organization’s expanding attack surface and closing the threat detection and response gap will be critical to keep pace, while keeping data control and governance front and center. Escalating reports of AI agents escaping sandboxes and autonomously targeting organizations, including government infrastructure, underscore the importance.

Trellix Wise™ for Private Cloud is built for the agentic SOC
Announced today, Trellix Wise for Private Cloud delivers the AI core for an agentic SOC, deployed entirely within a customer's environment. It provides the machine-speed defense needed to close the threat detection and response gap while keeping data fully within an organization’s control. The solution scales SOC capacity while eliminating the three barriers to adoption customers most cite: unpredictable costs, loss of data control, and lack of AI decision transparency.

The CISO's expanding role
As AI reshapes the threat landscape, the growing focus on AI insider risk is also adding to CISOs' responsibilities. Over nine in ten (91%) agree their accountability for insider risk has grown over the past 12 months, and 69% are concerned about personal liability in the event of an incident. Yet nearly three in four (74%) report senior leadership and the board lack a clear understanding of insider risk, leaving CISOs exposed.

Organizations seek support
Sixty-two percent of CISOs agree their organization is not fully prepared to manage the risks associated with AI and autonomous tools. Over two-thirds (68%) report existing policies don't adequately address AI-related risks, and a majority are calling on regulators for clearer frameworks, compliance requirements, and best practices to fill the gap.

“Autonomous agents now operate inside enterprise trust boundaries with access equivalent to privileged human users, and in many cases, without equivalent governance,” said Clayton Romans, Associate Director for Joint Cyber Defense Collaborative, CISA. “Insider threat frameworks provide a strong foundation for managing that risk today, and CISA is actively working across government and private sector partners to build specific guidance to help organizations address many facets of Super Intelligence. The risk is already here; the time for leaders and cyber defenders to act is now.”

To strengthen cyber resilience efforts as agentic AI continues to proliferate across the enterprise, senior leadership must support CISOs on insider risk initiatives, policymakers must work to standardize AI governance frameworks, and organizations must govern AI as a privileged user and implement agentic SOC capabilities to meet the challenges of an AI threat landscape.

Learn more about The Mind of the CISO: The New Insider here.

Additional Resources:

• Trellix Wise for Private Cloud
• The Mind of the CISO: The New Insider: Rethinking Risk in the AI Era
• The Mind of the CISO: The Future of Cyber Resilience
• The Mind of the CISO Series
• Trellix Advanced Research Center

Methodology
Trellix commissioned independent market research agency Vanson Bourne to survey 600 CISOs or equivalent roles across the Americas, Europe, the Middle East, and Asia Pacific to understand how AI is changing how organizations approach insider risk. It examines the visibility and accountability gaps emerging as AI becomes part of daily work, the consequences when trusted access is misused or goes wrong, the growing role AI plays on both sides of the security equation, and what this means for CISOs being asked to manage a broader set of risks. Respondents work across various industries, including finance, public sector, healthcare (public and private), manufacturing, energy, oil, gas, and utilities.

About Trellix
Trellix is a global cybersecurity leader helping organizations build cyber resilience for the AI era. Combining AI-native security, operational threat intelligence, and automated detection and response, Trellix provides defense-grade protection at machine speed across on-premises, air-gapped, operational technology, hybrid, and cloud environments. Trellix helps customers anticipate threats, scale effective security operations, maintain business continuity, and adapt their security posture for the modern threat landscape. More at https://trellix.com.

Follow Trellix on LinkedIn and X.