True cost of ungoverned AI: Trellix CISO report reveals $2.4M insider risk

AI agents now operate inside enterprise trust boundaries at machine speed, but most organizations cannot see or govern them.

CISOs face a new class of insider: autonomous systems and AI agents with privileged access and no equivalent governance. A new Trellix study of 600 security leaders quantifies the exposure: AI actions account for 28% of insider incidents, detection and response takes 15 hours on average, and each incident costs organizations $2.4 million. Softprom is the official distributor of Trellix.

What was announced

Trellix published Mind of the CISO: The New Insider, a global survey of 600 CISOs across the Americas, EMEA and APAC conducted by Vanson Bourne. Alongside the report, Trellix launched Trellix Wise for Private Cloud, an AI core for the agentic SOC that runs entirely within the customer environment.

Key findings from the report:

• 95% of organizations experienced an insider incident linked to AI or autonomous system actions in the past 12 months.
• 28% of all insider-related incidents are driven by AI actions on average.
• $2.4M is the average cost of insider risk incidents.
• 15 hours average time to detect and respond to insider-related incidents.
• 74% of CISOs agree AI tools introduce risks traditional controls were not built for.

A 15-hour detection-to-response window is not just a gap; it is an open invitation. When AI agents operate inside your trusted boundary at machine speed, resilient organizations will govern them like the privileged identities they are, while building an agentic SOC to respond at the speed of the threat.

Why this matters

For CIOs, CISOs and procurement leaders, the data reframes insider risk. 78% of organizations now include AI agents, autonomous systems and machine identities in their insider risk definition, and 42% rank this as the top security priority for the next 12 to 24 months. Yet only 48% have a fully implemented insider risk strategy.

The visibility gap is structural: 63% of CISOs say they lack sufficient visibility into employee AI use, and 99% want to improve visibility across users, devices and environments. Meanwhile, 79% expect to be targeted by an AI-assisted attack exploiting trusted identities within the next year, and 91% of CISOs report that personal accountability for insider risk has grown over the last 12 months.

Technical details

• Survey scope: 600 CISOs across the Americas, Europe, Middle East and Asia Pacific.
• Industries: finance, public sector, healthcare, manufacturing, energy, oil, gas and utilities.
• Trellix Wise for Private Cloud: AI core for the agentic SOC deployed inside the customer environment, keeping data under organizational control.
• Adoption barriers addressed: unpredictable costs, loss of data control, lack of AI decision transparency.
• Impact categories reported: data loss (56%), operational disruption (49%), compliance or legal violations (48%), reputational damage (46%).
• Defense direction: 99% of CISOs agree AI and automation will be essential for managing insider risk over 12 to 24 months.

FAQ

What is the average cost of an AI-driven insider incident?

$2.4 million on average per organization, according to the Trellix survey of 600 CISOs. Additional impacts include data loss, downtime, compliance violations and reputational damage.

How fast should SOC teams respond to AI-driven insider threats?

Faster than the current 15-hour industry average. Trellix recommends an agentic SOC model that responds at machine speed rather than human workflow speed to close the detection and response gap.

What does Trellix Wise for Private Cloud deliver?

It delivers the AI core for an agentic SOC deployed entirely within the customer environment. It scales SOC capacity while keeping data under organizational control and providing AI decision transparency.

Softprom and Trellix

Softprom is the official distributor of Trellix. Our team supports partners and enterprise customers with licensing, technical enablement and deployment of Trellix XDR, insider risk and agentic SOC solutions.

Prepared by the Softprom editorial team based on vendor materials (Softprom DistriFlow). Source: original article.