AI systems drive insider risk incidents in most organizations
October 20, 2026 · 2 min read
Also published in Nederlands
Artificial intelligence systems are causing security incidents in the majority of organizations, according to a survey of 600 Chief Information Security Officers and equivalent professionals across the Americas, Europe, the Middle East, and Asia-Pacific. The study, conducted by Vanson Bourne, found that 95% of respondents recorded at least one incident linked to AI or autonomous system actions in the past 12 months. These events accounted for an average of 28% of episodes associated with insider risks.
The report, titled Mind of the CISO: The New Insider, states that the average cost per incident caused by internal agents is 2.4 million US dollars. Among the surveyed organizations, 56% reported data loss, 49% experienced operational disruptions, and 48% faced regulatory or legal violations. The average time to detect an insider risk episode is seven hours, with an additional eight hours required for response. David Soto, Chief Information Security Officer at Trellix, described this 15-hour interval as an open invitation rather than a mere gap.
Visibility into AI tool usage remains limited, as 63% of security leaders believe their organizations do not sufficiently monitor how employees use these resources. Meanwhile, 99% acknowledge the need to expand monitoring of users, devices, and environments linked to insider risks. Additionally, 78% already include AI agents, autonomous systems, and machine identities in their definition of insider risk.
To support defense at machine speed, Trellix released Trellix Wise for Private Cloud, a local AI core for Security Operations Centers based on agents. This solution operates in local, physically isolated, hybrid, and private cloud environments, connecting telemetry from AI agents and traditional sources without requiring a new data lake. It aims to investigate 100% of alerts and provide auditable conclusions. The report indicates that 99% of Chief Information Security Officers consider AI and automation necessary for managing insider risks in the next 12 to 24 months, while 41% plan to prioritize investments in AI-related detection and response during that period. Rodrigo Buosi, country manager for Trellix in Brazil, stated that organizations must leverage AI speed without losing visibility into their environments.