In response, the company is introducing Trellix Wise for Private Cloud, a solution that brings AI into the heart of the organization's security operations center (SOC), without the data ever leaving it.
In recent years, artificial intelligence has gone from a promising technology to an everyday working tool in the enterprise: AI systems help managers and employees make decisions, analyze vast amounts of data and streamline processes. But alongside the benefits, the growing use of AI confronts CISOs with a new question: how do you protect an organization when some of the threats come from the very smart systems operating inside it?
Unlike traditional cyber threats, in which a hacker or other outside actor tries to break into the organization's systems, AI systems and autonomous agents operate with legitimate permissions, access sensitive data and take actions on their own. When that activity goes wrong, or when attackers manage to exploit it, the line between a legitimate business operation and a security incident blurs. The new insider doesn't carry an employee badge, works around the clock, and never gets an exit interview.
The Gap Between Threat Speed and Response
The Trellix study, "Mind of the CISO: The New Insider", surveyed 600 CISOs and senior security leaders worldwide. 95% of them reported experiencing an insider incident linked to the actions of an AI or autonomous system in the past 12 months, and on average, AI actions accounted for 28% of all insider-related incidents.
The financial impact was significant as well: insider incidents cost organizations $2.4 million on average. Beyond the direct cost, 56% of respondents reported data loss, 49% operational disruption or downtime, 48% compliance or legal violations, and 46% reputational damage or loss of customer trust.
One of the most troubling findings concerns the gap between the speed of the threats and the organization's ability to respond: organizations take 15 hours on average to detect and respond to insider-related incidents. When the attacker operates at machine speed, 15 hours is an eternity. And if that weren't enough, 63% of CISOs admit their organization lacks sufficient visibility into how employees use AI tools.
The Insider Threat Is No Longer Human
The study also found that 78% of organizations now include AI agents, autonomous systems and machine identities in their definition of insider risk, and 42% rank it as the most important security risk to address over the next 12–24 months. Yet 52% still lack a fully implemented insider risk strategy.
Attackers have adopted the technology too. 83% of CISOs agree AI is accelerating attackers' ability to discover and exploit vulnerabilities, 78% say traditional security controls are becoming less effective against these attacks, and 79% expect to be targeted by an AI-assisted attack exploiting trusted identities or systems within the next 12 months. The result is a new reality: attackers move at machine speed, while much of the defense still relies on manual investigation and response.
Agentic SOC: The Next Generation of the Security Operations Center
To meet this reality, organizations need to change the way their security operations centers work. In the old model, security teams receive large volumes of alerts from different systems, examine them, correlate the data and try to work out which ones point to a real threat. As alert volumes grow and attacks become more sophisticated, the load on analysts increases and response times stretch.
One of the key developments in the field is the shift to the agentic SOC: a security operations center in which AI systems don't just detect threats, but take an active part in investigation, analysis, triage and decision-making.
Against this backdrop, Trellix is introducing Trellix Wise for Private Cloud, the AI core for an agentic SOC, deployed entirely within the customer's environment.
The solution investigates, evaluates, correlates and triages every incoming alert and, within minutes, produces a verdict: confirmed incident or benign. Every verdict comes with the evidence, a confidence score and specific guidance on what to do next. That lets security teams focus on the incidents that really matter, without giving up human oversight.
Unlike solutions that rely on external AI services, Trellix Wise for Private Cloud runs in the customer's environment, and the organization's data stays fully under its control. This is not just a question of regulation: according to the study, public cloud models can actively impede a security team's own breach investigation. At the same time, the solution addresses the three barriers to AI adoption that customers cite most often: unpredictable costs, loss of data control, and a lack of transparency in AI decisions.
Yaniv Nezri, Country Manager, Trellix Israel, explains: "In recent years, organizations have rightly embraced AI-based technologies to keep pace with the market and stay relevant, but many are now realizing that it comes at a steep cost: data sovereignty, transparency into how the system reaches its decisions, and predictability in their budgets. Trellix Wise for Private Cloud is designed to restore all three. Data stays within the organization's own environment, every decision the system makes is explainable to the team, and costs remain predictable, even on the day of an attack. Because on that day, the team should be focused on stopping the attacker, not on what it will cost."
This approach reflects a broader shift in how organizations evaluate AI-based security solutions: alongside the demand for performance and automation, data sovereignty, control and transparency are growing in importance, especially for organizations operating in sensitive, regulated environments such as finance, healthcare, government and critical infrastructure.
Staying in Control When the Machines Act Alone
The change AI brings is not only technological; it also affects CISOs' personal accountability. 91% of the study's participants say their accountability for insider risk has grown over the past 12 months, and 69% are concerned about personal liability in the event of an incident. Yet 74% report that senior leadership and the board lack a clear understanding of these risks, and 62% agree their organization is not fully prepared to manage the risks associated with AI and autonomous tools.
The implication is clear: as AI takes on a bigger role in business operations, organizations must invest not only in advanced defense technologies but also in oversight and risk governance. Or, as the study concludes: organizations must govern AI as a privileged user and
implement agentic SOC capabilities to keep pace with it.
In partnership with Trellix
