Trellix has published a new report, ‘Mind of the CISO: The New Insider’, which claims that AI and autonomous systems are the latest insider threat vector. In total, 74% of CISOs agree that the use of AI tools introduces risks that traditional security controls are not designed to address. The result is a growing gap between the operational speed of AI within enterprise environments and how quickly organizations can detect and respond to the risks it introduces. This demands a fundamental shift toward autonomous, agentic SOC capabilities to close the gap, says Trellix.
Other results from a survey of 600 CISOs and senior security leaders for the report reveal the scale of AI-driven insider risk:
- 95% experienced an insider incident linked to the actions of an AI or autonomous system in the past 12 months, with AI actions accounting for 28% of all insider-related incidents, on average.
- Insider risk incidents cost organizations $2.4 million on average.
- Impacts of insider risk incidents include data loss (56%), operational disruption or downtime (49%), compliance or legal violations (48%), and reputational damage or loss of customer trust (46%).
- 78% of organizations now include AI agents, autonomous systems, and machine identities in their definition of insider risk, and 42% report this as the most important security risk to address over the next 12 to 24 months. Yet half (52%) lack a fully implemented insider risk strategy. The majority (94%) are concerned about the risk of actions taken by AI within their security environments and often operate with limited visibility.
- 63% of surveyed CISOs say that their organization lacks sufficient visibility into how employees use AI tools, and 99% agree they need to improve visibility across users, devices, and environments.
- On average, organizations take 15 hours to detect and respond to insider-related incidents – a window that attackers can exploit.
- 83% of CISOs agree that AI is accelerating attackers’ abilities to discover and exploit vulnerabilities, and 78% agree that traditional security controls are becoming less effective against these attacks.
- 79% expect to be targeted by an AI-assisted attack exploiting trusted identities or systems within the next 12 months.
- Nearly all (99%) CISOs surveyed agree that AI and automation will be essential to managing insider risk over the next 12 to 24 months, and 41% plan to prioritise investment in AI-related detection and response.
