Organisations in the Middle East incurred an average of US$2.41 million in costs from insider-related security incidents over the past 12 months, according to new research from Trellix. The finding is part of Trellix Mind of the CISO: The New Insider, which examines how AI and autonomous systems are changing insider risk, the consequences when trusted access goes wrong, and what this means for CISOs.
The financial figure, while substantial, is only one measure of the fallout. Among organisations that experienced an insider incident, 55% reported data loss or exposure of sensitive information, 41% experienced operational disruption or downtime, and 47% reported reputational damage or a loss of customer trust. An incident can therefore compromise information, interrupt services, and affect the relationships a business depends on.
Behind those impacts is a changing mix of sources. On average, accidental or negligent actions by employees and other trusted users accounted for 45% of insider-related incidents, while malicious human actions accounted for 30%. Most strikingly, actions taken by AI-driven or autonomous systems already account for one in four insider-related incidents. As these systems become more widely used and act through trusted access at machine speed, mistakes or misuse could spread before security teams intervene. Trellix warns that without stronger governance and response, the business costs identified by the research could mount.
“When AI agents operate inside your trusted boundary at machine speed, the resilient organisations will be the ones governing them like the privileged identities they are, while simultaneously building an agentic SOC to respond at the speed of the threat, not a human workflow,” said David Soto, Chief Information Security Officer, Trellix.
The growing role of autonomous systems adds to the responsibility CISOs already carry for human insider risk. In the Middle East, 94% say their responsibility for managing insider risk has increased over the past 12 months, while 70% are concerned about their personal liability if an insider-related security incident occurs. Yet 83% say senior leaders or board members lack a clear understanding of insider risk and its potential impact. CISOs are being asked to account for a growing range of trusted activity and explain its business consequences to leaders who may not yet see the full picture.
Encouragingly, the findings also show where CISOs can start strengthening their position. More than three-quarters (78%) agree their organisation lacks sufficient visibility into how employees use AI tools, while 76% say it is not fully prepared to manage risks associated with AI and autonomous tools. Improving visibility and establishing ownership of non-human identities would give security leaders a clearer basis for identifying risk and deciding when to act.
But visibility only helps when it leads to a timely response. Middle East organisations take an average of 5.6 hours to detect an insider-related incident and a further 8.2 hours to respond, nearly 14 hours in total. That window underscores the need to investigate suspicious activity in context and contain it quickly, particularly when autonomous systems can act at machine speed.
“Across the Middle East, the pressure on security leaders has shifted. The conversation used to be about whether AI belonged in the SOC, and now it is about control: who can see what AI is doing, who can act on it, and how fast,” said Siju Ramachandradasan, Vice President, Customer Success & Professional Services – EMEA at Trellix. “Organisations here are operating in complex regulatory environments with real consequences for getting it wrong. CISOs need the ability to track activity across both human and AI actors, understand the full picture, and shut down a threat before it becomes a wider business problem.”
That need to investigate quickly while retaining control of security data also informs Trellix’s approach to the agentic SOC. The company recently introduced Trellix Wise for Private Cloud, the AI core for an agentic security operations centre deployed within a customer’s own environment. It is designed to close the threat detection and response gap with faster investigation and response, while keeping security data under the organisation’s control.
Discussion about this post