Insider incidents cost Middle East organisations US$2.41 million annually

Research from Trellix finds AI and autonomous systems account for a quarter of insider-related incidents as CISOs face growing responsibility and gaps in visibility.

Middle East organisations incurred an average of US$2.41 million in costs from insider-related security incidents over the past 12 months, according to research from Trellix, highlighting the business consequences of compromised or misused trusted access.

The report, Trellix Mind of the CISO: The New Insider, examines how AI and autonomous systems are reshaping insider risk and increasing pressure on security leaders to govern activity across human and non-human identities.

Among organisations that experienced an insider incident, 55% reported data loss or exposure of sensitive information. Reputational damage or a loss of customer trust affected 47%, while 41% experienced operational disruption or downtime.

Accidental or negligent actions by employees and other trusted users accounted for an average of 45% of insider-related incidents, followed by malicious human actions at 30%. Actions taken by AI-driven or autonomous systems accounted for the remaining 25%, extending insider risk beyond employees and other human users.

“When AI agents operate inside your trusted boundary at machine speed, the resilient organisations will be the ones governing them like the privileged identities they are, while simultaneously building an agentic SOC to respond at the speed of the threat, not a human workflow,” said David Soto, Chief Information Security Officer, Trellix.

The findings point to a widening gap between accountability and organisational understanding. Across the Middle East, 94% of CISOs said their responsibility for managing insider risk had increased over the past 12 months, while 70% expressed concern about their personal liability following an insider-related security incident.

However, 83% said senior leaders or board members lacked a clear understanding of insider risk and its potential impact.

Limited visibility into AI use presents another challenge. More than three-quarters of respondents (78%) agreed their organisation lacked sufficient visibility into how employees use AI tools, while 76% said it was not fully prepared to manage risks associated with AI and autonomous tools.

Detection and response times compound that exposure. Middle East organisations took an average of 5.6 hours to detect an insider-related incident and a further 8.2 hours to respond, bringing the combined window to nearly 14 hours.

“Across the Middle East, the pressure on security leaders has shifted. The conversation used to be about whether AI belonged in the SOC, and now it is about control: who can see what AI is doing, who can act on it, and how fast,” said Siju Ramachandradasan, Vice President, Customer Success & Professional Services, EMEA, Trellix.

“Organisations here are operating in complex regulatory environments with real consequences for getting it wrong. CISOs need the ability to track activity across both human and AI actors, understand the full picture, and shut down a threat before it becomes a wider business problem.”

Trellix linked the findings to its approach to an agentic security operations centre (SOC), where AI supports investigation and response. The company recently introduced Trellix Wise for Private Cloud, which it describes as the AI core for an agentic SOC deployed within a customer’s own environment.

According to Trellix, the offering is designed to accelerate threat investigation and response while keeping security data under the organisation’s control.