Trellix Wise for Private Cloud runs AI security operations inside customer environments

SECURITY

Trellix Wise for Private Cloud runs AI security operations inside customer environments

Cybersecurity company Trellix today launched Trellix Wise for Private Cloud to let enterprises run its artificial intelligence engine for security operations entirely inside their own environments.

The new release targets the main reasons large organizations have held back from handing security operations center work to AI agents. David Soto, Trellix’s chief information security officer, said those holdouts “aren’t resistant to the technology, but to the tradeoffs.” He described the tradeoffs as sending sensitive security telemetry to a public cloud, “absorbing unpredictable token costs” and working without visibility into how AI decisions are made.

Every outcome from the private cloud edition comes with a confidence level, and Trellix said each one is explained in plain language so it can be audited for governance purposes. Customers are not billed by the token. Trellix Wise first appeared in May 2024 as generative AI investigation features in the company’s extended detection and response platform.

Soto’s comments come from the latest edition of Trellix’s “Mind of the CISO” report, released alongside the product. Research firm Vanson Bourne Ltd. polled 600 chief information security officers on insider risk for the study in August and September. One of the report’s recommendations is that companies consider on-premises or private cloud deployments for sensitive workloads so data stays inside their own security boundary.

Respondents told Vanson Bourne that AI-driven or autonomous systems were behind 28% of the insider incidents they dealt with over the past year, on average. Ninety-nine percent still expect AI and automation to be critical or very important to managing insider risk within two years. Asked what stands in the way, 40% named a lack of trust in automated decision-making.

The average organization in the survey took seven hours to spot an insider incident. Responding took eight more, a window Soto described as an invitation to attackers who use AI to speed up every stage of an attack.

Companies that do not govern AI agents with the same rigor they apply to human employees are “operating with an unmonitored insider at scale,” Soto argued in the report.

The report also found 98% of respondents see a role for governments or regulators in helping them manage insider risk. One U.S. chief information security officer at a financial operations provider told interviewers that fragmented state rules were “a nightmare” and called for a “unified matrix of regulations” so companies can “safely use AI for legitimate business purposes.”

Trellix, formally named Musarubra US LLC, was formed in 2022 by Symphony Technology Group following STG’s acquisition of McAfee Enterprise and FireEye.

Image: Trellix