Nearly all Indian organisations surveyed experienced an insider incident linked to artificial intelligence or autonomous systems over the past year, while 58% of Indian Chief Information Security Officers (CISOs) rank risks from AI tools and machine identities among their top security priorities, according to new research by Trellix.
The findings come as Trellix also announced Wise for Private Cloud, an AI-based security operations offering designed to help organisations investigate threats while keeping sensitive data within their own infrastructure.
The Mind of the CISO: The New Insider study, conducted by research firm Vanson Bourne, surveyed 600 CISOs or equivalent executives at organisations with at least 1,000 employees globally, including 50 respondents in India. Trellix said 98% of Indian organisations surveyed had experienced an insider incident linked to AI or autonomous systems in the preceding 12 months.
The research found that AI-driven or autonomous systems accounted for an average of 31% of insider-related incidents at Indian organisations. The average cost of insider incidents for affected Indian organisations was approximately US2.63millionoverthepastyear,comparedwithUS2.38 million globally. Data loss or exposure of sensitive information was the most commonly reported impact, cited by 65% of respondents, followed by operational disruption or downtime at 59%.
The findings suggest that security teams are increasingly concerned about risks from systems that have legitimate access to corporate networks and data. These include AI tools, autonomous agents, automation systems and machine identities.
Some 22% of Indian CISOs ranked non-human insider risk as their single most important security risk, ahead of ransomware and human insider risk, both cited by 20%. Meanwhile, 48% said they were very concerned about actions taken by AI-driven or autonomous systems, compared with 31% globally.
Third-party AI applications are another concern. More than half of Indian CISOs, or 56%, identified vendors’ AI tools with unclear data-handling practices as a leading risk for data leakage, compared with 45% globally.
The challenge extends to monitoring and compliance. Ninety-six per cent of Indian respondents said balancing insider-risk monitoring with privacy and regulatory requirements was becoming increasingly difficult. Forty-six per cent cited privacy, legal or compliance constraints on monitoring as a challenge in detecting and responding to insider threats.
“Indian organizations face a dual mandate: harness AI to accelerate detection and response, while maintaining full control of sensitive data in an increasingly regulated environment,” said Ganesh Iyer, Managing Director, Trellix India and SAARC.
He said organisations adopting agentic security needed clarity on where their data was stored, how AI systems reached conclusions and the cost of scaling their use.
Trellix’s newly announced Wise for Private Cloud is designed to run within customer-controlled environments, including on-premises, air-gapped, hybrid and private cloud deployments. The company said the system would not send data to public large language models or external cloud environments. It also provides explanations and audit records of AI-generated outcomes to support oversight.
“The threat landscape has fundamentally shifted, where AI isn’t just accelerating attacks; it’s commercializing them,” said Vishal Rao, CEO of Trellix. He said the company’s approach was to counter AI-powered threats with AI-powered defence.
However, the research points to gaps in organisations’ ability to identify and manage these risks. Half of Indian CISOs said their organisations needed to significantly improve detection of threats involving AI tools and non-human identities. Seventy-two per cent said senior leadership and board members lacked a clear understanding of insider risk and its potential impact.
The findings also highlight demand for stronger regulatory guidance. Seventy per cent of Indian respondents wanted governments or regulators to establish clearer requirements for insider-risk management, while 60% called for frameworks specifically addressing AI-related insider risks. Thirty-four per cent ranked India’s Digital Personal Data Protection Act, 2023, among the regulations or programmes they expected to have the greatest positive impact on their ability to manage insider risk.
Looking ahead, 48% said AI and automation would be critically important to managing insider risk over the next 12 to 24 months. Data loss prevention, cited by 56%, and integration of security tools to improve visibility and response, cited by 54%, were the leading investment priorities.
The findings underline a growing tension for security leaders: organisations are turning to AI to improve threat detection and response even as AI tools and autonomous systems introduce new access, data-handling and accountability challenges.
Express Computer is one of India's most respected IT media brands and has been in publication for 24 years running. We cover enterprise technology in all its flavours, including processors, storage, networking, wireless, business applications, cloud computing, analytics, green initiatives and anything that can help companies make the most of their ICT investments. Additionally, we also report on the fast emerging realm of eGovernance in India.