Saudi Organisations Lose US$1.95 Million Annually to Insider-Related Incidents, Trellix Research Finds
63% of organisations that experienced an insider incident reported data loss or exposure of sensitive information
100% of CISOs say their responsibility for managing insider risk has increased
Organisations in Saudi Arabia incurred an average of US$1.95 million in costs from insider-related security incidents over the past 12 months, according to new research from Trellix. The finding is part of Trellix Mind of the CISO: The New Insider, which examines how AI and autonomous systems are changing insider risk, the consequences when trusted access goes wrong, and what this means for CISOs.
The financial figure, while substantial, is only one measure of the fallout. Among organisations that experienced an insider incident, 63% reported data loss or exposure of sensitive information, 43% experienced operational disruption or downtime, and 45% reported reputational damage or a loss of customer trust. An incident can therefore compromise information, interrupt services, and affect the relationships a business depends on.
Behind those impacts is a changing mix of sources. On average, accidental or negligent actions by employees and other trusted users accounted for 47% of insider-related incidents, while malicious human actions accounted for 31%. Most strikingly, actions taken by AI-driven or autonomous systems already account for one in every five insider-related incidents. As these systems become more widely used and act through trusted access at machine speed, mistakes or misuse could spread before security teams intervene. Trellix warns that without stronger governance and response, the business costs identified by the research could mount.
“When AI agents operate inside your trusted boundary at machine speed, the resilient organisations will be the ones governing them like the privileged identities they are, while simultaneously building an agentic SOC to respond at the speed of the threat, not a human workflow,” said David Soto, Chief Information Security Officer, Trellix.
The growing role of autonomous systems adds to the responsibility CISOs already carry for human insider risk. In Saudi Arabia, 100% say their responsibility for managing insider risk has increased over the past 12 months, while 70% are concerned about their personal liability if an insider-related security incident occurs. Yet 80% say senior leaders or board members lack a clear understanding of insider risk and its potential impact. CISOs are being asked to account for a growing range of trusted activity and explain its business consequences to leaders who may not yet see the full picture.
Encouragingly, the findings also show where CISOs can start strengthening their position. In Saudi Arabia, 80% agree their organisation lacks sufficient visibility into how employees use AI tools, while 80% say it is not fully prepared to manage risks associated with AI and autonomous tools. Improving visibility and establishing ownership of non-human identities would give security leaders a clearer basis for identifying risk and deciding when to act.
But visibility only helps when it leads to a timely response. Saudi Arabian organisations take an average of 5.1 hours to detect an insider-related incident and a further 8.4 hours to respond—about 13.5 hours in total. That window underscores the need to investigate suspicious activity in context and contain it quickly, particularly when autonomous systems can act at machine speed.
“Across Saudi Arabia, our conversations with customers keep coming back to the same question: how can they understand what trusted AI systems are doing and respond before an incident becomes a wider business loss?” said Khaled Alateeq, Regional Vice President, KSA at Trellix. “Security teams need to work with their own data and move quickly. For CISOs, that means being able to trace the actions of people and AI agents, put them in context, and contain harmful activity before it spreads.”
That need to investigate quickly while retaining control of security data also informs Trellix’s approach to the agentic SOC. The company recently introduced Trellix Wise™ for Private Cloud, the AI core for an agentic security operations centre deployed within a customer’s own environment. It is designed to close the threat detection and response gap with faster investigation and response, while keeping security data under the organisation’s control.
Research Methodology
Trellix commissioned independent market research agency Vanson Bourne to survey 600 CISOs or equivalent senior security leaders across the Americas, Europe, the Middle East and Asia Pacific in August and September 2026. The Middle East sample comprised 40 respondents in the UAE and 40 in Saudi Arabia. Cost averages are based on respondents whose organisations experienced an insider-related security incident in the previous 12 months and who provided a cost response. “Middle East” figures combine the UAE and Saudi Arabia samples.
About Trellix
Trellix is a global cybersecurity leader helping organizations build cyber resilience for the AI era. Combining AI-native security, operational threat intelligence, and automated detection and response, Trellix provides defense-grade protection at machine speed across on-premises, air-gapped, operational technology, hybrid, and cloud environments. Trellix helps customers anticipate threats, scale effective security operations, maintain business continuity, and adapt their security posture for the modern threat landscape. More at https://trellix.com.
