Over half of Indian CISOs flag third-party AI tools as top data leakage risk: Trellix survey

Trellix’s Mind of the CISO study finds 98% of Indian organisations suffered an AI-linked insider incident in a year, as security chiefs worry about vendor tools, machine identities and balancing monitoring against privacy and compliance.

More than half of Indian chief information security officers (CISOs) surveyed, 56%, see third-party or vendor AI tools with unclear data handling practices as one of the greatest AI-related data leakage risks. The finding comes from Mind of the CISO: The New Insider, a new study by cyber resilience firm Trellix.

The worry goes beyond outside vendors. According to the study, 58% of Indian CISOs place non-human insiders, such as AI agents and machine identities, among their top three security risks, compared with 42% globally.

AI-linked incidents already widespread

The risk is already real. Some 98% of Indian organisations reported an insider incident tied to AI or autonomous systems in the past 12 months. Insider incidents cost affected organisations US$2.6 million on average, above the global average of US$2.4 million.

Half of the CISOs agreed their organisations must significantly improve detection of risks linked to AI tools and non-human identities. At the same time, 48% expect AI and automation to be critically important in managing insider risk over the next 12 to 24 months, against 30% globally. The study also found that 96% find it increasingly hard to balance insider risk monitoring with privacy and regulatory requirements.

Regulation is seen as a help. About 34% of Indian CISOs ranked the Digital Personal Data Protection (DPDP) Act, 2023 among the top three regulations or programmes likely to most improve their ability to address insider risk.

Trellix launches on-premises AI for security operations

Alongside the research, Trellix announced Trellix Wise™ for Private Cloud, which it describes as the first on-premises, federated AI core for the agentic security operations centre (SOC). The company says it extends a security fabric across existing infrastructure to close the threat detection and response gap without compromising data sovereignty, governance or cost predictability.

“The threat landscape has fundamentally shifted, where AI isn’t just accelerating attacks; it’s commercializing them,” said Vishal Rao, Chief Executive Officer, Trellix. “Our strategy for the AI era is clear: meet AI-powered threats with AI-powered defense. Trellix Wise for Private Cloud enables our customers to harness the speed and precision of AI on their terms, ensuring resilience without compromise.”

“Indian organizations face a dual mandate: harness AI to accelerate detection and response, while maintaining full control of sensitive data in an increasingly regulated environment,” said Ganesh Iyer, Managing Director, Trellix, India & SAARC. “To act on the promise of agentic security, organizations need confidence in three things: where their data stays, how the AI reaches its conclusions, and what it will cost to scale. Trellix Wise for Private Cloud answers all three.”

Trellix says the product addresses these concerns in three ways:

·         Data control: It can be deployed across on-premises, air-gapped, hybrid and private cloud environments. It operates entirely inside the customer’s environment, so data stays within the security boundary and is never sent to a public large language model (LLM) or external cloud.

·         Cost: Predictable pricing replaces token-based consumption models, so organisations can scale AI adoption without escalating costs.

·         Governance: Auditable AI outcomes come with confidence levels, plain-language explanations and detailed dossiers on the AI’s reasoning. This gives analysts visibility into how decisions are reached and supports risk-informed governance.

Partner view and availability

“Our customers have invested heavily in security, but their teams are still left piecing together what different tools are telling them,” said Suchit Karnik, COO at RAH Infotech Pvt Ltd. “Trellix Wise for Private Cloud connects those signals with threat intelligence to reveal activity that might look harmless in isolation. That means helping customers close gaps between their tools and get more value from the security they already have.”

Trellix says the offering draws on nearly 40 years of its threat intelligence and its Trellix Wise AI technology.