Insider cybersecurity incidents cost UAE firms $2.88 million a year, Trellix finds

Financial losses and business disruption

The UAE findings in Mind of the CISO: The New Insider describe damage beyond financial losses. Among organizations that experienced an insider incident during the previous 12 months, half reported reputational harm or lost customer trust. Data loss or sensitive information exposure affected 47%, while 39% reported downtime or other operational disruption.

Published October 13, 2026, the Trellix report put the global average cost at $2.4 million per organization over the preceding 12 months, below the UAE figure. Trellix commissioned independent market research agency Vanson Bourne to survey 600 chief information security officers (CISOs) or people in equivalent roles across the Americas, Europe, the Middle East and Asia Pacific. Participants came from industries including finance, the public sector, healthcare, manufacturing, and energy, oil, gas and utilities.

A separate benchmark, the Ponemon Institute's 2026 Cost of Insider Risks Global Report, estimated annual insider-risk costs at $19.5 million per organization. Commissioned by DTEX and published in February 2026, that report identified negligent or mistaken insiders as the largest cost driver, accounting for $10.3 million in annualized costs. Organizations took an average of 67 days to contain an insider event.

Human errors and AI-related incidents

In the UAE results, accidental or negligent behavior by employees and other trusted users accounted for 43% of insider-related incidents. Malicious human activity represented 28%, with AI-driven or autonomous systems responsible for the remaining 29%.

The global survey also found widespread experience with AI-related insider incidents: 95% of organizations reported at least one linked to an AI or autonomous system during the preceding 12 months. Across the global sample, AI actions accounted for an average of 28% of all insider-related incidents.

Visibility into AI use remains limited in the UAE. Three-quarters of respondents said they could not adequately see how employees were using AI tools, and 73% said their organizations were not fully ready to manage risks involving AI and autonomous systems.

Security leaders report gaps in oversight

Among UAE CISOs, 88% said their responsibility for insider-risk management had increased over the past year, and 70% were worried about personal liability in the event of an insider-related security incident. Meanwhile, 85% said senior executives or board members lacked a clear understanding of the risk and its potential business consequences.

Policy concerns extended across the broader Trellix study. Existing policies did not adequately cover AI-related risks, according to 68% of CISOs. A majority wanted regulators to provide clearer frameworks, compliance requirements and best practices.

David Soto, Trellix's chief information security officer, said: "When AI agents operate inside your trusted boundary at machine speed, the resilient organisations will be the ones governing them like the privileged identities they are, while simultaneously building an agentic SOC to respond at the speed of the threat, not a human workflow."

Detection and response

UAE organizations needed an average of 6.1 hours to detect an insider-related incident, followed by another eight hours to respond, the research found. Those delays leave time for threats to escalate.

Vibin Shaju, Trellix's vice president of EMEA solutions engineering, said: "Across the UAE, the question we hear most from customers is not whether to trust AI - it is how to verify what it is actually doing." He said CISOs need to follow the actions of people and AI agents, assess their context and stop harmful activity before it develops into a broader business problem.

Alongside the report, Trellix announced Trellix Wise for Private Cloud. The company describes the product as the AI core of an agentic security operations center running entirely within a customer's environment. Its stated purpose is to narrow the gap between threat detection and response while leaving the organization in control of its security data.