The SOC needs AI, but telemetry should not leave: lessons from Trellix Wise Private Cloud

On 15 October 2026, Trellix announced general availability of Trellix Wise for Private Cloud: AI for the security operations centre (SOC) that can run on-premises, air-gapped, on private cloud IaaS, or hybrid. The point is sharp: data and telemetry are not sent to a public LLM or an external cloud. The AI accesses data where it already lives, without forcing a new data lake, and Trellix threat intelligence is delivered inside the same boundary.

Two days earlier, Trellix released Mind of the CISO: The New Insider with Vanson Bourne. A survey of 600 CISOs across the Americas, Europe, the Middle East and Asia Pacific shows the same pressure: AI is already inside the definition of insider risk, yet many organisations lack a mature strategy, and trust in automated decisions remains a barrier.

For private businesses, from fintech and retail to manufacturing, private healthcare, hospitality and digital products, the main question is no longer "does the SOC need AI?" It is "where do that telemetry and those AI decisions live?"

What AI for the SOC inside the boundary means

A modern SOC ingests logs, endpoint signals, machine identities and behaviour trails at rising volume. Without help, analysts lose on speed. AI promises prioritisation, correlation and response guidance. The catch: many security AI offers assume telemetry may leave for a public cloud service or a vendor-managed model outside the customer's control.

Trellix Wise for Private Cloud places the model inside the customer's environment. According to the 13 October 2026 blog by Trellix CPO Alex Au Yeung, it addresses three adoption barriers that keep showing up in boardrooms:

1. Data and AI sovereignty. Sensitive telemetry does not leave the organisation's boundary.
2. Opaque AI decisions. Differentiators Trellix cites include confidence scoring, audit trails and human-in-the-loop controls, so analysts can see how conclusions were reached.
3. Unpredictable token pricing. Cost is described as fixed and forecastable by hardware capacity, not by token consumption.

To illustrate AI agent pace, the Trellix blog mentions the Hugging Face intrusion: about 17,600 actions in five days, most of them failed attempts. That figure is a volume and speed illustration, not a product claim. We covered another side of similar events in access limits for AI agents.

What the Mind of the CISO data says

Vanson Bourne's research for Trellix asked 600 CISOs. The findings most relevant to business:

• 95% experienced an insider incident linked to AI or autonomous system actions in the past 12 months.
• AI actions accounted for 28% of insider-related incidents on average.
• Average cost of insider-related incidents: USD 2.4 million.
• Most cited impacts: data loss 56%, operational disruption or downtime 49%, compliance or legal 48%, reputation or customer trust 46%.
• 74% agree that AI tools introduce risks traditional controls were not designed for.
• 78% now include AI agents, autonomous systems and machine identities in their definition of insider risk.
• 52% lack a fully implemented insider risk strategy.
• An average of 15 hours to detect and respond to insider-related incidents (secondary SiliconANGLE coverage breaks this into roughly 7 hours to detect plus 8 hours to respond).
• 99% say AI and automation are essential to managing insider risk over the next 12–24 months.
• About 40% (per SiliconANGLE) named lack of trust in automated decision-making as a barrier.

Trellix CISO David Soto summarises a common stance: holdouts are not resistant to the technology itself, but to the tradeoffs, namely public-cloud telemetry, unpredictable token costs, and no visibility into AI decisions.

In a neighbouring layer, Reach Security announced on 13 October 2026 more than USD 50 million in Series B funding to close reachable gaps at machine speed, citing CrowdStrike's 2026 Global Threat Report: AI-enabled adversary operations up 89%, with breakout times as little as 27 seconds.

The problem is not "AI or not", it is the hidden tradeoff

Many organisations already use automation in the SOC: SOAR playbooks, correlation rules, or cloud-based assistants. What often gets skipped are the five evaluation questions Trellix poses for defenders:

1. Where does telemetry go after it is sent?
2. Can the AI work without data leaving the environment?
3. Can analysts see how conclusions were reached?
4. Can you forecast the cost?
5. Is there proof from similar environments?

If the answers to questions two and three are "not sure", then the SOC AI on offer is really asking the organisation to trade speed for sovereignty and clarity. For a fintech holding transaction data, a retailer storing customer profiles, a manufacturer with production data, or a private clinic with medical records, that tradeoff is not a technical detail. It is a business risk.

Unpredictable cost also often escapes notice. Token-based models can look cheap in a demo, then swell when alert volume rises. The same pattern appears in FinOps: cloud spend needs owners: without a budget owner and a clear pricing model, automation becomes an end-of-month surprise.

What it means for businesses in Indonesia

Many companies in Indonesia already run a mixed cloud: production on public cloud, sensitive data on private cloud or on-prem, and partners with limited access. Adding SOC AI that forces telemetry into a public LLM can conflict with internal policy, customer contracts, or board-agreed data-control expectations.

Five practical steps you can start without waiting for a specific vendor:

1. Map where your SOC telemetry goes today. Record log sources, SIEM, EDR, identity, and every connector to external AI services. If you cannot answer "what data leaves and where", you are not ready to choose SOC AI.
2. Extend insider risk to AI agents and machine identities. Trellix's survey: 78% of CISOs already do this. Review service accounts, API tokens and automated agents with the same rigour as human accounts, as in AI agent access limits.
3. Demand explainability before you scale. Ask for confidence scoring, audit trails and a human-in-the-loop path. If a vendor cannot show how conclusions were reached, do not hand them critical triage.
4. Compare cost models: capacity versus tokens. Build a high-alert-volume scenario. Prefer a model you can forecast for 12 months, then assign a budget owner.
5. Measure the detect-and-respond window, then set a target. The 15-hour average in Trellix's survey is too slow for AI-assisted attacks. Establish a baseline, then test whether in-boundary AI truly shortens that window without sacrificing auditability.

How MarkasDev helps

MarkasDev works as a Technology Partner for operational reliability, in three phases:

• Diagnose: map SOC telemetry flows, data egress points, machine identities and AI agents, automation cost models and explainability gaps, then set priorities.
• Deliver: implement access controls, audit paths and security integrations with written milestones and acceptance criteria, including architecture that keeps data inside the boundary.
• Operate: a retainer with SLA and monitoring for machine-identity anomalies, automation cost and response effectiveness. How that differs from fix-when-broken support is in Maintenance vs Operate.

If your security team wants AI in the SOC without sending telemetry to a public LLM, book a Diagnose session to map data boundaries, cost models and auditable decision paths.

Sources

• Trellix, "Trellix Wise for Private Cloud: AI for the SOC" (Alex Au Yeung, 13 October 2026): https://www.trellix.com/blogs/platform/trellix-wise-for-private-cloud-ai-for-the-soc/
• Trellix, "Trellix Research Reveals the True Cost of Ungoverned AI" (press release, 13 October 2026): https://www.trellix.com/news/press-releases/trellix-research-reveals-the-true-cost-of-ungoverned-ai/
• SiliconANGLE coverage of Trellix Wise for Private Cloud and Mind of the CISO (13 October 2026): https://siliconangle.com/2026/10/13/trellix-wise-for-private-cloud-runs-ai-security-operations-inside-customer-environments/
• Reach Security, Series B >$50M (13 October 2026): https://www.globenewswire.com/news-release/2026/10/13/3379991/0/en/reach-security-raises-more-than-50m-series-b-to-stop-ai-powered-attacks-by-autonomously-closing-the-gaps-they-target.html