ProductNot yet confirmed elsewhere1 publisher3 min readPublished
Trellix ships a Wise edition that runs entirely inside the customer's own environment
Trellix launched Trellix Wise for Private Cloud, which runs its security operations AI engine entirely inside customer environments with no per-token billing. The release targets the reasons large organizations have held back from giving SOC work to AI agents.
The Product Desk
Key figures from the Vanson Bourne poll for Trellix: 99% of respondents expect AI and automation to be critical or very important to managing insider risk within two years; 40% named a lack of trust in automated decision-making as what stands in the way; 600 CISOs were polled.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Expect AI critical or very important in two years | 99% of respondents | 8 | |
| Name lack of trust in automated decision-making | 40% of respondents | Asked what stands in the way | 9 |
| Polled by Vanson Bourne | 600 CISOs | 5 |
What happened
- Trellix CISO David Soto framed the launch around buyers who, he said, "aren't resistant to the technology, but to the tradeoffs."
- In a Vanson Bourne poll of 600 CISOs released with the product, 40% named a lack of trust in automated decision-making as what stands in the way.
- Respondents said AI-driven or autonomous systems were behind 28% of the insider incidents they handled over the past year, on average.
Why it matters
- decision Buyers now sort alert queues by sensitivity: Trellix's own report recommends private or on-premises deployment for sensitive workloads, and this edition is the product that fits that advice.
- cost Removing the token meter takes away the variable bill, and the buyer still needs a fixed quote at pilot volume before comparing.
- exposure If AI agents count as insiders, as Soto argues, the SOC agent is itself in scope for governance, and the per-outcome confidence record is what an auditor would ask to see.
The shortest claim in the launch is also the most checkable: customers are not billed by the token [4]. Trellix's chief information security officer, David Soto, built the pitch around buyers who want that. Holdouts, he said, "aren't resistant to the technology, but to the tradeoffs" [2].
Location is the first of Soto's tradeoffs [3]. Sending sensitive security telemetry to a public cloud is one he named [3]. Wise for Private Cloud answers it by running the engine entirely inside the customer's environment [1]. The Mind of the CISO report released alongside the product recommends the same posture for sensitive workloads: consider on-premises or private cloud so data stays inside the company's own security boundary [6].
Cost is the second. Soto's phrase was "absorbing unpredictable token costs" [3]. Dropping the meter removes the unpredictability only if something predictable replaces it. The SiliconANGLE report does not say what Trellix charges instead. We'd expect the cost question to move from the invoice to capacity planning, since the compute now sits in the customer's environment.
Explanation is the third, and the hardest to verify. Every outcome carries a confidence level. Trellix said each comes with a plain-language explanation that makes it auditable for governance [13]. What still needs testing is what a reviewer does with that score at the end of a long shift.
The survey Trellix released with the product points at the same gap. Vanson Bourne polled 600 CISOs in August and September [5]. Ninety-nine percent expect that within two years, AI and automation will be critical or very important to how they manage insider risk [8]. Asked about obstacles, 40% said they lack trust in automated decisions [9].
The stakes in the report are about speed. Respondents said AI-driven or autonomous systems were behind 28% of the insider incidents they handled over the past year, on average [7]. The average organization took seven hours to spot an insider incident and eight more to respond [10], or 15 hours in all [12]. Soto argued that companies that do not govern AI agents as rigorously as human employees are "operating with an unmonitored insider at scale" [11]. By that logic the SOC agent is itself something to govern. An auditor would ask to see its per-outcome confidence record.
Sort your alert queues on two axes. One is how sensitive the telemetry is. The other is what a wrong automatic close costs you. Queues that are high on both are the ones that justify a private deployment and a rule that sends low-confidence outcomes to a person. Queues that are low on both can go wherever is cheapest. Where only the cost of a wrong close is high, the review gate matters more than the location. Where only the sensitivity is high, location matters more than the gate. The tradeoff is that a private deployment makes you the one who sizes and runs it. Before comparing it with a metered service, get a fixed monthly quote at your pilot's alert volume.
What to watch
- Whether Trellix publishes pricing and capacity requirements for Wise for Private Cloud.
- Whether any customer or independent tester compares Wise confidence levels with analysts' calls on closed alerts.
- Whether other SOC AI vendors answer with private-environment editions or flat pricing.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+20
- Incentives75
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Trellix launched Trellix Wise for Private Cloud to let enterprises run its AI engine for security operations entirely inside their own environments.
- [2]
David Soto, Trellix's chief information security officer, said holdouts "aren't resistant to the technology, but to the tradeoffs."
- [3]
Soto described the tradeoffs as sending sensitive security telemetry to a public cloud, "absorbing unpredictable token costs" and working without visibility into how AI decisions are made.
- [5]
Research firm Vanson Bourne polled 600 chief information security officers on insider risk for Trellix's Mind of the CISO report in August and September; the report was released alongside the product.
- [6]
One of the report's recommendations is that companies consider on-premises or private cloud deployments for sensitive workloads so data stays inside their own security boundary.
- [7]
Respondents told Vanson Bourne that AI-driven or autonomous systems were behind 28% of the insider incidents they dealt with over the past year, on average.
- [8]
Ninety-nine percent of respondents expect AI and automation to be critical or very important to managing insider risk within two years.
- [9]
Asked what stands in the way, 40% of respondents named a lack of trust in automated decision-making.
- [10]
The average organization in the survey took seven hours to spot an insider incident, and responding took eight more.
- [11]
Soto argued in the report that companies that do not govern AI agents with the same rigor they apply to human employees are "operating with an unmonitored insider at scale."
- [12]
The average surveyed organization took about 15 hours from an insider incident to the end of its response.
- [13]
Every outcome from the private cloud edition comes with a confidence level, and Trellix said each one is explained in plain language so it can be audited for governance purposes.
Sources
1 independent publisher whose own reporting we read for this story.
- siliconangle.comTrellix Wise for Private Cloud runs AI security operations inside customer environments
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Insider RiskFollow
- AI in security operationsFollow
- Private cloud deploymentFollow