AI costs in security are rising, not falling. WitFoo research shows how to cut the bill by four-fifths

New research builds on joint guidance from five national cyber security agencies and puts numbers on their advice to filter data before it reaches an AI model.

DUNWOODY, GA, UNITED STATES, November 4, 2026 /EINPresswire.com/ -- Cybersecurity company WitFoo today published The AI cost collision in cybersecurity, a white paper arguing that the price of running AI on security data is set to keep rising, and that the answer lies in the data, not the model.

For two years, security leaders were told that AI would get cheaper every year. The paper sets out why that assumption is breaking. The chips, data centres and electricity that AI depends on are all in short supply, and each takes years to expand. Frontier model prices have stopped falling, and security operations, which generate more data than almost any other part of a business, are among the heaviest users.

In October, the national cyber security agencies of Australia, Canada, New Zealand, the United Kingdom and the United States published joint guidance, Managing AI token consumption for operational resilience. It treats AI usage as a resilience risk as well as a cost, places cyber defence, incident response and threat intelligence in the top tier for access to AI capacity, and suggests preprocessing and filtering data before it reaches a model. The WitFoo paper works through what that advice is worth in a security operation.

Security data is highly repetitive. A single login can appear in six to ten different logs. Sending all of it to an AI model means paying the model to read the same event many times over. The paper describes a deterministic layer that removes more than 90% of the volume through deduplication and normalisation before anything reaches a model, while every remaining record still points back to its original evidence. AI is then applied to the small share of signals that warrant it.

In the paper's worked example, an organisation spending US$3.28 million a year on an AI-first security architecture achieves the same security outcomes for about US$692,000, a reduction of 79%. AI inference costs alone fall by 86%.

"The cheapest AI token is the one you never have to send. Every security team is being asked to put AI to work, and the bill depends far more on what the model reads than on which model it is. The agencies have now said what practitioners already knew: shape the data first. Do that, and AI becomes affordable for the work that truly needs it," WitFoo Chairman and co-Founder Charles Herring said.

Seven security practitioners contributed perspectives to the paper, including Tom Cross, a cybersecurity expert and WitFoo advisor.

"Log collection and storage is often one of the largest ticket items in security operations budgets. These costs are ballooning now that everyone wants to read all their logs with AI. It makes sense to preprocess log data to convert it into higher level information that AI models can consume more rapidly and efficiently, and doing so frees up token budget that is needed for other critical security objectives," Cross said.

The paper also looks ahead. It expects pressure on AI capacity and pricing to continue through at least 2028, and argues that organisations which build AI-heavy security architectures on per-token or per-alert pricing will face rising renewals, while those that reduce data before AI will see their advantage grow. For boards, finance teams and the investors who back them, the cost of AI in security is becoming a recurring line item to plan for rather than a cost that will fade on its own.

The paper closes with recommendations for security leaders planning budgets from 2026 to 2029. It is free to read and download at witfoo.com/research/ai-cost-collision. Charles Herring is available for interviews; requests go to press@witfoo.com.

About WitFoo
WitFoo builds security operations software that reads all of an organisation's security data, reduces telemetry volumes by more than 90% without losing evidence, and shares what it finds with the people who must act on it, from analysts and boards to law enforcement. Founded in 2016, WitFoo, Inc. is headquartered in Dunwoody, Georgia, and sells its Conductor, Analytics and Reporter products through channel partners. Its New Zealand subsidiary, WitFoo Limited, is based at 47 Salisbury Street in Christchurch Central, where the company is building its international commercial operations. Cybersecurity for Collective Defense.

Michael Riforgiate
WitFoo, Inc.
+1 678-203-9800
press@witfoo.com
Visit us on social media:
LinkedIn
Bluesky
Facebook
X
Other