[ITmedia Enterprise] Defending AI attacks with AI, realizing AI SOC How will Trellix overcome the "three walls" that bind regulated industries?

Trellix announced ``Trellix Wise for Private Cloud'' (hereinafter referred to as Wise for Private Cloud), an agentic SOC product that completes everything from AI-based alert investigation to response within the customer's managed environment. It can be deployed on-premises, in air-gapped environments isolated from external networks, in hybrid environments, or in private clouds without sending data to external clouds or public LLMs (Large-Scale Language Models). General availability began on the same day.

According to Oh Yun, 67.8% of respondents in the company's survey answered, ``I want to use AI, but there are regulations that require me to manage the data myself, so I can't use it.'' Even in Japan, there is a strong sense of caution about the risks associated with the use of AI. In the research report "Mind of the CISO: The New Insider: Rethinking Risk in the AI ​​Era" published by Trellix in 2026, 83% of Japanese respondents said that the use of AI tools has created risks that were not anticipated by traditional security measures.

There is also the barrier of cost. According to the company, many agentic SOC products use a token billing system based on the amount of AI processing, making it difficult to predict costs when incidents increase rapidly. Transparency issues, such as not being able to see the process by which AI reaches its decisions, have also been an impediment to its adoption in highly regulated industries.

Collaborates with existing SIEM and charges a fixed fee

Hidemitsu Sakurai (Managing Director and Head of Solutions Engineering Headquarters) of Trellix listed the following four characteristics of Wise for Private Cloud.

Even with a minimum configuration of 3000 VMs, it is possible to analyze 1800 alerts per day. Mr. Sakurai explained that if a human spends 20 minutes on a single case, this is equivalent to the amount of work required by approximately 25 analysts working 24 hours a day. The system investigates all alerts, including low-level alerts, and actively searches for signs of threats even when no alerts are issued.

On the other hand, it does not eliminate human involvement. The work of Tier 1 analysts, who are responsible for primary analysis of alerts, will be automated, and humans and AI will work together for Tier 2 and later analysts, who are responsible for detailed analysis and response. Mr. Sakurai expressed the view that agentic AI can automate 50 to 60% of the work that has traditionally relied on humans.