%201.webp)
WitFoo has published research on the cost of using artificial intelligence in cybersecurity operations. In a worked example, the paper says filtering data before it reaches AI models can cut costs by 79%.
The white paper examines rising AI costs in security operations and builds on joint guidance from cyber agencies in Australia, Canada, New Zealand, the UK and the US on managing AI token consumption. That guidance identified cyber defence, incident response and threat intelligence as priority areas for access to AI capacity, and advised organisations to preprocess and filter data before it reaches a model.
WitFoo argues that the assumption AI will steadily become cheaper is no longer holding in security operations. It points to constraints in chips, data centre capacity and electricity supply, and says security teams are among the largest users of AI because of the volume of data they generate.
The paper focuses on repetitive information in security logs. A single login event, for example, can appear across multiple logs, meaning organisations may pay repeatedly for an AI model to process the same underlying activity.
Its proposed approach uses a deterministic layer to deduplicate and normalise records before they are sent to a model. WitFoo says this removes more than 90% of the data volume while preserving links to the original evidence, leaving AI to analyse a smaller set of signals that merit closer attention.
In the paper's worked example, an organisation using an AI-first security architecture with annual spending of USD $3.28 million could achieve the same security outcomes for about USD $692,000. That would represent a 79% overall reduction, while AI inference costs alone would fall by 86%.
Agency guidance
The analysis follows joint guidance from the five national cyber agencies on operational resilience in AI usage. The document presents AI consumption not only as a cost issue but also as a resilience concern, reflecting the possibility that limited access to compute or rising token use could affect essential security functions.
WitFoo says boards, finance teams and investors are increasingly likely to treat AI spending in security as a recurring budget item rather than a temporary expense. The paper argues that organisations built around per-token or per-alert pricing may face higher renewal costs if pricing pressure persists.
Charles Herring, Chairman and Co-Founder of WitFoo, said the findings support the view that the economics of AI in security depend as much on data handling as on model choice.
"The cheapest AI token is the one you never have to send. Every security team is being asked to put AI to work, and the bill depends far more on what the model reads than on which model it is. The agencies have now said what practitioners already knew: shape the data first. Do that, and AI becomes affordable for the work that truly needs it," Herring said.
The paper also includes views from seven security practitioners, including Tom Cross, a cybersecurity expert and Adviser to WitFoo. Their comments focus on the budget pressure associated with storing and analysing large volumes of log data as more organisations apply AI tools to security monitoring.
"Log collection and storage is often one of the largest ticket items in security operations budgets. These costs are ballooning now that everyone wants to read all their logs with AI. It makes sense to preprocess log data to convert it into higher-level information that AI models can consume more rapidly and efficiently, and doing so frees up token budget needed for other critical security objectives," Cross said.
WitFoo expects pressure on AI capacity and pricing to continue through at least 2028, and argues that companies which reduce data volumes before sending information to models will be in a stronger position if those costs persist.