Introduction
The race to become “AI-first” is creating a cybersecurity crisis that most organizations are only starting to understand. Businesses that have moved fastest to integrate AI into their core operations are discovering a painful paradox: their speed is making them slower to recover when things go wrong, and far more expensive to fix when they do. The problem is not AI itself — it is AI adoption without the security infrastructure to support it.
Fastly partnered with research agency Sapio to survey 2,000 IT decision makers across 21 regions, and the findings are stark. AI-first organizations take 80 days longer to recover from security incidents than their peers, pay 135% more when incidents occur, and face a growing skills gap that leaves them exposed to threats they cannot yet name. This report examines why the fastest-moving businesses are the slowest to recover — and what can be done about it.
You Will Learn
- Why AI-first organizations take an average of 6.8 months to recover from incidents versus 3.9 months for everyone else
- How AI directly contributed to security incidents at nearly half of the AI-first businesses surveyed
- What shadow AI is doing to attack surfaces — and why sanctioned AI tools may be equally dangerous
- Why software bugs have overtaken external attackers as the leading cause of security incidents
- How AI scraping has become a material cost center, averaging over $350,000 annually per organization
- Where security investment dollars are actually going — and where the dangerous gaps remain
- Why more than half of AI-first businesses don’t know who is responsible when an incident occurs
- How the CISO role is expanding in accountability while shrinking in real authority
- What recovery improvement looks like for organizations that invested in post-incident reviews and automation
- How threat exposure differs dramatically by sector — and which industries are paying the steepest AI tax
Strategic Insight: Speed Without Security Is a Liability, Not an Advantage
The AI Tax Is Real and Measurable
Organizations that have publicly or informally committed to AI-first operations are paying a compounding penalty. Incident recovery takes nearly twice as long as it does for traditional organizations. Financial losses per incident consume more than double the percentage of annual revenue. And AI was directly exploited in 44% of the most recent incidents reported by AI-first companies. The gap between innovation ambition and security readiness has become a quantifiable business risk.
The Attack Surface You Built Is Now the Problem
AI tools don’t just expand what an organization can do — they expand what attackers can reach. Every AI agent integrated into infrastructure comes with permissions, and those permissions become attack vectors. Over a third of AI-first organizations identified AI usage as a contributing factor in their last security oversight. Shadow AI runs rampant in cultures that reward innovation, but sanctioned AI tools with excessive automated permissions present equal or greater risk. The identity and access management challenges organizations struggled with before AI have not gone away — they have multiplied.
Software Bugs Are Now the Number One Threat
For the first time, software bugs have overtaken external attackers as the leading cause of security incidents, now triggering 40% of all incidents surveyed. This shift signals a fundamental problem with how organizations build and deploy software at speed, particularly in AI-accelerated development environments. CI/CD pipelines catch tactical bugs but miss the architectural mistakes that give AI agents excessive privileges — and those require human judgment at the design stage, not an automated tool at the deployment stage.
The Accountability Crisis Is Getting Worse
When something goes wrong, 51% of AI-first businesses cannot clearly identify who is responsible for incident response. Yet when the dust settles, 79% of those same businesses say the CISO is ultimately held accountable. Policy responses have largely focused on legal protection and documentation rather than genuine security improvement. Organizations giving CISOs a seat at the table without giving them the resources and authority to act are creating accountability without enablement.
Governance and Challenges
The skills gap is widening as AI adoption accelerates. More than half of security teams lack AI-specific expertise, and traditional cybersecurity credentials do not transfer cleanly to protecting agentic infrastructure. Repeat incidents are common — two thirds of organizations suffered another incident within three months of recovery — suggesting that surface-level fixes are leaving root causes intact. Regulatory pressure is also increasing personal liability for security leaders in ways that policy cosmetics cannot address.
Implementation and Strategy
The report points toward a clear path: security by design rather than security bolted on after the fact. Organizations that embedded resilience into their AI strategy from the first architecture conversation reported faster, cheaper recoveries and stronger innovation confidence. Practical steps include investing in WAAP solutions that protect both scraping-exposed infrastructure and agentic API surfaces, implementing post-incident reviews and response automation, and addressing the skills gap through internal upskilling and cross-functional collaboration rather than relying on an external talent market that cannot supply what is needed.
Who Should Read This
This report is essential reading for CISOs and security leaders navigating expanded accountability and tighter budgets, IT and platform engineering teams building or securing AI infrastructure, C-suite executives evaluating the true cost of AI-first strategies, and risk and compliance leaders in finance, retail, media, government, and healthcare where sector-specific AI threats are already measurable.
Download The AI Speed Tax from Fastly to get the complete data breakdown by industry, region, and AI maturity level — and understand exactly what it costs to move fast without building security in from the start.
