Filtering Data Before AI Cuts Security Costs 79%, WitFoo Says

Security vendor WitFoo claims that filtering and deduplicating data before it reaches AI models can cut the cost of AI-driven security operations by 79%, according to a new white paper. In a worked example, an organisation spending USD $3.28 million a year on an AI-first security architecture could achieve the same security outcomes for roughly USD $692,000. AI inference costs alone would fall by 86%.

The claim arrives at a moment when security teams are wrestling with the economics of applying large models to vast stores of log data. The stakes are both financial and operational: national cyber agencies have begun treating AI consumption as a resilience issue, not merely a line item.

What does the research actually say?

WitFoo has published a white paper examining rising AI costs in security operations centres. Its central argument is that the long-standing assumption AI will steadily become cheaper no longer holds in this domain. The company points to constraints in chips, data centre capacity and electricity supply as the forces keeping prices elevated.

Security teams sit at the sharp end of this problem. According to WitFoo, they rank among the largest users of AI because of the sheer volume of data they generate — logs, alerts and telemetry that pile up continuously across an enterprise.

The paper's specific target is repetitive information in security logs. A single login event, for example, can appear across multiple logs. Under per-token pricing, that means an organisation may pay repeatedly for an AI model to process the same underlying activity.

The numbers in the worked example:

• Annual AI-first security spending: USD $3.28 million
• Equivalent spend after preprocessing: about USD $692,000
• Overall reduction claimed: 79%
• AI inference cost reduction claimed: 86%
• Data volume removed by the preprocessing layer: more than 90%

A 79% saving on the headline bill is a vendor's own worked example, not an audited result from a third party. The paper does not specify which models, which token prices or which workload mix the example assumes.

How is the filtering supposed to work?

WitFoo proposes a deterministic layer — a fixed, rule-based processing step — that deduplicates and normalises records before they reach a model. Deduplication strips repeated copies of the same event; normalisation converts different log formats into a consistent structure.

The company says this step removes more than 90% of data volume while preserving links to the original evidence. The AI model then analyses a smaller set of signals that merit closer attention, rather than re-reading the same activity dozens of times across separate logs.

The approach matters because it shifts cost control from the model side to the data side. Teams shopping for cheaper models or negotiating token rates have limited leverage; teams that shrink what they send to a model control the input directly. That is the paper's thesis in plain terms: the size of the input, not the choice of model, drives the bill.

What have the cyber agencies said?

The white paper builds on joint guidance from cyber agencies in Australia, Canada, New Zealand, the UK and the US on managing AI token consumption. That guidance is the policy backdrop that elevates this from a vendor cost pitch to a broader operational question.

The agencies' document identified three priority areas for access to AI capacity: cyber defence, incident response and threat intelligence. It also advised organisations to preprocess and filter data before it reaches a model — precisely the practice WitFoo's paper quantifies.

The guidance frames AI consumption as more than a cost issue. It raises resilience concerns: if access to compute becomes limited, or token use rises faster than budgets, essential security functions could suffer. A security operations centre that depends on continuous AI processing has a dependency that can be squeezed.

Takeaway: five national agencies have already endorsed data preprocessing as standard practice for AI-dependent security operations.

Who is behind the numbers?

Charles Herring, Chairman and Co-Founder of WitFoo, said the findings support the view that the economics of AI in security depend as much on data handling as on model choice.

"The cheapest AI token is the one you never have to send. Every security team is being asked to put AI to work, and the bill depends far more on what the model reads than on which model it is. The agencies have now said what practitioners already knew: shape the data first. Do that, and AI becomes affordable for the work that truly needs it," Herring said.

The paper also includes views from seven security practitioners. Among them is Tom Cross, a cybersecurity expert and Adviser to WitFoo, whose comments focus on budget pressure from storing and analysing large log volumes as more organisations apply AI to security monitoring.

"Log collection and storage is often one of the largest ticket items in security operations budgets. These costs are ballooning now that everyone wants to read all their logs with AI. It makes sense to preprocess log data to convert it into higher-level information that AI models can consume more rapidly and efficiently, and doing so frees up token budget needed for other critical security objectives," Cross said.

Cross's framing adds a nuance the headline figure does not capture: the saving is not only about spending less. Freed token budget can be redirected to other critical security objectives — more analysis, not just cheaper analysis.

Why does the budget framing matter?

WitFoo argues that boards, finance teams and investors increasingly treat AI spending in security as a recurring budget item rather than a temporary expense. That shift changes how renewal negotiations play out. Organisations built around per-token or per-alert pricing may face higher renewal costs if pricing pressure persists — a structural exposure, not a one-off price increase.

The company expects pressure on AI capacity and pricing to continue through at least 2028. On that timeline, a security programme that sends raw, duplicated logs to a model every year compounds the cost problem annually. A programme that strips 90% of the volume before inference changes the cost base permanently.

What should readers weigh?

The paper comes from a vendor that sells into this problem space, and the 79% figure rests on a single worked example with undisclosed assumptions. The paper does not publish the underlying data volumes, token prices or benchmark comparisons that would let an outsider reproduce the arithmetic. The seven practitioner contributions lend field perspective but are not independent verification.

What is verifiable is the policy direction. Five national cyber agencies have told organisations to preprocess and filter data before it reaches a model, and they have flagged compute access as a resilience risk for essential security functions. WitFoo's contribution is to attach a number to that advice — 79% in one scenario, 86% on inference alone.

If AI capacity and pricing pressure do persist through 2028, as WitFoo expects, the companies that cut data volumes before models see them will hold the stronger negotiating position at every renewal.