AI-First Businesses Face Costly ‘AI Speed Tax’ in Cybersecurity Recovery, Fastly Report Warns

Fastly, Inc. has released its fourth annual Global Security Research Report, warning that AI-first businesses are paying a steep “AI Speed Tax” when recovering from cybersecurity incidents. These organisations, which integrate AI into core processes from the outset, take nearly seven months to fully recover—80 days longer than non-AI-first firms. The financial impact is also severe, with breach costs exceeding those of traditional businesses by 135%, driven by longer recovery timelines and AI-specific compromises.

AI Speed Tax

Nearly half (44%) of AI-first organisations reported direct exploitation of AI in their most recent incident, compared to just 6% of non-AI-first firms. In Southeast Asia, 69% of respondents said AI contributed to their latest cybersecurity incident, underscoring the region’s heightened exposure. AI scraping alone has become a costly burden, impacting 67% of Southeast Asian organisations with average annual infrastructure costs of USD372,330.

“AI is no longer a single tool – it’s becoming an integral part of business operations. This creates new challenges for security teams, from tracking its deployment to understanding its impact during incident recovery,” said Rachel Ler, AVP of Asia at Fastly.

“Companies that establish clear AI governance today will gain a decisive advantage tomorrow.” At the same time, practices such as AI scraping are adding cost and complexity to already stretched infrastructure, driving operational disruption and pushing spend into six-figure territory.

Malicious actors and isolated security incidents

“The speed of AI adoption is reshaping security infrastructure almost overnight. For AI-first businesses, the priority isn’t to slow down innovation, it’s to modernise security at the same rate,” said Marshall Erwin, CISO at Fastly. “That means securing AI and inference infrastructure, monitoring and throttling unwanted AI crawler activity, anticipating the rise of shadow AI and shoring up your outer perimeter.”

“There is a major shift happening in terms of what organisations are responsible for defending,” continued Erwin. “The challenge is no longer confined to malicious actors and isolated security incidents. Instead, it’s about managing an infrastructure footprint that is growing rapidly and, often, invisibly.”

The report highlights operational disruption, rising infrastructure expenses, data leakage, and degraded user experiences as top negative impacts. To counter these risks, businesses are investing in Web Application Firewalls, API security, and agentic discoverability tools. However, 83% remain concerned about DDoS attacks targeting AI agents, while many admit lacking AI-specific security expertise. Fastly urges organisations to modernise security at the same pace as AI adoption.

Business News