AI-first firms face slower cyber recovery & higher costs

AI-first organisations are taking longer to recover from cyber incidents and reporting higher breach costs than peers that have adopted AI more cautiously, according to research published by Fastly.

In Fastly's global survey of IT decision-makers, AI-first businesses took nearly seven months on average to fully recover from a cybersecurity incident, 80 days longer than organisations that did not describe themselves as AI-first.

Fastly called the gap an "AI Speed Tax", linking the longer recovery time to operational and security pressures created by rapid AI deployment across infrastructure and business processes.

AI-first respondents also reported a greater financial impact from breaches. Losses from a large breach were more than 135% higher than those reported by non-AI-first organisations, the research found.

The survey also suggests a more direct link between AI systems and incident outcomes. Some 44% of AI-first organisations said AI was directly exploited in their most recent security incident, compared with 6% of non-AI-first organisations.

Attack surface

Fastly said the way organisations deploy AI can change what needs to be protected, pointing to AI-native systems that rely on new workflows and distributed data movement across environments.

"The speed of AI adoption is reshaping security infrastructure almost overnight. For AI-first businesses, the priority isn't to slow down innovation - it's to modernise security at the same rate that AI is transforming their infrastructure," said Marshall Erwin, Fastly's chief information security officer.

"That means securing AI and inference infrastructure, monitoring and throttling unwanted AI crawler activity, anticipating the rise of shadow AI and shoring up your outer perimeter," he said.

The report also highlighted governance and visibility issues as AI use spreads across teams and workflows. More than a third of AI-first organisations (34%) said AI use led to a security oversight or blind spot that contributed to their last incident, compared with 20% of non-AI-first organisations.

These findings reflect a broader challenge for security teams: AI tools can be adopted outside formal procurement or technology controls. That can make it harder to map where AI is used, what data it touches, and which systems it can access during day-to-day operations and incident response.

Scraping costs

Fastly also pointed to rising infrastructure spending linked to AI activity, particularly automated scraping. Nearly two-thirds of organisations (64%) said AI scraping had become a material cost centre.

The report put the average annual infrastructure impact from AI scraping at more than USD $348,000. For UK organisations, Fastly said this equated to roughly GBP £350,000 per company each year, based on the survey's reported average costs.

Cost was not the only reported effect. Some 43% of organisations said infrastructure expenses increased directly because of AI activity. A further 40% reported operational disruption, while 29% said issues affected online visitors, including slower load times and broken functionality.

Fastly framed these impacts as part of a shift in day-to-day risk management. "There is a major shift happening in terms of what organisations are responsible for defending," Erwin said.

"The challenge is no longer confined to malicious actors and isolated security incidents. Instead, it's about managing an infrastructure footprint that is growing rapidly and, often, invisibly," he said.

Security spending

The survey suggests organisations are responding by prioritising specific security controls. Respondents cited agentic discoverability, API security and web application firewalls as leading areas of investment (56%, 55% and 54%, respectively).

Concern about denial-of-service risk was also prominent. Three-quarters of respondents (75%) said they were concerned about distributed denial-of-service attacks targeting AI agents. More than half (53%) said they had a greater need for AI-specific security expertise.

"From unmonitored agentic activity to escalating scraping costs, the risks are real, operationally and commercially. As a result, Web Application and API Protection (WAAP) tools are becoming business-critical solutions because they provide essential visibility and control organisations need to secure innovation at the edge," Erwin said.

The research was based on a survey of 2,000 IT decision-makers with influence over cybersecurity at large organisations across the Americas, Europe and Asia-Pacific. Sapio Research conducted the online fieldwork in the fourth quarter of 2025.