Versa Field CISO on AI Agent Costs

Prasad Tharippala, Field CISO at Versa, told Help Net Security that running open-weight models in a company’s own environment can look attractive, but it shifts a huge amount of responsibility onto the organization.

Hidden Operational Burden

When a business brings an open-weight model into its own data centre, it does not automatically become more secure. The real cost emerges from the surrounding infrastructure: GPU servers, networking, storage, power, cooling, capacity planning, orchestration, and continuous monitoring. Licensing is another hidden expense. Even open-weight models can carry usage restrictions, and regulatory frameworks such as the EU AI Act impose obligations on large models. Every update to the model or its adapters requires re-validation, turning compliance into an ongoing cost.

Tharippala noted that the skills gap is often underestimated. Teams need specialists in AI/ML infrastructure, GPU and Kubernetes operations, site reliability, AI security, red-team testing, identity and data governance. Relying on existing security or infrastructure staff can delay delivery or even halt the project before it delivers business value.

GPU utilisation is a frequent blind spot. Idle capacity or unpredictable spikes can drive up costs. Techniques such as quantisation, multi-tenant GPU sharing, batching, and demand forecasting can reduce waste. The economics shift dramatically when inference resources are shared efficiently.

A disciplined strategy, right skill set, and clear data-sensitivity goals should guide the build-vs-buy decision. Many organisations adopt a hybrid model, running some workloads in-house while consuming others as a managed service.

Red-Team Testing Before Production

Red-team exercises for AI agents must go beyond traditional penetration testing. Tharippala outlined a checklist: prompt injection, indirect prompt injection, excessive permissions, data leakage, unauthorized tool use, privilege escalation, unsafe actions, memory manipulation, cross-agent trust abuse, supply-chain vulnerabilities, and resource exhaustion. The list aligns with OWASP guidance for agentic applications and MITRE ATLAS.

A key point is the handoff between agents. An output that seems harmless when produced by one agent can become dangerous when another agent acts on it. Therefore, testing must cover the entire chain of agents, infrastructure, APIs, identity layers, and human approval steps.

The exercise should involve AI specialists who understand model behaviour and security professionals who know attack paths and enterprise risk. The duration varies: a simple agent may be assessed in days; a production agent tied to sensitive systems can require weeks of iterative testing. Any change to the model, system prompt, tools, permissions or connectors triggers targeted retesting.

A failure is not merely a bad answer. It occurs when an attacker can breach the agent’s security boundary, accessing data it should not see, invoking disallowed tools, bypassing authorisation, or taking a consequential action without controls. If such a breach happens without detection or an audit trail, it is a worse failure.

Telecom Operators and Inference Scale

Telecom operators often focus on power and GPU capacity, but Tharippala says the real challenge is operational predictability. AI inference workloads are variable in compute, latency and concurrency, making it hard to maintain high-availability service levels across thousands of edge sites.

Isolation is another concern. Shared infrastructure across enterprise and government customers can expose data if AI workloads are not properly isolated. Data sovereignty and lawful-intercept obligations add further complexity, prompting some operators to consider sovereign deployment options.

When AI becomes part of network operations, the failure domain expands. Operators must plan for capacity, isolation, failover, observability and resource contention.

The discussion echoes the stats of GPU utilisation in enterprise environments and the need for a dedicated squad to manage AI workloads. Tharippala’s insights highlight that a small budget and 90 days can buy inventory optimisation, blast-radius reduction and ongoing testing, but only if the organisation understands the full scope of hidden costs and operational challenges.