When AI Security Costs Extra – Who Can Afford to Be Protected?

AI is often bought with a simple promise: less manual work, faster decisions and lower costs. But once a system moves beyond answering questions—searching data, using tools and completing bounded tasks—the calculation changes. A business is not only buying an AI service. It also has to decide who may use it, what it may access, how it will be monitored and who will respond when a warning signals that something is wrong.

Some of that protection comes with the product. Some may require a higher licence tier, a separate security service or more work from the organisation’s own IT and security teams. That does not automatically mean a vendor sold an unsafe base product, nor that every advanced security service should be free. But it makes one boundary important: which protections must be present from the start for a product to be used reasonably safely, and which are legitimate additional layers of defence-in-depth?

What is included is not the same as everything that is needed

It is easy to blur two different things. The first is essential security built into the product: secure defaults, identity, access control, logging and clear controls where they are needed for normal use. The second is defence-in-depth: additional monitoring, specialised threat detection, isolated execution environments, advanced analytics or protection in the infrastructure.

Both can be necessary in a particular environment, but they are not the same. An organisation with sensitive data, many external connections or its own AI agents may reasonably need more than an ordinary office licence provides. It becomes a problem, however, if a customer discovers only after buying the product that protection essential to its intended use sits in a different product, licence or administrative process.

That is also why it is misleading to compare vendors as though they were selling the same thing. A system for governing and monitoring AI agents, a filter for model inputs and outputs, an identity-controlled workspace and a security architecture operating close to the hardware serve different purposes. A price list says something about packaging, but not by itself which protection is best.

Microsoft shows how licensing can become concrete

Microsoft Agent 365 is a useful example because it is intended to bring together inventory, governance and security for AI agents. Microsoft lists the standalone service at US$15 per user per month with annual billing. It can also be included in Microsoft 365 E7. The licence is attached to a person, not to an agent. Not everyone in a company therefore needs it automatically.

Some foundational capabilities can be available at organisational level for eligible Microsoft Cloud customers, but activating Agent 365 requires at least one user with a qualifying licence. A business still has to decide which people and agent workflows need the more advanced controls.

Terms also changed for some agent-focused security capabilities in Copilot Studio and Microsoft Foundry on 1 July 2026. Microsoft says they then require an Agent 365-eligible licence. This includes the ability to discover agents, view security posture, receive threat alerts and investigate agent activity. For Foundry, it includes discovery, security posture and threat protection for cloud-hosted agents.

This is a verifiable change, but it does not prove that every organisation must buy every add-on. For small and medium-sized business customers, Microsoft states that Business Premium is required. To unlock Agent 365 functionality, it also says Defender Suite for SMB and Purview Suite for SMB are needed, while explicitly noting that those two add-ons are not formal prerequisites. What a customer already has in its licensing position determines what it may actually need to add.

The full cost of Business Premium, Defender or Purview is still not a pure AI-security charge. Those suites include broader identity, device, data and compliance functions. Yet for a company that wants to use agent features safely, they become part of a practical question: which licences are already in place, and which are missing?

A calculation without invented costs

Imagine a smaller company that wants to use AI agents in several workflows. It has 25 people who genuinely need Agent 365 protection because of how they use those agents. At Microsoft’s documented list price, the standalone Agent 365 line is US$375 per month, or US$4,500 per year, before tax, currency effects, contract terms and possible discounts.

That is a useful number, but not a finished budget. The company still needs to answer questions such as:

• Which base licences do we already hold, and do they meet the requirements for the Agent 365 capabilities we want to use?
• Which of the 25 users or agent owners actually need premium protection?
• Which security capabilities are already included, and which require Agent 365, Defender or Purview?
• Who sets access rights, configures policies and reviews the agents’ access?
• Who follows up on alerts, investigates incidents and keeps policies aligned as working practices change?
• How are employees trained to understand both the tool’s value and its limits?

The final questions often have no public price list. It would be dishonest to invent hours, salaries or incident costs. But they are still part of the real operating cost: configuration, administration, monitoring, training, recurring training and incident readiness all take time and responsibility. An AI service that appears inexpensive per user can become considerably less so if the business lacks the capacity to operate it safely day to day.

Security Priced by User, Usage or Tier

Other vendors illustrate different models. AWS charges for Amazon Bedrock Guardrails according to the protections that are activated. The service can combine several controls, including content filters, prompt-attack controls and sensitive-information filters. AWS defines a text unit as up to 1,000 characters; longer text is split into several units.

It is therefore misleading to speak of a single “guardrail price”. The controls have different functions and can be priced differently. AWS describes its prompt-attack control as helping to detect and filter jailbreaks, prompt injection and leakage. That reduces risk; it is not a guarantee that attacks can never succeed. AWS also says customers should continue to test and validate their guardrails.

Google offers a different example. Google Cloud describes Model Armor as protection for inputs and outputs to generative AI. In Gemini Enterprise, the service is available without an additional Model Armor charge in all editions. As a standalone service, it has a free tier of up to two million tokens per month, then costs US$0.10 per additional million tokens. The documentation describes screening for prompt injection, sensitive data and harmful links.

Operations still matter here. In Gemini Enterprise, customers can choose whether interactions should be allowed or blocked when the screening service is unavailable. Google also documents limits on which agent types are screened. Model Armor being included in a Gemini Enterprise subscription does not make it directly comparable with Microsoft Agent 365 or a specialist product from CrowdStrike. They address different parts of a larger security effort.

OpenAI and Anthropic: Why Product Distinctions Matter

With OpenAI, it is particularly important not to mix up the ChatGPT workspace and the API platform. ChatGPT Business includes, according to OpenAI, SAML SSO, MFA, central administration and the default setting that business data is not used for training. Enterprise adds documented organisational controls including SCIM, Enterprise Key Management, role-based access control, Compliance Logs Platform and IP allowlisting.

That does not mean “IP allowlisting requires Enterprise” in every OpenAI context. OpenAI documents separate IP allowlisting for API requests, available to API customers, and it does not apply to ChatGPT workspace access or sign-in. Similarly, API RBAC is a control for API organisations and the dashboard. A sound comparison has to ask which product is being used before drawing conclusions about which controls are included.

Anthropic also has a clear tier distinction. Claude Team is for groups of two to 150 users. A Standard seat costs US$20 per month with annual billing or US$25 month to month, according to Anthropic’s current pricing. Team includes central administration and SSO. Claude Enterprise has a stated price of US$20 per seat per month with annual billing, with a 20-seat minimum for self-service and 50 for sales-assisted purchases. Usage of Claude, Claude Code and Cowork is billed separately at standard API rates on top of the seat fee.

In addition to Team, Enterprise includes fine-grained role-based permissions, SCIM, audit logs, Compliance API, custom data-retention controls, network-level access control and IP allowlisting. That makes Enterprise an example of additional organisational controls; it does not mean Team is unsafe. The plans have different target users, use cases and levels of control.

Claude Code illustrates another kind of built-in product architecture. Anthropic describes a permission model in which the tool is normally read-only until a person approves changes, commands or other access. It also describes sandboxing with filesystem and network isolation. Anthropic connects this to the problem of approval fatigue: repeated approvals can make people stop examining them properly. This is Anthropic’s own product and observation description, not general proof of how all AI agents work. It does show why security may need to be built into how a tool is allowed to act, rather than added only afterwards.

When a separate specialist defence can be reasonable

It goes too far to treat every separate security product as proof that an AI vendor has left its customer unprotected. CrowdStrike and NVIDIA show why. On 21 October 2026, the companies said that CrowdStrike Falcon Guardian, which CrowdStrike describes as AI Detection and Response, is integrating with NVIDIA OpenShell. The same announcement describes an NVIDIA Sentry integration on BlueField-4 as a future step, not an already deployed customer capability.

The distinction matters. NVIDIA describes OpenShell as a reference architecture and secure runtime environment. Sentry and BlueField-4 are described as an additional layer for monitoring outside the agent environment and for stopping or isolating threats near the infrastructure. That is not the same as a finished Sentry integration already running for customers. It is also the companies’ own description of the architecture, not an independent security evaluation.

This kind of specialised defence-in-depth can be legitimate to buy separately. A company with higher risk, its own infrastructure or highly sensitive agent workflows may have different needs from a small team using an AI assistant in a limited workspace. The question is not whether everyone should receive the same advanced solution. It is whether the baseline required for the promised use is clear, manageable and reasonably accessible.

CISA’s principle: do not place all responsibility on the customer

There is a useful principle beyond vendors’ own price lists. In its secure-by-design guidance, CISA and partner agencies argue that vendors should take more responsibility for security from the start. The guidance highlights MFA for privileged users, modern-standard SSO and high-quality audit logs at no additional cost. In a later action, CISA noted that Microsoft made expanded logging available to federal customers regardless of licence tier.

That does not mean every advanced security product must be free. The policy principle makes no such general pricing rule. It does, however, sharpen a question: if a feature is necessary for a customer to detect, understand and manage serious risks in a product, should it be an expensive add-on or part of the secure baseline?

NextNet analysis: the security gap may begin in operations

It has not been shown that businesses at scale are already forgoing necessary AI security because it is too expensive. “Who can afford to be protected?” should therefore be read as an open question, not an established market outcome. Still, the risk of a gap is understandable: larger organisations more often have specialist roles, established identity and logging platforms, and time to test new control models. Smaller businesses may not have the same margins.

ENISA’s survey of small and medium-sized businesses preparing for the EU Cyber Resilience Act is not about AI-security purchasing. It therefore cannot prove that smaller businesses are choosing not to buy AI protection because of cost. It does provide relevant context: cybersecurity requirements meet practical limits in knowledge, resources and implementation capacity.

There is also a human dimension. Rapid AI adoption can require recurring training, changed workflows and attention to new risks. NextNet intends to examine separately how that transition affects workload and stress. This article does not claim that AI has already been shown to cause a general rise in work-related stress.

This article has not shown that small and medium-sized businesses already avoid necessary AI protection because it is too expensive. It has shown, however, that security may be built in, sit in a higher tier, be priced by usage or be bought as a separate specialist layer. Whatever the pricing model, internal work that rarely appears in the subscription price is added as well.

That is why a company’s AI calculation should begin with security and operations, not add them afterwards. The question is not only what AI costs. It is what it costs to use AI in a way the company can actually trust.

Even after a company has paid for additional protection, another question remains: who pays when that protection still fails? That question belongs in the next article in the series: Who Pays When Protection Fails?

💬 What do you think?

Which security capabilities should be included from the start when a business buys AI that can work in real systems?

Share your thoughts in the comments.

📚 Related articles