WitFoo paper says security teams can cut AI token costs by preprocessing data first

WitFoo says a new white paper shows how cybersecurity teams can comply with Five Eyes guidance on AI token consumption by filtering and shaping data before a model reads it. The company says the approach can reduce costs, preserve evidence and keep security operations within tighter AI capacity limits.

Why it matters: - Five Eyes agencies have put cyber defence, incident response and threat intelligence near the top of the queue for AI token availability. - The guidance warns security teams about token exhaustion and denial-of-wallet attacks that can drive up AI costs. - WitFoo says security teams can respond by reducing how much raw data they send to models, without losing evidence needed for defence.

What happened: - WitFoo published a white paper titled The AI cost collision in cybersecurity on November 3, 2026. - The paper responds to October guidance from the Canadian Centre for Cyber Security, the U.S. Cybersecurity and Infrastructure Security Agency, the Australian Signals Directorate’s Australian Cyber Security Centre, and the National Cyber Security Centres of New Zealand and the United Kingdom. - The agencies’ document, Managing AI token consumption for operational resilience, recommends preprocessing and filtering data before it reaches a model. - The agencies did not review the paper and do not endorse WitFoo or any product.

The details: - WitFoo Chairman and co-Founder Charles Herring said the industry should stop paying a model to read data it does not need. - Herring said security data is structurally redundant and that attackers can control part of what a security operations centre ingests. - The paper describes “empathetic processing” as a deterministic, security-aware layer that removes noise, deduplicates evidence and normalises context before model inference. - WitFoo says the filtered output is more than 90% smaller, while every record still points back to raw evidence. - The company says the approach is not sampling and does not discard security-relevant information. - In an illustrative example from the paper, the same security outcomes cost US$692,000 a year instead of US$3.28 million, a 79% reduction. - Five practitioners contributed on-record perspectives to the paper. - TK Keanini, cybersecurity technologist and author of tkonsecurity.com, said the engineering work should start before inference and that savings must not create a blind spot. - Rob Kehl, Senior Security Operations Specialist at Tower Insurance, said optimisation should use deterministic automation where reasoning is not required and reserve advanced AI for high-value analysis. - Tom Cross, cybersecurity expert and WitFoo advisor, said preprocessing log data into higher-level information can free up token budget for other security objectives.

Between the lines: - WitFoo is framing data reduction as a security control, not just a cost-saving measure. - The company is also aligning its product pitch with public-sector guidance that prioritises operational resilience over broad model consumption. - The paper’s focus on deterministic preprocessing suggests a strategy to keep AI in a narrower decision-support role rather than using it on every event.

What’s next: - WitFoo plans to demonstrate its AI harness at the launch of WitFoo Analytics 1.2.0 on Thursday, November 19, 2026. - The launch webinar is scheduled for 3:00 pm U.S. Eastern and noon U.S. Pacific on Wednesday, November 18, which is 9:00 am NZDT on Thursday, November 19. - WitFoo says the AI harness will use a customer’s own AI on facts WitFoo has already shaped and will operate within the permissions the customer has set. - WitFoo says it hosts no AI model of its own. - WitFoo, Inc. is also inviting verified accredited investors into a private placement of up to US$2.5 million under Regulation D, Rule 506(c). - The company says most of the raise is allocated to sales and channel enablement, product and engineering, and the commercial operations of WitFoo Limited, its New Zealand subsidiary. - WitFoo says none of the raise funds AI hardware. - The paper is free to read under a Creative Commons licence, and the company says interview requests can go to press@witfoo.com. - More information is available on WitFoo's invest page