Tokenmaxxing won't fly in APAC. How to shrink AI spend without limiting security

Asia Pacific firms are projected to outspend the rest of the world on AI. KPMG's Global AI Pulse survey puts the region's average investment at US$245 million over the next 12 months, putting Asia Pacific ahead of other markets and well above the global average of US$186 million.. Security is a significant part of that investment. IDC forecasts total security spending in the region (excluding Japan) will reach US$39.5 billion in 2026 and US$52.4 billion by 2029, with 39% of enterprises planning to apply AI or GenAI to threat detection and analysis within the next 12 months.

Here's what most of those teams will come to realise in practice: the most capable models cost too much to run on routine, high-volume work. Usually, the lesson lands after the first invoice arrives.

I lead a security operations team at GitLab, and I've brought detection costs down to roughly a dollar a day for trust and safety work. That number surprises people. Enterprise AI is supposed to be expensive. It isn't, if you design the work correctly. The teams burning through budget in the region are skipping the design decisions that determine which cases should ever reach a model at all.

Narrow the pipe before it reaches the model

Detection funnelling isn't new. Before LLMs, security teams built layered filters to narrow high-volume event streams down to the cases worth a human analyst's time. The same logic applies to AI spend. The narrower and more precise the funnel feeding your models, the lower your cost per accurate outcome.

In trust and safety, most abuse is identifiable before any model runs. Deterministic, rules-based pattern detection captures a significant portion of volume upfront. Account age, email provider, behavioural signals all feed automated filters that resolve the obvious cases and narrow what remains. Only the subset that clears those filters reaches an LLM. That's where the dollar-a-day figure comes from. A well-designed funnel keeps expensive work to a minimum.

Think of it like a home security system. You don't need a camera monitoring everyone who walks past your house. You care once someone's actually inside, and that's when you bring in the higher capability response.

Match the right model to the job

For cases that clear the initial funnel, a lightweight model handles the first pass. The output is structured - a malicious or benign determination at high or low confidence. High-confidence outcomes resolve automatically, while low-confidence cases escalate to a more capable model with broader context and stronger reasoning.

Only a fraction of events reach that second tier. We ran structured efficacy testing across model options and found only a 1-2% accuracy difference between lightweight and frontier models for our use cases. Frontier models cost roughly five times more per token. That math only works if the cases reaching them need that capability.

Prompt engineering matters as much as model selection. One prompt I wrote for agentic detections runs over 1,900 words, covering every scenario the agent is likely to encounter, including when to escalate and when to act autonomously. Not every case needs that depth. Some trust and safety prompts are two or three sentences, but the scope of what you're asking an agent to handle determines the precision the prompt requires.

Context is what separates accurate AI analysis from hallucination. Give a model an abuse report and ask whether the user is abusive, and it may take the report at face value. Give it the actual artifact being reported alongside the report, and it can assess independently whether the claim holds up.

Where human judgement is required

Automation handles the clear cases. It's the ambiguous ones that need judgment that agents don't yet have.

Distinguishing a legitimate security researcher who hosts malware samples for analysis from a malicious actor hosting the same content to target others requires discernment AI still struggles with. So does a dispute in an issue thread where the terms-of-service could be interpreted differently. These cases reach a human because the question itself requires contextual reasoning the current generation of agents can't reliably provide.

The goal is to give human reviewers the time to spend on the cases that actually need them. Instead of clicking through individual events, engineers on my team are building the systems, writing the prompts, and defining the patterns that orchestrate detection at scale.

Treat cost as a design decision

Attackers try new obfuscation techniques, and we adapt prompts and models to catch them. It's iterative work, closer in spirit to detection engineering than a one-time deployment. Prompt engineering is just another form of that: write the rule, test the output, tune when accuracy slips.

For APAC security teams, the stakes are unusually high. Asia Pacific remains one of the world's most attacked regions. Meanwhile, the region's talent gap is real: only 7% of APAC enterprises consider themselves highly experienced in the governance and compliance skills these systems demand. Applying frontier models to every alert won't close either gap. It simply shifts the constraint from headcount to AI spend.

The cost question is solvable if you treat it as a design problem from the start. How much reaches a model, in what form, and with what context determines the bill. Most APAC teams that find AI expensive haven't made those decisions deliberately.