More than one in four organizations hit by a malicious attack over the past year say AI drove it. Those breaches averaged about $1 million above the malicious attacks that ran without AI.
Defenders bought similar technology and aimed it somewhere else. Half of breached organizations put AI agents inside a security operations center, mostly on threat hunting, automated response and containment. Among that group, 18% aimed agents at vulnerability scanning and management, the work of finding and closing the holes attackers come through. Known exposures stay open longer, and the gap between discovery and exploitation keeps shrinking.
A frontier model announced in April 2026 found thousands of high-severity vulnerabilities, some of them in every major operating system and web browser. Attackers holding tools like it will collapse the time between vulnerability discovery and exploitation.
Ponemon Institute interviewed staff at more than 600 organizations breached between March 2025 and February 2026 for the annual IBM Cost of a Data Breach Report. The average breach in that sample cost $4.99 million, a record, up more than a tenth over the year before. Detection, escalation and lost business drove most of the rise. Breaches at US organizations averaged more than twice the global figure.
Healthcare stayed the costliest industry for a thirteenth consecutive year, with financial services close behind. Financial services and energy absorbed the heaviest concentration of AI-driven attacks.
Where the agents went
Alert-facing work drew the agents. Threat hunting leads, followed by automated response and containment, then threat investigation. Roughly a third of organizations leave AI and automation out of front-line prevention entirely, the work of identifying and patching vulnerabilities before anyone reaches them.
IBM’s first recommendation to breached organizations is to send agents into vulnerability management, “a soft target because of the capabilities of frontier AI models.”
“AI is making attacks faster and cheaper, while breaches keep getting more expensive,” said Suja Viswesan, VP, IBM Security Software. “When organizations have an extended gap between discovery and remediation, that imbalance shows up directly in breach costs. The priority now is to eliminate that lag—building remediation into development workflows, securing identity at runtime, and fixing risks at the speed attackers are already moving.”
Organizations running AI and automation across prevention, detection, investigation and response close breaches roughly two months faster and pay close to two million dollars less than the ones running none.
The AI systems were missing access controls
Roughly one in five organizations reported a security incident involving an AI model or application, up from about one in eight a year earlier. Among that group, 92% were missing role-based access, multifactor authentication and similar controls on their AI models and applications.
Identity and access management ranks second among all factors that lower breach costs, behind a DevSecOps approach. Two in five organizations apply access controls to their AI models and data.
Model inversion, where an attacker pulls sensitive training data back out of a model, produced the costliest AI incidents at $6.07 million. Prompt injection came next. Compromised APIs, connected applications and cloud misconfigurations rank among the most common root causes.
More than half of the organizations hit through an AI system reported direct financial loss. Operational disruption and unauthorized access to sensitive data followed, each named by more than four in ten.
Close to seven in ten breached organizations lack governance policies for managing AI or spotting unapproved use. Fewer than one in five coordinate their governance teams with their security teams.
Shadow AI doubled
Workers using unapproved AI tools figured in 43% of security incidents, more than double last year’s share. Those incidents cost more than they did a year ago. They ended in data loss or compromise about half the time and disrupted operations in four out of ten. About one in five drew a regulatory fine.
Attackers changed what they threaten
Deepfake impersonation drove the largest share of AI-driven attacks, close to half of them. AI-generated malware accounted for about a fifth, and IBM researchers report seeing it more often.
Ransomware reached close to four in ten breached organizations, extending a four-year climb. Threats to publish stolen data and shame the victim are now the most common form of pressure, ahead of encrypting systems.
Phishing led all entry points for a fourth consecutive year. The voice and SMS variety carried the highest average cost of any vector, with help desk impersonation next. In nearly one in ten breaches, someone copied data onto removable media and walked out with it.
Supply chain compromise, where a business partner becomes the attack path, adds more to a breach bill than any other single factor. Those breaches take the longest to identify and contain, tied with the removable media cases. Malicious and criminal attacks account for more than half of all breaches now, up from about half last year.
The clock went backwards
Mean time to identify and contain a breach rose to 247 days, reversing five straight years of decline.
Breaches that ran past the 200-day mark cost about a third more than the ones closed sooner. Data held on premises figured in the largest share of breaches by location, a share that has grown for two years running.
Internal security teams found close to four in ten breaches and closed them about five weeks faster than the global average. Attackers themselves disclosed roughly one in six, and those breaches cost the most of any discovery route.
More than half of breached organizations had left sensitive data unencrypted at rest and in motion. Another tenth could not say either way.
About four in ten reported complete recovery from their breach, up from a third last year. Fewer than one in twenty got there inside seven weeks.
What the budgets do next
Among breached organizations aware of the new model capabilities, 85% said they would raise security spending, up from about two thirds who said so on the strength of their own breach. Three quarters plan to deploy agents at higher rates in alert triage, vulnerability management, and scans and penetration testing. Planned agent coverage of vulnerability scanning runs at double the current share.
Fewer than half of organizations secure the non-human identities their AI workflows depend on. About a quarter have a post-quantum cryptography project underway, and a majority lack controls to monitor keys, certificates and algorithms across their environments.
A patch cycle runs in weeks. A model that reads source code finds the bug in an afternoon. The agents that could close that distance are working the alert queue.
Download: The high-performance team playbook