IBM’s Cost of a Data Breach Report 2026: AI Is Now the Attacker and the Target

Key takeaways

• AI-driven attacks rose 56% since last year's Report, with shadow AI incidents more than doubling to 43%. 

• The majority of AI-related breaches (92%) involved no proper AI access controls, making access and governance gaps the real driver of AI breach costs.

• Organizations that applied AI and automation extensively across their security lifecycle cut breach costs by $1.93 million.

What is the IBM Cost of a Data Breach Report?

IBM's Cost of a Data Breach Report 2026, researched independently by Ponemon Institute, is the security industry's longest-running benchmark for breach economics. 

This year's edition studied 602 organizations across 17 industries, drawing on interviews with 3,558 security and C-suite leaders with firsthand knowledge of a breach at their organization between March 2025 and February 2026.

The global average cost of a data breach reached a new record this year — $4.99 million, up 12% from last year. 

The rise of machine-speed attacks

The rise of AI has brought about the rise of AI-driven attacks, which increased by 56%. More than one in four organizations that experienced a malicious attack this year said it resulted from AI. 

Deepfake impersonation and AI-generated malware were behind most of that volume, and the financial consequence was direct, adding an average of $1 million per breach.

How AI lowered the bar for a convincing attack

Generative AI has lowered the cost, time, and skill required to launch a convincing attack, and attackers are now running them continuously and at scale rather than as isolated attempts.

It's a pattern Varonis Threat Labs has been tracking this year, including Reprompt, a single-click Copilot exploit that silently exfiltrated data, and CoSnitch, which showed how a compromised AI assistant could be turned into its own data leak. Both attacks required a single click to succeed, and neither relied on stolen credentials or custom malware — a sign of how little technical skill a modern AI exploit now demands.

The most expensive attacks target what surrounds the model 

Among organizations that reported an AI-related breach, the root cause was rarely the model itself. Instead, it turned out to be the environment around it: compromised APIs, connected applications, and cloud misconfigurations. 

The costliest security incidents were inversion attacks, which averaged $6.07 million, and prompt injection attacks, which averaged $5.89 million. These are attacks on trust in the system itself, which pushes remediation past technical recovery into governance and disclosure.

Varonis Threat Labs has also documented this pattern — its SearchLeak research found that a Copilot exploit let an attacker inherit the victim’s full permissions, not because the model was flawed, but because of what it was connected to.

Most AI-related breaches had no AI access controls

This year's report found that 92% of AI-related breaches involved no proper AI access controls, and only 40% of organizations reported using access controls on AI models and data at all. That gap should carry the most weight with security leadership, since it points to the single clearest driver of AI breach costs. 

Still, it persists despite identity and access management being reported as one of the most effective cost reducers across breaches overall, suggesting the issue has more to do with execution than awareness. 

Governance gaps compound the access control problem

AI governance — covering access controls for models, agents, and applications, plus monitoring for data leaks — was absent at 68% of breached organizations this year (up from 63% last year). Only about a third of organizations with any AI policy had strict approval processes for deploying it, and just 19% reported that governance and security teams actually coordinate with each other.

AI systems have outpaced the access models meant to govern them. But it's access control that determines whether an AI system can reach sensitive data in the first place — which is exactly the gap Varonis’ guidance on least privilege for AI agents is built to close.

Shadow AI incidents more than doubled

Security incidents involving shadow AI — employees using AI tools that were never approved or reviewed — more than doubled to 43% this year (up from 20% last year), and these incidents also got more expensive, averaging $5.39 million compared to $4.63 million last year. Nearly half led to data loss or compromise, and regulators are starting to respond: about one in five shadow AI incidents this year resulted in a reported fine.

Shadow AI is less an AI problem than a visibility problem AI has made urgent. The fix isn’t a policy memo telling employees to stop — it’s visibility into what’s touching sensitive data, approved or not, paired with the ability to act on that in real time.

Critical infrastructure and on-premises data remain high-risk targets

By industry, financial services and energy accounted for 62% of all AI-driven breaches studied, with average costs of $6.29 million and $5.2 million respectively. Both sectors identify and contain breaches roughly four weeks faster than the global average, but their deep interdependence with the rest of the economy means a disruption in one doesn’t stay contained to a single balance sheet.

Breaches involving on-premises data storage also grew this year, now present in 30% of breaches, up from 28% last year and 20% in 2024. Although many organizations still treat on-premises storage as inherently safer than the cloud, this year’s data doesn’t support that belief. On-prem environments place the full burden of patching, physical security, and access management on internal IT with no shared responsibility model to offset it.

AI and automation remain the most effective cost reducer

Combating AI-driven attacks requires AI and automation. Organizations that used both extensively across their security lifecycle shortened breach timelines by 65 days and reduced average costs by $1.93 million compared to those that did not — the strongest cost-reduction signal in this year's report.

But the catch is “extensively.” Only 36% of breached organizations applied these tools across prevention, detection, investigation, and response, and most of that use clustered in detection and investigation.

Half of breached organizations have deployed AI agents in their SOC, yet only 18% have applied them to vulnerability scanning and management — exactly where frontier model capabilities are shifting the advantage toward attackers. Varonis’ own Triage Agent research points to the same conclusion: Agentic AI delivers the most value when it’s applied across the full investigation lifecycle, not merely one stage of it.

What this means for security teams building AI programs

Taken together, these findings point to one conclusion: control over where AI systems run, how they process data, and who can access them has become a baseline security requirement.

More than half of organizations now plan to invest in AI security and governance tools following a breach — an 88% increase from last year — and 85% plan to increase security spending specifically in response to frontier AI model threats.

How Varonis helps close the AI access control gap

The report’s clearest signal is also its most actionable: access control, not model sophistication, is what separates costly AI breaches from contained ones. Varonis addresses that gap directly, treating AI security as data security, so access decisions account for both what an AI system can do and what sensitive data it can reach:

• Varonis Atlas continuously discovers every AI model, agent, and tool in your environment — including shadow AI — and enforces real-time policy through an inline AI Gateway, closing the visibility gap behind this year’s doubling in shadow AI incidents.

• Agent intent-based access control compares what an agent was asked to do against what it actually reaches for, enforcing least privilege at runtime rather than only at provisioning — directly addressing the 92% access-control gap behind this year’s costliest AI breaches.

• The Varonis Data Security Platform discovers and classifies sensitive data, maps blast radius, and automatically remediates excessive and stale permissions, so access controls are grounded in what data an identity — human or AI — can actually reach.

• Varonis automatically executes more than 200 million remediation actions every month, giving security teams the automated, continuous enforcement this report shows most organizations still lack.