IBM 2026 Breach Report Finds AI Attacks Rising and Access Controls Lacking

Summary

IBM's 2026 breach-cost study, based on 602 organizations, reports a $4.99 million average breach cost. AI-driven attacks rose 56%, while 92% of AI-related breaches involved no proper AI access controls.

Key points

The Ponemon Institute study covered 602 organizations across 17 industries and interviewed 3,558 security and C-suite leaders about breaches from March 2025 through February 2026.
The global average breach cost reached $4.99 million, up 12% from the prior year.
AI-driven attacks increased 56%; more than one in four organizations experiencing a malicious attack attributed it to AI.
The report says 92% of AI-related breaches involved no proper AI access controls; 40% of organizations reported using access controls on AI models and data.
Shadow AI incidents more than doubled to 43%; nearly half reportedly led to data loss or compromise.
Organizations extensively using AI and automation across the security lifecycle had breach timelines 65 days shorter and average costs $1.93 million lower than organizations that did not.

Article Details

Publisher: Varonis Research
Report Period: March 2025–February 2026
Scope: Breach economics and AI-related security incidents across organizations in 17 industries.
Sample Size: 602 organizations; interviews with 3,558 security and C-suite leaders with firsthand knowledge of an organizational breach.
Key Statistics: The global average data-breach cost was $4.99 million, up 12% from the previous year.
AI-driven attacks increased by 56%; more than one in four organizations that experienced a malicious attack said it resulted from AI.
92% of AI-related breaches involved no proper AI access controls; 40% of organizations reported using access controls on AI models and data.
Shadow AI incidents rose to 43% from 20% the previous year; their average cost was $5.39 million, compared with $4.63 million the previous year.
Organizations using AI and automation extensively across the security lifecycle shortened breach timelines by 65 days and reduced average costs by $1.93 million compared with those that did not; 36% of breached organizations used them across prevention, detection, investigation, and response.
Recommendations: Apply least-privilege access controls to AI models, agents, and applications, based on the sensitive data they can reach.
Improve visibility into approved and shadow AI and monitor data access and leaks, with the ability to act in real time.
Apply AI and automation across prevention, detection, investigation, and response rather than concentrating use in only some stages.
Strengthen AI governance with strict deployment approval processes and coordination between governance and security teams.
For on-premises environments, maintain patching, physical security, and access management.

Vendors

IBMWhat is the IBM Cost of a Data Breach Report?VaronisIt's a pattern Varonis Threat Labs has been tracking this year, including Reprompt, a single-click Copilot exploit that silently exfiltrated data, and CoSnitch, which showed how a compromised AI assistant could be

Products

AI Gatewayand tool in your environment — including shadow AI — and enforces real-time policy through an inline AI Gateway, closing the visibility gap behind this year’s doubling in shadow AI incidents.CopilotIt's a pattern Varonis Threat Labs has been tracking this year, including Reprompt, a single-click Copilot exploit that silently exfiltrated data, and CoSnitch, which showed how a compromised AI assistant could be Varonis AtlasVaronis Atlas continuously discovers every AI model, agent, and tool in your environment — including shadow AI — and enforces real-time policy through an inline AI Gateway, closing the visibility gap behind this year’s Varonis Data Security PlatformThe Varonis Data Security Platform discovers and classifies sensitive data, maps blast radius, and automatically remediates excessive and stale permissions, so access controls are grounded in what data an identity —

Industries

EnergyBy industry, financial services and energy accounted for 62% of all AI-driven breaches studied, with average costs of $6.29 million and $5.2 million respectively.Financial ServicesBy industry, financial services and energy accounted for 62% of all AI-driven breaches studied, with average costs of $6.29 million and $5.2 million respectively.