IBM's Cost of a Data Breach Report 2026, published on 29 July 2026 and conducted by Ponemon Institute, puts the global average cost of a breach at a record USD 4.99 million, up 12%. For security teams, the AI findings are the part worth reading twice, and five of them matter most. Security incidents involving shadow AI more than doubled to 43%, and breaches with shadow AI averaged USD 5.39 million. AI-related breaches, meaning those that involved an organization's own AI models or applications, reached 21% of organizations, and 92% of those organizations lacked proper AI access controls. Model inversion and prompt injection were the costliest AI incident types, at USD 6.07 million and USD 5.89 million on average. 68% of breached organizations lacked AI governance, and only 19% reported coordination between their governance and security teams. And just 46% secure the non-human identities that operate inside AI workflows. Together, they point less at the model than at the access, identity and oversight around it.
This is the AI-focused reading of the report. It is not a general summary.
What is the study, and how far should you trust it?
This is the 21st edition. Ponemon Institute ran the research, and the report is "sponsored, analyzed and published by IBM." The sample is 602 organizations that suffered a breach between March 2025 and February 2026, across 17 industries and 16 countries and regions, with breaches ranging from 2,590 to 115,380 records. The researchers conducted 3,558 interviews. In May 2026 they went back to the same organizations with questions about frontier AI threats, and 456 of the 602 responded (p.5, pp.68-70).
The report states its own limits plainly, and so should we. The sample is nonstatistical, so there are no confidence intervals. The sampling frame is, in the report's words, "biased toward organizations with more mature privacy or information security programs" (p.70). Years in the report refer to the year of publication, not necessarily the year the breach happened (p.5). Treat the figures as directional. Our own reading, which the report does not test: if the frame leans toward mature programs, the AI control gaps it finds are unlikely to be smaller in a typical enterprise.
How much does shadow AI cost when a breach happens?
The report defines shadow AI as the situation "where workers use unapproved AI." Security incidents involving it more than doubled, to 43% from 20%. Breaches that involved shadow AI averaged USD 5.39 million, against USD 4.63 million in the 2025 edition (pp.46-47).
The impacts IBM recorded for those incidents were broad: data loss or compromise in 49%, operational disruption in 42%, reputational damage in 35%, increased security costs in 32% and regulatory fines in 21%. The fines question was new this year, and the report adds that "in about one in five incidents, organizations reported paying a fine" (p.47). Anyone who owns compliance evidence should note that one.
The cost-factor analysis tells the same story from another angle. Lack of visibility into the number and location of applications, which IBM labels shadow IT, added USD 201,165 to the average breach (pp.50-51).
Unapproved use is rarely malicious; it is people solving a problem with the closest tool. Agents make it harder to see, because an agent wired up last quarter keeps running whether or not anyone remembers it. Outside IBM's data, a Cloud Security Alliance survey commissioned by Token Security found that 82% of organizations discovered previously unknown AI agents in the past year (April 2026). Our shadow AI hub covers the discovery methods in detail.
What went wrong in breaches involving AI models and applications?
21% of organizations reported a breach involving their AI models or applications, up from 13%, which the report calls "a 61% increase." Another 73% said no, and 6% were unsure. Those breaches cost more: USD 5.33 million on average, against USD 4.70 million for breaches that did not involve AI or where the organization was unsure (pp.40-41).
The control failure is stark. Among organizations with an AI-related breach, 92% lacked proper AI access controls, and the report spells out what it means: "Those controls include role-based access and multifactor authentication" (p.42). Across the whole sample, only 40% reported using access controls on AI models and data (p.6). These are not exotic controls.
IBM broke the AI-related breaches down by incident type (Figure 27, in the AI section on pp.40-45). The shares add to more than 100%, which suggests one breach can be counted under several types.
| Incident type | Share of AI-related breaches, 2026 | Average cost (USD million) |
|---|---|---|
| Model inversion | 25% | 6.07 |
| Prompt injection | 25% (17% in 2025) | 5.89 |
| Cloud security misconfigurations | 27% | 5.25 |
| Malicious model | 18% | 4.94 |
| Model evasion | 17% | 4.72 |
| Compromise of connected apps, APIs or plug-ins | 27% (30% in 2025) | 4.37 |
| Insecure deployment | 20% | 4.34 |
| Data poisoning | 26% (15% in 2025) | 4.32 |
Two patterns sit in that table. The most expensive incidents are attacks that work through the model: model inversion extracts what a model learned, and prompt injection turns untrusted text into instructions. The most frequent incidents are plumbing: cloud misconfigurations and compromised connected apps, APIs and plug-ins, at 27% each. Prompt injection grew from 17% to 25% of AI-related breaches, and data poisoning from 15% to 26%. Our prompt injection guide covers the mechanics and the defense layers.
IBM's executive summary draws the conclusion itself. The incidents "were less about model selection than model and environmental security," and root causes were "often structural: compromise of connected APIs, applications and cloud misconfigurations, indicating governance failures," and, in the summary's closing words, "not model risk" (p.5). Choosing a safer model would not have prevented most of these.
How wide is the AI governance gap?
68% of breached organizations lacked AI governance to manage AI or detect shadow AI, up from 63% last year. Only 32% had policies in place. 35% had none, and 33% were still developing them, against 22% in development last year (pp.48-49).
The controls in use are thin (Figure 32). 38% use strict approval processes for AI deployments, down from 45% in 2025. 33% use AI governance technology and 33% a governance framework; 29% run regular audits for unsanctioned AI, down from 34%. Coordination between governance and security teams, asked about for the first time, came in at 19%.
That 19% is the figure to take to your next steering meeting. A governance committee can approve a tool with conditions, such as no customer data and no source code, but unless security enforces those conditions at the point of use, the approval is a document and nothing more. Two of the controls also moved the wrong way: fewer organizations use strict approval and fewer audit for unsanctioned AI than a year ago. Noncompliance with regulations added USD 201,112 to the average breach in the cost-factor analysis (pp.50-51). For how to report progress to a board in measurable terms, see our AI governance KPI pack.
Why do non-human identities and agents belong in this conversation?
Only 46% of organizations secure non-human identities in AI workflows (p.62). Among that 46%, the most common measure is machine identity inventory and lifecycle management, at 55%. Secrets management follows at 39%, then behavioral monitoring at 36%, zero trust extended to non-human identities at 32%, and role-based access control on service accounts at 30%.
A non-human identity is any credential that is not a person: a service account, an API key, an OAuth token, or an agent acting for someone. The cost factors show why that matters. Mismanaged secrets and keys added USD 198,933, and excessive privileges and poor role management added USD 177,313. Identity and access management was among the largest cost reducers, at USD 225,622 below the average (pp.50-51).
IBM's second recommendation is to shift identity security to continuous, runtime verification, covering agent discovery and onboarding, authentication delegation and authorization, anomaly detection and risk remediation, and governance and lifecycle controls (pp.64-65). Our piece on agentic identity sets out why per-action authorization matters for agents.
How are attackers using AI against you?
More than one in four organizations hit by a malicious attack said it was AI-driven, a 56% increase over last year. Figure 20 shows 25% AI-driven, 64% not, and 11% unable to tell. Of the AI-driven attacks, 45% were deepfakes or impersonation, 19% AI-enabled malware, 17% AI-generated phishing or other communication, and 19% something else (pp.36-37).
They cost more. A malicious AI-driven attack averaged USD 6.04 million against USD 5.03 million for one that was not AI-driven, which the report sums up as USD 1 million added. 62% of AI-driven breaches hit critical-infrastructure sectors, mostly financial services and energy (p.6, pp.36-37).
Most of the defense here is not AI governance. It is callback verification for payment and access requests, phishing-resistant authentication, and endpoint detection.
What does AI on the defender's side save?
Here the news is good. 36% of organizations used security AI and automation extensively, up from 32%. Their breaches averaged USD 4.00 million against USD 5.93 million for organizations with no use, a saving of USD 1.93 million. Limited use averaged USD 5.05 million, a saving of USD 880,000. Extensive users identified and contained breaches in 215 days against 280, which is 65 days faster (pp.52-55).
Half of breached organizations with a security operations center deploy AI agents in it, and 74% have rethought if and where they deploy them because of frontier AI threats (p.60). Defensive agents are still agents, with the same need for identities, owners and logs.
Which control answers which finding?
| Finding | Figure (page) | What it implies | Control that addresses it |
|---|---|---|---|
| Shadow AI in security incidents | 43%, from 20%; USD 5.39M (pp.46-47) | Unapproved tools are on the breach path | Continuous discovery of AI tools and agents, then sanction, restrict or block |
| AI-related breaches without access controls | 21% of organizations; 92% lacked controls (pp.40-42) | AI systems are exposed through ordinary access gaps | Role-based access and MFA on AI models and data |
| Costliest AI incident types | Model inversion USD 6.07M; prompt injection USD 5.89M (Figure 27, pp.40-45) | What enters and leaves the model is the attack surface | Inline inspection of prompts and agent actions, plus checks on responses |
| Structural root causes | Cloud misconfigurations and connected apps 27% each (Figure 27, pp.40-45; p.5) | The surrounding environment fails first | Cloud posture management and review of APIs and plug-ins |
| Governance gap | 68% without AI governance; 19% coordinate (pp.48-49) | Policy is written apart from enforcement | One review that approves a tool and sets its enforced rules |
| Non-human identities | 46% secure them in AI workflows (p.62) | Agents act with credentials nobody owns | Agent identities with named owners, lifecycle and secrets management |
| AI-driven attacks | USD 6.04M vs 5.03M (pp.36-37) | Impersonation works on people and processes | Out-of-band verification, phishing-resistant MFA, EDR |
| Fines after shadow AI incidents | About one in five (p.47) | Regulators ask for evidence | An event log of AI use that can be produced on request |
What should security teams do this quarter?
- Build an inventory of AI tools and agents, including the unapproved ones. A list of sanctioned tools alone misses the 43%.
- Put access controls on AI models and data. Role-based access and MFA, the two controls IBM names, on every model endpoint, vector store and AI admin console.
- Inspect inline, before data reaches a model, and check what comes back. Redact or block sensitive data in prompts and agent actions, and check responses for leaked data and unexpected tool calls. IBM's third recommendation includes "monitoring how data enters, transforms within and exits AI systems" (pp.64-65).
- Put governance and security in one review. The same meeting that approves a tool should set the rules that security enforces, so the 19% problem does not apply to you.
- Give every agent an identity, an owner and a lifecycle. No shared credentials, secrets in a vault, and a decommissioning step when the project ends.
- Log every AI event. Who used which tool, what was redacted or blocked, what an agent did. That record shortens investigations and answers regulators. Our guide to the AI agent audit log covers what to capture and how to keep it tamper-evident.
If you want a dollar estimate for your own environment to set beside IBM's averages, our free AI agent risk calculator estimates annual AI risk exposure in dollars, which is useful when a budget request has to speak the same language as this report.
Where does a product like AccuroAI fit, and where does it stop?
AccuroAI covers three of the controls above. It discovers AI tools and agents in use, including unapproved ones, across more than 1,400 AI tools. It inspects prompts and agent actions inline and redacts or blocks sensitive data before it reaches a model, without TLS interception, enforcing at the point of use. And it logs every event as audit evidence.
It is not a SIEM, an EDR or an IAM platform. It does not fix cloud misconfigurations, which IBM found in 27% of AI-related breaches, and it will not stop a deepfake phone call. No tool makes an organization compliant with a law.
Frequently asked questions
What is the average cost of a data breach in 2026?
USD 4.99 million globally, up 12% and a record, according to IBM's 2026 report. The 2025 figure was USD 4.44 million. The US average was a record USD 11.5 million (p.6, pp.10-12).
How much does shadow AI add to a breach?
IBM reports USD 5.39 million for breaches involving shadow AI. That is about USD 400,000 above the USD 4.99 million overall average, but that difference is our arithmetic, and the overall average includes the shadow AI breaches, so it is not a controlled comparison. The cost-factor analysis puts lack of visibility into applications at USD 201,165.
What share of breaches involve AI?
It depends which AI you mean. 21% of organizations reported a breach involving their own AI models or applications. Security incidents involving shadow AI reached 43%. And 25% of organizations hit by a malicious attack said it was AI-driven. These are three different measures and should not be added together.
Is the report vendor-neutral?
No, and it does not claim to be. It is sponsored, analyzed and published by IBM, which sells security products, and the research is conducted by Ponemon Institute. The sample is nonstatistical and leans toward more mature security programs. Its method is described in full in the report.
Which AI figures are often misattributed to this report?
Two come up often. A claim that 63% of organizations lack AI governance uses last year's figure; the 2026 figure is 68%. A claim that only 18% keep a complete AI inventory is not from this report at all. Its only 18% is the share of SOC agent deployments used for vulnerability scanning and management.
Sources
- IBM and Ponemon Institute: Cost of a Data Breach Report 2026, published 29 July 2026. Page numbers above are the report's printed page numbers.
- Cloud Security Alliance, commissioned by Token Security: Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises, April 2026