What is the short answer for the board?
Shadow AI is the AI your people use without approval: chat assistants, browser extensions, coding tools and agents that security never reviewed. IBM's Cost of a Data Breach Report 2026 now gives a CISO measured figures to take to the audit committee. Security incidents involving shadow AI more than doubled, to 43% from 20%, and breaches that involved it averaged USD 5.39 million, above the record global average of USD 4.99 million (pp.6, 46-47). That gap is your opening line. Present shadow AI to directors as a missing financial control with a regulatory tail, not as a technology complaint, and leave the room with a decision. This briefing is laid out so you can make that case in five minutes.
Last verified: 17 October 2026, against the IBM Cost of a Data Breach Report 2026 (page numbers given in the text), the Cloud Security Alliance survey page, and Regulation (EU) 2026/1744.
A note on this page's history. Earlier editions used a modeled figure of $4.63M per incident, which we built by scaling IBM's 2024 average. IBM now measures the cost of shadow-AI breaches directly, so this version uses its published numbers and drops the model.
Which numbers belong on the slide?
Keep the stat block short. Every row below has a source a director can look up.
| Metric | Figure | Source |
|---|---|---|
| Security incidents involving shadow AI | 43% (previous edition: 20%) | IBM 2026, pp.46-47 |
| Average cost of a breach involving shadow AI | USD 5.39M (2025 edition: USD 4.63M) | IBM 2026, pp.46-47 |
| Global average cost of a breach | USD 4.99M, a record | IBM 2026, p.6 |
| Shadow-AI incidents where the organization paid a fine | About one in five | IBM 2026, p.47 |
| Breached organizations with no AI governance to manage AI or detect shadow AI | 68% | IBM 2026, pp.48-49 |
| Organizations coordinating AI governance and security teams | 19% | IBM 2026, pp.48-49 |
| Added cost from poor visibility into applications (shadow IT) | USD 201,165 | IBM 2026, pp.50-51 |
| Organizations that discovered previously unknown AI agents in the past year | 82% | CSA and Token Security, April 2026 |
| Organizations with at least one agent-related incident | 65% | CSA and Token Security, April 2026 |
Where do the IBM figures come from, and how hard can you lean on them?
Expect a director with a finance background to test the number. Know the method before you show it.
The study is the 21st edition of the series. Ponemon Institute ran it; IBM sponsored, analyzed and published it. The sample is 602 organizations that suffered a breach between March 2025 and February 2026, across 17 industries and 16 countries and regions, with 3,558 interviews behind it (p.5, pp.68-70). The report is open about its limits. The sample is nonstatistical, so there are no confidence intervals, and the authors say the sampling frame leans toward organizations with more mature security programs (p.70). Years in the report refer to the year of publication, not the year a breach happened (p.5).
So say it plainly on the slide: these are averages across breached organizations. They are not a forecast for your company, and they say nothing about how likely a breach is.
What they do show is direction and relative cost. In the 2025 edition a breach involving shadow AI averaged USD 4.63 million. In 2026 it was USD 5.39 million, about USD 400,000 above the overall average. One more figure is close but not identical: IBM found that a lack of visibility into the number and location of applications, which it labels shadow IT, added USD 201,165 to the average breach (pp.50-51). That factor covers applications in general, not only AI, and it overlaps with the shadow-AI average. Do not add the two together. For a figure that reflects your own headcount, data and controls, run the AI agent risk calculator before the meeting and put its assumptions in the appendix. For the full AI section of the report, see our reading of IBM's 2026 AI findings.
Which control gaps does shadow AI open?
Directors tune out "attack surface". They pay attention to "control gap". Three belong on one slide.
The data flow gap
Most DLP, CASB and egress tooling was built to watch file uploads, email attachments and calls to approved SaaS. A prompt is different. When an analyst pastes a customer spreadsheet into an unapproved assistant, or a developer feeds a private repository to a coding tool nobody vetted, the data leaves through a channel those controls were never designed to read. IBM's numbers show how common the blind spot is: 68% of breached organizations had no AI governance in place to manage AI or to detect shadow AI (pp.48-49). For the board, compare it to a payments channel that runs without dual approval.
The compliance gap
Regulators look at what your organization actually does with data, and an unapproved tool is still your organization's tool when an employee uses it for work. Article 26 of the EU AI Act sets out the obligations of deployers of high-risk AI systems. The Digital Omnibus, Regulation (EU) 2026/1744, moved the obligations for stand-alone high-risk systems to 2 December 2027. Whether any tool in use today is high-risk depends on what it is used for, and you cannot answer that for tools you have never seen. The inventory comes first. Sector rules on health or financial data may apply as well; ask counsel which ones. IBM adds a cost signal: in about one in five shadow-AI incidents, organizations reported paying a fine (p.47).
The insurance gap
Pull your cyber policy and read every AI-related endorsement and exclusion. Ask your broker how a claim would be treated if the loss started in an AI tool or agent your security program had not approved. If nobody has walked you through that answer, raise it with the committee.
How do you frame it to the board in five minutes?
Assume five minutes on a crowded audit committee agenda. Use these five points in order.
One: "Shadow AI makes breaches more expensive, and here is by how much." Lead with the conclusion. Show USD 5.39 million against USD 4.99 million and name IBM as the source. Then say, in one sentence, that this is an industry average from breached organizations and that your own estimate is in the appendix.
Two: "Our current tools were not built to see this." Name DLP, CASB, egress inspection and identity governance, then explain that none of them reads prompt traffic to AI services or governs what an agent does.
Three: "The regulatory clock is set." Give the EU AI Act date for stand-alone high-risk systems, 2 December 2027, and say which of your products, markets or business units might be in scope. Mention that about one in five shadow-AI incidents in IBM's data ended in a fine.
Four: "Here are three options and what each costs." Option A: accept the exposure and record that acceptance in writing. Option B: extend the existing security stack, accepting partial coverage. Option C: add a dedicated control layer that discovers AI use and inspects it in line. Put one-time cost, running cost and time to first result next to each, using your own quotes.
Five: "We need a decision by this date." Ask for something specific: a budget, a wider mandate, or a signed risk acceptance. "Keep us posted" is not a decision. It hands the problem back to you with no owner.
What will the board ask, and how should you answer?
Prepare one-sentence answers to all seven. Most committees will ask at least four.
- "What is our exposure?" Answer: "IBM's average for a breach involving shadow AI is USD 5.39 million; our own estimate, with its assumptions, is in the appendix."
- "How reliable is that figure?" Answer: "It comes from a Ponemon study of 602 breached organizations, sponsored by IBM; the sample is nonstatistical, so we treat it as directional, not as a forecast."
- "What are others doing?" Answer: "In IBM's sample, 68% of breached organizations had no AI governance to manage AI or detect shadow AI, and only 19% coordinate governance with security, so a working program would put us ahead of most."
- "What does fixing it cost?" Answer: "Three options are on the next slide, priced from our own quotes."
- "Why are we hearing this now?" Answer: "In IBM's data the share of incidents involving shadow AI more than doubled in one edition, and our controls predate this kind of traffic."
- "What is the timeline?" Answer: "Discovery first, a credible inventory within thirty days, inline controls on the riskiest uses by day ninety, then quarterly reporting to this committee."
- "Who owns it?" Answer: "I own delivery and report to this committee; general counsel, the CIO and the chief data officer sit on the working group."
For a longer version of this question set with legal and finance framing, share our piece on the seven questions the board will ask the CISO about AI in 2026 with general counsel.
What three things should you bring to the meeting?
Three artifacts, no more.
First, the cost slide. USD 5.39 million against USD 4.99 million, a one-line source note for IBM 2026, and your calculator estimate beside it, clearly labeled as an estimate.
Second, a benchmark table. Put IBM's governance figures (68% with no AI governance, 19% coordinating governance and security) next to an honest description of where your organization stands today. Directors read benchmarks quickly.
Third, a 90-day plan with names and dates. Three milestones, three owners, three dates. The committee is approving accountability more than it is approving a project plan. Score your starting point with the AI governance maturity assessment, which gives you a baseline to report against each quarter, and put the score on the cover.
What happens after the board says yes?
Here is the sequence you committed to.
Days 1 to 30: discover and classify. Run discovery across your identity provider, DNS egress and SaaS posture tooling. Build an inventory of every AI tool and agent in use, sorted by the sensitivity of the data it touches and the rules that might apply to it.
Days 31 to 60: put controls on the riskiest uses. Take the top tenth of the inventory by exposure and put inline inspection in front of it: prompt-level data protection, output checks and limits on what agents may do. Aim for one control you can defend on the highest-risk path rather than thin coverage everywhere.
Days 61 to 90: make it routine. Set up the committee briefing template, a monthly working group with counsel and the CIO, and quarterly board reporting. Map your agent controls to the OWASP Agentic Top 10. For executive positioning, read the CISO board narrative pillar; for technical depth, the shadow AI pillar goes further.
Which parts of this plan can a platform carry, and which stay with people?
AccuroAI discovers 1,400+ AI tools, so the inventory in the first thirty days reflects what people actually use. It does not use TLS interception; it enforces at the point of use, redacting sensitive data and blocking risky prompts in line as well as logging them. It deploys in under 30 minutes.
Software cannot set your risk appetite, decide which use cases are high-risk under the AI Act, or make your organization compliant with any law. Those calls belong to the committee, counsel and business owners; the tooling supplies their evidence.
FAQ
Should this go to the full board or the audit committee?
Start with the audit committee. Risk, internal audit and regulatory exposure already sit there. Escalate to the full board if the committee stalls or if your estimate crosses the organization's materiality threshold.
Is the dollar figure defensible?
Yes, as long as you describe it accurately. USD 5.39 million is IBM's measured average for breaches involving shadow AI in a sample of 602 breached organizations; it is not a prediction for your company, and the report itself warns that its sample is nonstatistical. Pair it with your own calculator estimate and show both. Saying "this is directional" out loud, before a director says it for you, is what makes the number credible.
What if the board chooses to do nothing?
Do not argue in the meeting. Record the decision in writing, share it with general counsel, and ask counsel whether a documented acceptance of this risk has implications for the directors' oversight duties. Check how your cyber policy's AI endorsements would treat a loss that began in an unapproved tool, then request a follow-up session with that answer in hand.
Does shadow AI belong to cyber or to compliance?
Both, which is why governance is the better frame. A cyber framing tends to land in the security budget, a compliance framing with legal. A governance framing gets committee attention and shared ownership.
How often should we refresh the assessment?
Quarterly. Run a fresh discovery scan, update your own estimate, and check whether IBM or another primary source has published newer figures. Building the review into the day-90 commitment turns a hard conversation into a standing agenda item.
This article is general information, not legal advice; take questions about your obligations to qualified counsel.
Sources
- IBM, Cost of a Data Breach Report 2026, conducted by Ponemon Institute; page numbers refer to the report's printed pages.
- Cloud Security Alliance and Token Security, survey on AI agent incidents, April 2026.
- Regulation (EU) 2024/1689 (the EU AI Act), Article 26, as amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI).