U.S. Average Breach Cost Hits Record High of $10.22 Million

Outside the U.S., the decrease in average breach cost stemmed from faster breach identification and containment via AI and automation, resulting in shorter breach investigations and estimated cost savings of $1.9 million.

However, IBM also found that nearly all organizations that experienced a data breach suffered operational disruption, with most taking an average of more than 100 days to fully recover. Additionally, about 65% of breached businesses say they haven’t fully recovered from their cyber events.

The report also revealed that artificial intelligence-related cyber breaches remain uncommon, but of those that have occurred, nearly 97% were due to inadequate AI access controls.

“The data shows that a gap between AI adoption and oversight already exists, and threat actors are starting to exploit it,” said Suja Viswesan, vice president of security and runtime products at IBM. “The report revealed a lack of basic access controls for AI systems, leaving highly sensitive data exposed and models vulnerable to manipulation. As AI becomes more deeply embedded across business operations, AI security must be treated as foundational.”

Viswesan added, “The cost of inaction isn’t just financial, it’s the loss of trust, transparency and control.”

About 13% of organizations responding to IBM’s survey reported a breach involving their AI models or applications, with incidents most often occurring through a company’s supply chain, compromised apps, APIs, or plug-ins.

“These incidents had a ripple effect: they led to broad data compromise (60%) and operational disruption (31%). The findings suggest AI is emerging as a high-value target,” said IBM in the report.

IBM also found that “shadow AI” – the use of AI without approval or oversight by employers – added about $670,000 to the global average cost of a data breach.

“These incidents also resulted in more personally identifiable information (65%) and intellectual property (40%) data being compromised. And that data was most often stored across multiple environments, revealing that just one unmonitored AI system can lead to widespread exposure,” said the firm.

Source: Zywave