IBM’s 2026 Cost of a Data Breach Report reveals a new high in average breach expenses, driven by faster AI-powered attacks and uneven defensive adoption. Security teams face a tipping point as attackers outpace traditional defenses.
The average cost of a data breach has climbed to a record USD 4.99 million worldwide, a 12 percent increase over the previous year, according to the 21st annual Cost of a Data Breach Report published by IBM and based on research by the Ponemon Institute. The rise is largely fueled by higher detection, escalation and lost-business costs, while AI-driven attacks—now 56 percent more common—add an extra USD 1 million on average to each incident.
In a study of 602 organizations across 16 countries and 17 industries that suffered breaches between March 2025 and February 2026, researchers interviewed 3,558 security and business leaders. The findings paint a clear picture: attackers are moving at machine speed, while many defenders still operate unevenly across the security lifecycle.
AI is no longer merely a defensive tool. Attackers use generative AI for deepfake impersonations (45 percent of AI-driven attacks), phishing, and malware generation. More than one in four organizations experienced a malicious AI-driven attack. Critical sectors such as financial services and energy absorbed 62 percent of these incidents, raising the risk of systemic disruption.
Yet the same technology offers the strongest cost reduction. Organizations that extensively deployed AI and automation shortened breach timelines by 65 days and saved an average of USD 1.93 million compared with those that did not. Despite this advantage, only about one-third of breached organizations used these tools extensively across prevention, detection, investigation and response. Agentic AI adoption is similarly uneven: 50 percent of organizations deployed agents for threat hunting, response and containment, but just 18 percent applied them to vulnerability scanning and management—the precise area where frontier AI models pose the greatest threat.
The United States recorded the highest regional average at USD 11.5 million, nearly double the global figure. Healthcare remained the costliest industry for the 13th consecutive year at USD 6.64 million, although that figure declined 10.5 percent from the prior year. Financial services followed at USD 6.29 million.
Phishing retained its position as the leading initial attack vector for the fourth year, with voice and SMS phishing producing the highest average costs at USD 5.29 million. Ransomware affected 39 percent of breached organizations, continuing a multi-year rise. Attackers increasingly weaponize brand reputation: 41 percent of ransomware incidents included threats of public shaming or media leaks.
Breaches involving AI models and applications themselves rose sharply to 21 percent of incidents. Model inversion attacks proved especially expensive, averaging USD 6.07 million. Among organizations that suffered an AI-related breach, 92 percent lacked proper AI access controls. Shadow AI incidents more than doubled to 43 percent, frequently resulting in data loss and operational disruption.
Data security practices also showed gaps. Fifty-three percent of breached organizations did not encrypt sensitive data at rest and in motion. On-premises storage accounted for the largest share of breached data (30 percent), yet public-cloud and multi-location breaches carried the highest costs.
Mean time to identify and contain a breach edged up to 247 days, reversing a five-year decline. Internal security teams detected breaches fastest (209 days) and at lower average cost than when attackers themselves disclosed the incident.
Looking ahead, 85 percent of organizations plan to increase spending on security tools and governance in response to frontier AI threats. More than half intend to invest in AI security and governance solutions—an 88 percent jump from the previous year. Securing non-human identities in AI workflows remains a weak point: fewer than half of organizations currently do so.
The report underscores a clear imperative. Organizations that treat AI as both a defensive necessity and a governed asset can shrink breach costs and timelines. Those that lag risk continuous disruption in an environment where attackers already operate at machine speed.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de