AI-Enabled Breaches Push the Global Average Cost to $4.99M

IBM and Ponemon Institute report a record $4.99 million global average breach cost, with AI-driven attacks rising 56% and AI-enabled malicious breaches averaging about $6 million.

IBM

2026

Cost of a Data Breach Report 2026

STRATEGIC OUTLOOK · SECBRIEFS ANALYSIS

THE SHORT VERSION

Executive Takeaway

IBM's 2026 Cost of a Data Breach Report moves AI from a future security concern into breach economics. The global average breach cost reached a record $4.99 million, while AI-driven attacks increased and organizations with extensive security AI and automation reported materially lower costs.

The leadership implication is not simply to buy more AI. Organizations need strong data, identity, cloud and cryptographic controls around AI systems while using automation to reduce the time between detection, containment and remediation.

Key Findings

01
The global average cost of a data breach reached $4.99 million, a 12% increase over the prior year.
02
AI-driven attacks increased 56%, led by deepfake impersonation and AI-enabled malware.
03
AI-enabled malicious breaches averaged about $6 million, roughly $1 million above the overall global average.
04
Organizations with extensive use of AI and automation in security reported about $1.93 million in cost savings compared with organizations using none.
05
More than 20% of organizations reported a breach targeting AI models or applications.
06
The report analyzed breaches at 602 organizations globally between March 2025 and February 2026.

What the Data Says

$4.99M

Global average breach cost

IBM reports a record global average cost of $4.99 million per breach in 2026.

56%

Growth in AI-driven attacks

AI-driven attacks increased 56%, with deepfake impersonation and AI-enabled malware among the main drivers.

$1.93M

Security AI cost advantage

Extensive use of AI and automation in security was associated with about $1.93 million lower breach costs than using none.

What It Doesn’t Say / Limitations

The report is sponsored and analyzed by IBM and conducted with Ponemon Institute. It covers 602 organizations that experienced breaches, so it is not a census of all organizations or a probability sample of the global economy.

Cost estimates combine multiple impact categories and can vary significantly by country, industry, breach type and organizational size. Correlations involving AI and automation should not be interpreted as proof that a single technology investment causes lower breach costs.

Why It Matters

Cyber risk is becoming a financial-speed problem. As AI reduces attacker effort and shortens attack timelines, long remediation cycles and weak control around AI workloads can translate directly into higher business impact.

For boards and financial-services leaders, the report also links cyber operations to enterprise economics: identity security, data protection, cloud configuration, cryptographic visibility and response automation increasingly influence the cost and duration of incidents.

Who Should Care

Boards and executive committees
CISOs and security leaders
CFOs and enterprise-risk teams
Data and AI governance leaders
Cloud and platform teams
Incident-response and resilience teams

SECBRIEFS VIEW

SecBriefs Assessment

The report is particularly valuable for executive conversations because it converts control weakness into economic consequence. Its strongest use is not benchmarking one organization's exact expected loss, but identifying where delays and governance gaps make incidents more expensive.

The AI findings should push organizations to secure the surrounding system—APIs, identity, cloud configuration, data and agent permissions—rather than treating the model itself as the only new risk.

What To Do Now

Measure breach response using time-to-detect, contain, remediate and restore alongside financial impact.
Secure AI workloads with strong identity, API, cloud-configuration and data-access controls.
Expand security automation where it demonstrably reduces investigation and containment time.
Create an enterprise inventory of AI models, agents, data flows and associated credentials.
Improve cryptographic inventory and plan migration for post-quantum requirements.
Use breach-cost scenarios to test cyber insurance, resilience and board risk appetite.

ORIGINAL REPORT