IBM 2026 Data Breach Report: 92% of AI-Related Incidents Had No Access Controls, Average Breach Cost Hits $4.99 Million

IBM's freshly released 2026 Cost of a Data Breach report delivers a stark headline number: the global average cost of a data breach climbed to $4.99 million, another all-time high.

Three Key Takeaways

92% of AI-related breaches had no access controls deployed. One in five organizations surveyed experienced an AI-related security incident in the past year. Among those that suffered an AI-related breach, 92% admitted they had no proper access controls in place for their AI systems. In other words, the vast majority of enterprises running AI are operating without even the most basic layer of permission management.

AI-driven attacks surged 56%, adding $1 million per breach. The report shows AI-powered cyberattacks grew 56% year over year. The average cost of an AI-involved data breach reached $6 million — roughly $1 million above the global overall average. By attack type, model inversion was the most expensive at $6.07 million per incident, with prompt injection close behind at $5.89 million.

Global breach costs rose 12% year over year. The worldwide average breach cost climbed from $4.45 million last year to $4.99 million, a 12% increase. This marks the fourth consecutive year of double-digit growth. The report covers 604 real-world breaches across 17 countries and 16 industries. Healthcare topped the industry list for the 14th straight year.

WangDou's Take

92% with no access controls — let that sink in. Out of every 100 companies that claim to have "deployed AI," 92 have not figured out the most basic question: who is allowed to query this model. They did not skip a firewall or forget encryption. They did not install a door. These are most likely the same companies whose annual reports feature phrases like "AI-powered transformation," while the model's API endpoint sits wide open on the corporate network — or the public internet. Model inversion at $6.07 million a pop means an attacker does not need to steal your database; they just need to query your model repeatedly until they reconstruct the training data, and your model does not even ask for a password. The state of AI security is not "asymmetric warfare." It is "the defense has not shown up yet."

Source: Cybersecurity Insiders, IBM