A new report from IBM reveals that the global average cost of a data breach has reached an all-time high of $4.99 million, driven largely by a surge in AI-powered cyberattacks and the rapid proliferation of unauthorized "shadow AI" tools within organizations.

The Record-Breaking Cost of a Breach

According to the 2026 Cost of a Data Breach Report, based on research from the Ponemon Institute and released by IBM, the financial impact of a data breach has risen 12% year-over-year to an average of $4.99 million per incident. In the United States, the average cost soared to $11.5 million, the highest of any country and more than double the global average.

The report, which analyzed 602 organizations across 17 countries, highlights that a data breach—an incident where sensitive, protected, or confidential data is accessed or stolen by an unauthorized individual—is becoming exponentially more expensive due to the increasing sophistication of attackers.

The Role of AI: Attackers Gain the Upper Hand

The study found that AI-driven attacks are a primary driver of the rising costs. These attacks, which include deepfake impersonation, AI-generated malware, and automated phishing campaigns, now add an average of $1 million to the total cost of a breach, pushing the average for AI-enabled incidents to over $6 million.

These advanced attacks have increased by 56% in the last year alone, and more than one in four organizations that suffered a malicious breach confirmed that AI was involved in the attack. The report cites expert estimates that AI will provide a 31.7% advantage to attackers over defenders within the next two years.

The Danger of 'Shadow AI'

Perhaps the most striking finding of the report is the doubling of "shadow AI" incidents. Shadow AI refers to the use of AI tools and systems within a company without the knowledge or approval of its IT and security departments.

Incidents involving shadow AI now account for 43% of all security breaches, up dramatically from just 20% in 2025. This trend reflects a troubling governance gap where employees are adopting powerful AI tools for productivity, often exposing sensitive company data to unsecured platforms. The data shows that 92% of organizations that suffered an AI-related breach lacked basic AI access controls, and 68% had no AI governance framework at all.

"Shadow AI's doubling ... is the structural signal that AI adoption has outpaced the security frameworks meant to govern it, and the breach cost data now reflects that gap in dollars," the report concluded.

The Cost of Inaction vs. Investment

While the threat landscape is deteriorating, the report also shows that investment in security defenses can pay off. Organizations using AI and automation in their security operations saved an average of $1.93 million per breach compared to those that did not. While 85% of organizations aware of these advanced threats are increasing their security spending, only one-third have strict approval processes for deploying new AI tools.

The findings serve as a critical warning for businesses: as the adoption of frontier AI models accelerates, the security frameworks governing them must keep pace to avoid a widening gap that is proving extremely costly in the new era of machine-speed exploitation.