What's on the Table: A 92% That Isn't Quite a 97%
Thirteen percent. That is the share of organizations that, per IBM's Cost of a Data Breach Report 2025, said a breach involved their own AI models or applications — with a further group admitting they were not sure whether such a breach had happened at all. As of August 3, 2026, that second group is the more revealing number, because it means the AI-incident count is a floor, not a ceiling. You cannot report a breach in a system you were never watching.
According to Google News, which surfaced the Cybersecurity Insiders piece framing these findings as an "IBM 2026 Data Breach Report," roughly 92% of organizations that suffered an AI-related security incident had no AI access controls or governance in place. IBM's underlying statistic is more commonly cited at 97% of AI-breach victims lacking proper access controls. Both numbers point the same direction, and the direction is unglamorous: the threat actor did not need a novel AI exploit. They needed an AI endpoint nobody had put a lock on.
That is the whole story in one sentence, and it is worth sitting with before anyone buys an AI-specific security product. IBM's report emphasized that the overwhelming majority of AI-related incidents traced back to missing basics — access controls, authentication, and oversight of AI tooling — rather than to exotic model attacks. The attack surface is new. The failure mode is thirty years old.
The Verification Gap Worth Naming
The 92% and the 97% are not the same claim, and neither the aggregator headline nor most of the downstream coverage says so. One appears to describe organizations with AI-related incidents that had no AI access controls or governance; the other describes AI-breach victims lacking proper access controls. Different denominators, different qualifiers, five percentage points of drift. As of August 3, 2026, the figures cited here have not been independently re-verified against the primary IBM/Ponemon document, and readers making budget decisions should pull the source report rather than the headline.
This is not pedantry. It is the difference between "almost nobody had controls" and "almost nobody had controls that worked," and those two findings imply different remediation programs.
Side-by-Side: What Shadow AI Costs a US Firm vs. Everyone Else
Here is the part the surface reporting skips. IBM's 2025 edition put the global average cost of a data breach at approximately USD 4.44 million — a decline from the prior year's record — while the United States average climbed to roughly USD 10.22 million, the highest of any region. Separately, about 20% of organizations reported a breach stemming from "shadow AI" (unsanctioned or unmanaged AI tools employees adopted without security review), and that shadow-AI factor added an estimated USD 670,000 to average breach costs.
Run those against each other and a genuinely useful asymmetry appears. Our calculation: USD 670,000 against the USD 4.44 million global average is roughly a 15% cost uplift. Against the USD 10.22 million US average, the same dollar penalty is closer to 6.5%. And the US average itself runs about 2.3 times the global figure.
Chart: IBM's 2025 breach-cost figures, with the shadow-AI cost adder shown at the same scale. The adder looks small next to the US average — which is exactly why it gets deprioritized.
So who should care more? A mid-market European or Asian firm operating near the global average takes a proportionally heavier hit from shadow AI: 15% on top of an already painful number. A US enterprise absorbs the same dollars as a smaller slice of a much larger loss. The counterintuitive read is that shadow-AI governance is a higher-ROI control for the smaller, non-US organization, even though the vendor marketing and the compliance pressure both aim squarely at large US enterprises. Smaller security teams are being told this is a Fortune 500 problem. Proportionally, it is more theirs than the Fortune 500's.
A careful skeptic should push back here, and the pushback is fair: these are self-reported survey figures, and "had no AI access controls" correlates with organizational security immaturity in general. An organization that never scoped its AI tools probably also runs weak identity governance, sparse logging, and a thin incident response function. The 92% may be measuring overall program maturity with AI as the visible symptom, not AI as the independent cause. That objection holds — and it does not change the remediation. If the missing control is identity and access governance either way, the fix is the same fix. It just means the return on that fix extends well past the AI estate.
The Defense Stack: Three Layers, One of Which Is Not Technology
The blast radius of an unsecured AI application is wider than a typical SaaS misconfiguration, because AI tools are unusual in what they aggregate. A retrieval system pointed at internal documents holds a distilled version of whatever the organization considers valuable — contracts, source code, customer records, pricing. A single over-permissioned service account against that index is not one record at a time; it is the corpus. The same structural lesson shows up in adjacent agent security work, including the pattern AI Agents covered on sandbox escapes, where conventional isolation and least-privilege did more work than any AI-native defense.
Layer one — technical control. Every AI endpoint gets an identity, and every identity gets a scope. That means no shared API keys, no service accounts with blanket read access to a document store, short-lived credentials, and authentication in front of internal AI interfaces including the ones a team spun up "just for a demo." Logging is part of this layer, not an optional extra: the organizations in IBM's data that could not say whether an AI breach occurred were failing at telemetry before they failed at defense.
Layer two — process. An inventory of sanctioned AI tools, refreshed on a real cadence, plus a lightweight approval path that takes days rather than quarters. Shadow AI is a demand signal. When 20% of organizations report a breach via unsanctioned tools, the honest reading is that employees needed capability the sanctioned stack did not offer, and procurement was slower than the workaround. Blocking alone reliably fails; blocking plus a fast approved alternative does not. Frameworks like the NIST AI Risk Management Framework and EU AI Act obligations are pushing organizations toward formalizing exactly this, which means the process layer is heading from optional to expected.
Layer three — people. Security awareness content that names AI specifically: what data must never be pasted into an external model, which tools are approved this quarter, and who to ask when the answer is unclear. Most awareness programs still teach phishing and password hygiene while employees are quietly moving regulated data into consumer chatbots. That gap is where cybersecurity best practices and actual behavior diverge.
Ship This Control Today
One thing, not thirty. Pull an inventory of every non-human identity — API keys, service accounts, tokens — that can reach an AI application or a data store an AI application reads from, and check what each one is actually scoped to. Most teams find at least one credential with far broader access than the use case requires, and revoking or narrowing it is a same-day change with no procurement cycle attached.
If that surfaces more than a handful of over-scoped identities, the finding is your business case for the rest of the program: scoped credentials, AI tool inventory, and logging that feeds threat intelligence and incident response rather than sitting unread. Data protection for AI systems is, at this stage of the technology's adoption, mostly just access control applied to a new class of asset.
Bottom line. Our read: the AI security market is currently selling detection for attacks that, by IBM's own data, are not the ones actually causing losses. As of August 3, 2026, the reported evidence points to governance failure — missing access controls, absent oversight, unmanaged tools — as the dominant AI incident vector, not adversarial model exploitation. On balance, the organizations that spend the next two quarters on identity governance and AI asset inventory will likely be better protected than those that buy an AI-specific detection platform and leave the service accounts alone. The unfashionable control is the one that works.
Frequently Asked Questions
What are AI access controls, and how do I implement them in a small business?
AI access controls are the authentication and authorization rules governing who — and which systems — can reach an AI application and the data it draws on. For a small business, start with three things: put login requirements in front of any internal AI tool, give each AI integration its own API key rather than a shared one, and scope each key to only the specific data source it needs. Most cloud AI platforms support scoped keys natively at no extra cost.
How much does shadow AI actually add to the cost of a data breach?
IBM's Cost of a Data Breach Report 2025 estimated that shadow AI added approximately USD 670,000 on average to breach costs, with about 20% of surveyed organizations reporting a breach tied to unsanctioned AI use. Measured against the global average breach cost of roughly USD 4.44 million, that adder works out to about a 15% uplift.
Why is the US average data breach cost so much higher than the global figure?
The 2025 report placed the US average at roughly USD 10.22 million versus a global average of approximately USD 4.44 million — about 2.3 times higher, and the highest of any region. Regional cost differences generally reflect regulatory penalty exposure, litigation environment, notification requirements, and detection and escalation spending, though the report itself is the authoritative source on the breakdown.
Should we block employees from using AI tools entirely?
Blocking without an approved alternative tends to push usage further underground, which is how shadow AI exposure develops in the first place. A more durable approach pairs a short list of sanctioned tools with a fast review path for new requests, backed by security awareness training that explains which data categories are off-limits. Enforcement works best when the compliant option is also the convenient one.
Disclaimer: This article is editorial commentary for informational purposes only and does not constitute professional security consulting advice. No independent product testing was conducted. Figures cited from IBM's Cost of a Data Breach Report should be verified against the primary document before use in budgeting or compliance decisions. Always consult with a qualified cybersecurity professional for your specific needs. Research based on publicly available sources current as of August 3, 2026.