Data breaches now cost businesses an average of $5 million, according to the new report, a 12% increase over the figure from IBM’s 2025 research. Some attacks on AI tools cost businesses much more — inversion and prompt-injection attacks cost organizations an average of roughly $6 million. “Unlike traditional exploits that compromise systems, these behavioral attacks undermine how AI models reason and respond,” IBM researchers wrote, “expanding remediation beyond technical recovery into trust and governance.” The vast majority (92%) of organizations that suffered attacks on their AI models failed to properly control access to those tools, even as businesses describe identity management as one of their best defenses against costly breaches. Only four in 10 organizations said they limited access to their AI systems.

Full report : Half of organizations that experienced a data breach in 2025 are using AI agents to hunt for threats.