IBM 2025: AI governance gap drives breach risk

IBM’s 2025 Cost of a Data Breach Report shows that breach costs are moving in two directions at once. Globally, the average cost of a data breach fell to USD 4.44 million, helped by faster detection and containment. But the risk profile is becoming more complex as AI adoption outpaces security governance.

The central theme is clear: organisations are adopting AI faster than they are securing it. IBM found that 97% of organisations with AI-related breaches lacked proper AI access controls, while 63% either had no AI governance policy or were still developing one.

Shadow AI is now a material business risk. Unapproved AI tools increase the likelihood of sensitive data exposure, weaken visibility and add cost when breaches occur. IBM found that organisations with high levels of shadow AI faced significantly higher breach costs than those with low or no shadow AI.

Attackers are also using AI more actively. One in six breaches involved AI-driven attacks, most commonly AI-generated phishing and deepfake impersonation. Phishing remained the most common initial attack vector, while supply chain compromise became one of the most expensive and slowest to resolve.

The report also reinforces the value of security automation. Organisations using AI and automation extensively reduced breach costs by USD 1.9 million and shortened breach timelines by 80 days compared with those not using these tools.

Breach cost trends

• Global breach costs fell for the first time in five years.
• The average global breach cost dropped to USD 4.44 million.
• The US reached a record average breach cost of USD 10.22 million.

AI security and governance gap

• AI adoption is moving faster than security oversight.
• Most AI-related breaches involved poor access control.
• Many organisations still lack mature AI governance policies.

Shadow AI risk

• Unapproved AI tools are creating blind spots.
• Shadow AI increases data exposure, especially customer PII and intellectual property.
• High levels of shadow AI add significant breach cost.

Attack vectors and root causes

• Phishing was the most common initial attack vector.
• Supply chain compromise was one of the costliest and slowest incidents to resolve.
• Malicious insiders remained highly expensive.

Business impact and recovery

• Breaches continue to disrupt operations beyond initial containment.
• Recovery often takes more than 100 days.
• Regulatory fines and detection costs remain major contributors to total breach cost.

Security automation and cost reduction

• AI and automation helped organisations detect and contain breaches faster.
• Extensive use of security AI and automation cut breach timelines by 80 days.
• DevSecOps, SIEM and AI-driven insights were among the strongest cost-reducing factors.

Practical recommendations

• Apply strong access controls to human, machine and AI identities.
• Govern AI usage before shadow AI becomes embedded.
• Improve data discovery, classification and protection.
• Test incident response and recovery plans regularly.
• Use AI-enabled detection and response to move faster than attackers.

Key takeaway

AI is now both a security advantage and a security risk. Organisations that use AI defensively can reduce breach costs and response times, but those that allow AI adoption to run ahead of governance are creating a larger, harder-to-control attack surface.