One in four successful malicious breaches is now AI-enabled, and the share of these AI-enabled breaches has jumped 56% over the previous year. Each of them costs an average of $6 million, roughly a million dollars more than the global average of $4.99 million. The 2026 Cost of a Data Breach study, based on 602 breached organizations between March 2025 and February 2026, puts numbers on something practitioners have felt in their bones for a while: attacking has become fast and cheap, while getting breached keeps getting slower and more expensive to fix.
Let that asymmetry sink in. Deepfake impersonation and AI-assisted malware can be launched for thousands of dollars. The cleanup bill runs into millions. This is not a technology problem; it is an economics problem, and the economics currently favor the people breaking in. Suja Viswesan of IBM Security Software put it plainly: AI makes attacks faster and cheaper, while breaches keep getting more expensive, especially when the gap between discovery and remediation stretches out. The longer you take to fix what you already know is broken, the more you pay.
And here is where the corporate comedy begins. Over half of organizations now use AI agents for threat detection and containment. Shiny, demo-friendly, board-presentable. But only 18% point those same agents at vulnerability management, the unglamorous work of closing the holes attackers walk through. Whatever else these companies do about patching, the order of priorities is on display: the magnificent alarm system gets the budget and the stage, the locks get whatever is left, because fixing locks doesn’t make it into the quarterly slides.
The encryption numbers are even less flattering. Only 37% of the breached organizations encrypt sensitive data both at rest and in transit. Just 34% have visibility into their own cryptographic assets. Read that again: in this sample, two thirds don’t fully encrypt what matters, and two thirds couldn’t tell you where their keys and certificates live. These are the same companies nodding gravely in conferences about post-quantum migration. You cannot migrate cryptography you cannot find. It’s like planning the move to a new house while having no idea which boxes contain your belongings, or whether you own boxes at all.
Meanwhile the targets are getting more systemic. Critical infrastructure absorbed 62% of AI-driven attacks, with financial services averaging $6.3 million per breach and energy $5.2 million. When the sectors that keep money moving and lights on are the preferred hunting ground, the damage stops being a line item in someone’s annual report and starts rippling through supply chains and essential services.
AI itself has become a target, not just a weapon. More than 20% of organizations reported breaches hitting their own AI models or applications, and the causes are depressingly familiar: compromised APIs, applications or plug-ins (27%) and cloud misconfigurations (27%). The revolutionary technology falls to the same old sloppiness. We didn’t invent new ways to fail; we just gave the old ones a bigger attack surface.
Ransomware, predictably, is thriving: 39% of incidents, up from 34%. The pressure tactics have evolved too. Brand reputation is now the favorite lever (41%), ahead of employee data (35%) and intellectual property (31%). Criminals have understood what many boards still haven’t: the most valuable asset in a modern company is the story it tells about itself, and the cheapest way to monetize a breach is to threaten that story.
There is one genuinely useful number in all this. Organizations that extensively use AI and automation in their security operations cut breach costs by roughly $2 million. So the tools pay off, at least where they are actually used. What doesn’t work is the hypocrisy: generous budgets for fashionable AI, zero appetite for the basics. Encrypt your data. Know your cryptographic assets. Point your expensive agents at your known vulnerabilities, not just at the dashboard that looks good in demos. A follow-on survey in May 2026, covering 456 organizations, found that 78% are aware of the most advanced frontier AI models. Fine. But awareness without remediation is just better-informed negligence, and the invoice for it now averages six million dollars.
Raffaele Di Marzio
All my “insane” books on cybersecurity and governance are here 👇 https://cyberium.limited/bookshelf.html