The global average cost of a data breach fell to $4.44 million in 2026, a 9 percent decline from $4.88 million in 2024. The headline improvement conceals a category moving sharply the other way.

One in five organizations studied, 20 percent, experienced a breach linked to shadow AI, meaning unsanctioned AI tools adopted by employees without security or IT oversight. Those incidents added as much as $670,000 to the average breach cost.

Shadow AI breaches also behave differently once they occur. Sixty five percent exposed personally identifiable information, and detection took 247 days, six days longer than the standard breach timeline. The combination of sensitive data and extended dwell time is what drives the cost premium.

Governance gaps show up throughout the affected population. Sixty three percent of breached organizations lacked AI governance policies entirely, and only 37 percent had any approval process or oversight mechanism. Among organizations reporting AI related breaches specifically, 97 percent said they lacked proper access controls on the AI systems involved.

The same technology produces the largest cost reduction in the study when deployed deliberately. Organizations using extensive AI and automation in security operations averaged $3.62 million per breach against $5.52 million for those without, a 34 percent reduction and the single largest cost differentiator measured.

Source: IBM - https://www.ibm.com/think/insights/data-matters/cost-of-a-data-breach