One in four malicious data breaches now involves artificial intelligence, and those attacks cost companies an average of $6 million, according to IBM’s annual Cost of a Data Breach 2026 report. The number of AI-powered attacks rose 56% over the past year, and their average cost runs about $1 million above the overall average for all incidents.
The global average cost of a data breach reached $4.99 million, up 12% from the previous year. IBM said attacks targeting AI systems directly, including model inversion and prompt injection, also carried an average cost of roughly $6 million.
Deepfakes and identity impersonation were the most common form of AI attack, making up 45% of all such incidents. AI-generated malware accounted for 19%, while automatically generated phishing messages and other social engineering methods made up 17%.
More than 20% of organizations reported attacks aimed directly at their AI models or applications. Of those affected, 92% had not put adequate access controls in place for those systems, IBM said. Such attacks can give criminals access not only to the models themselves but also to related data, tools, AI agent permissions, and internal workflows.
The average time to detect and contain a breach rose to 247 days, up 2.5% from the previous year. For attacks involving removable media and supply chains, that figure reached 258 days. The main drivers of higher costs were detection expenses, incident response, and business losses.
IBM said organizations that use AI and automation in security monitoring operations can reduce breach costs by nearly $2 million. About a quarter of organizations have not yet adopted those tools. More than half use AI agents to detect and contain threats, while only 18% deploy them to find and fix vulnerabilities. Separately, 85% of surveyed companies said they plan to increase cybersecurity spending following the rise of modern AI-powered attack tools.
