The Widening Gap Between Information Security and AI

In the fast-paced world of artificial intelligence, AI-related data breaches represent a growing menace that organizations can no longer afford to ignore. IBM’s 2025 Cost of a Data Breach Report reveals a startling reality: 97% of these incidents stem from improper access controls, underscoring a critical oversight gap in AI governance. As cybersecurity professionals grapple with the dual-edged sword of AI—empowering defenses while introducing new vulnerabilities—this report serves as a wake-up call to prioritize robust controls and policies.

IBM’s annual report, compiled in collaboration with the Ponemon Institute, draws from in-depth analysis of hundreds of organizations worldwide that experienced data breaches in the past year. This year’s edition places a spotlight on AI’s role, both as a perpetrator of risks and a savior in mitigation efforts. Researchers examined factors like breach causes, costs, and recovery times, revealing how AI adoption often outpaces security measures.

The report defines AI-related data breaches as incidents where AI systems or tools contribute to unauthorized data access, whether through exploited vulnerabilities in AI models or unauthorized “shadow AI” deployments. Shadow AI refers to employees using unapproved AI applications, bypassing corporate oversight and exposing sensitive data. This phenomenon amplifies risks, as these tools often lack encryption or access logging.

Key to the findings is the identification of an “AI oversight gap.” Organizations rush to integrate AI for efficiency gains but neglect foundational security. For instance, the study shows that breaches involving shadow AI inflate costs by an average of $670,000, pushing the global average breach expense to $4.4 million—a 9% drop from last year, yet still a hefty burden. This cost includes direct expenses like forensics and notification, plus indirect hits such as lost business and reputational damage.

Cybersecurity teams must recognize that AI systems handle vast datasets, making them prime targets. Attackers exploit weaknesses like data poisoning, where malicious inputs corrupt AI models, leading to erroneous outputs that cascade into breaches. The report notes that 16% of breaches now involve AI tools for phishing or deepfake impersonations, a tactic that deceives even vigilant users.

The Alarming Statistics Behind AI Security Failures

Diving deeper, IBM’s data paints a grim picture of preparedness. A whopping 97% of organizations hit by AI-related data breaches admitted to lacking proper AI access controls, such as role-based permissions or multi-factor authentication tailored to AI environments. This statistic alone highlights how traditional security perimeters fall short against AI’s dynamic nature.

Equally concerning, 63% of surveyed entities had no AI governance policies in place to regulate usage or curb shadow AI. Without these, employees might deploy consumer-grade AI like chatbots for sensitive tasks, inadvertently leaking proprietary information. The report quantifies the fallout: organizations with extensive AI in security operations saved $1.9 million compared to non-users, proving that proactive AI integration can flip the script.

Regionally, the U.S. faces the steepest costs at over $10 million per breach, up 9% year-over-year, driven by stringent regulations like CCPA and GDPR that mandate swift reporting. Sectors like healthcare and finance bear the brunt, where AI processes patient records or transaction data, amplifying breach impacts.

Mean time to identify and contain breaches has improved to 241 days—the lowest in nine years—thanks to AI-powered detection tools. Yet, for AI-specific incidents, this timeline stretches due to the complexity of tracing AI-involved attacks.

The Rise and Risks of Shadow AI in Enterprises

Shadow AI emerges when teams adopt AI tools without IT approval, often to boost productivity. While innovative, it creates blind spots. IBM warns that 20% of breaches link to unauthorized AI use, adding significant costs. For example, an employee using an unvetted AI app might upload confidential data, exposing it to third-party servers with lax security.

This practice thrives in hybrid work environments, where monitoring is challenging. Cybersecurity professionals should audit networks for unauthorized AI traffic, using tools like endpoint detection to flag anomalies. The report stresses connecting security with AI governance to gain visibility into all deployments, including shadow ones.

Consequences extend beyond finances. Operational disruptions from AI-related data breaches affect supply chains, customer service, and sales processing. In agentic AI—systems that operate autonomously—governance lapses can lead to mistaken shutdowns or undetected intrusions, as noted by Trustly’s chief legal officer Kathryn McCall: “This isn’t a technical upgrade; it’s a governance revolution.”

To combat this, organizations must foster a culture of transparency. Training programs educate staff on approved AI tools, while policies enforce vetting processes. Integrating AI risk assessments into existing frameworks, like those from NIST, helps map shadow AI risks early.

The economic sting of AI-related data breaches is profound. Beyond the $4.4 million average, hidden costs include regulatory fines and legal fees. For instance, breaches disclosing personal data trigger penalties under laws like HIPAA, escalating totals.

Operationally, these incidents halt business. AI systems integral to decision-making—such as predictive analytics in finance—become unreliable post-breach, eroding trust. Recovery involves not just data restoration but model retraining to purge compromised elements.

IBM’s analysis shows that self-detected breaches cost less ($4.18 million on average) than those disclosed by attackers, emphasizing the value of internal vigilance. Long-term, reputational damage deters customers, with studies indicating up to 30% churn after major incidents.

For cybersecurity leaders, quantifying these impacts aids in securing budgets for AI defenses. Tools like cost calculators from IBM help simulate scenarios, justifying investments in governance.

Harnessing AI as a Shield Against Breaches

Paradoxically, AI fortifies cybersecurity when wielded wisely. The report highlights that AI reduces alert volumes, spots gaps, and enables rapid responses. Organizations deploying AI in security operations cut costs by $1.9 million, accelerating containment.

AI-driven anomaly detection identifies subtle patterns indicative of breaches, such as unusual data flows in AI models. Machine learning algorithms prioritize threats, freeing analysts for complex tasks.

However, success hinges on ethical implementation. Biased AI could overlook certain attacks, so diverse training data is essential. Integrating AI with human oversight ensures accuracy, aligning with recommendations from authorities like CISA.

Best Practices for Robust AI Governance

Establishing AI governance prevents many breaches. Start by implementing access controls: role-based access ensures only authorized personnel interact with AI systems. Encryption and key management protect data at rest and in transit.

Develop policies that ban shadow AI, mandating approval for new tools. Regular audits verify compliance, using automated scanners to detect unauthorized deployments.

Fortify identities, including non-human ones like API keys, with phishing-resistant methods. Elevate data security through classification and privacy-enhancing technologies.

Implementing Effective AI Access Controls

Access controls form the frontline defense. Use zero-trust models, verifying every request to AI resources. Multi-factor authentication, tailored for AI, prevents credential stuffing.

Monitor usage with logging tools, alerting on suspicious activities. For generative AI, protect prompts to avoid injection attacks that extract data.

Crafting Comprehensive AI Policies

Policies should cover the AI lifecycle, from development to decommissioning. Include risk assessments per NIST guidelines, evaluating for vulnerabilities like data poisoning.

Train teams on policy adherence, simulating breaches to test responses. Collaborate with legal for compliance with evolving regs.

Guidance from NIST and CISA on AI Security

The NIST AI Risk Management Framework (RMF) offers a blueprint for mitigating risks, with functions like Govern for policy-setting, Map for context-building, Measure for assessment, and Manage for prioritization. It addresses cybersecurity by promoting “Secure and Resilient” AI, countering threats like adversarial attacks and data breaches through standards integration.

CISA’s guidelines emphasize secure AI development, urging providers to embed security from design. Their AI Cybersecurity Collaboration Playbook aids stakeholders in joint efforts, recommending data minimization and anomaly detection to thwart breaches.

Incorporate these into enterprise strategies for holistic protection.

Real-World Examples Illuminating AI Vulnerabilities

History provides cautionary tales. In 2023, an OpenAI breach allowed users to view others’ conversation titles due to a flaw, exposing sensitive data. More recently, breaches in 2025, like those affecting retail giants, involved AI tools in phishing campaigns.

Verizon’s 2025 Data Breach Investigations Report notes phishing as a top vector, often amplified by AI-generated deepfakes. These examples underscore the need for vigilant governance.

Emerging Trends in AI Cybersecurity

Looking ahead, quantum computing could crack AI encryptions, necessitating post-quantum algorithms. Regulatory landscapes evolve, with frameworks like EU AI Act mandating high-risk AI audits.

Advancements in explainable AI will enhance breach forensics, while collaborative initiatives from NSA and allies promote shared threat intelligence.

Cybersecurity professionals stand at the forefront, equipped to transform AI from liability to asset. By embracing governance, leveraging tools, and heeding authoritative guidance, organizations can navigate this era with confidence, safeguarding data against tomorrow’s threats.