IBM Cost of a Data Breach 2026: $5M Average, AI on Both Sides, and What Your Backend Still Controls

I watched the IBM Technology walkthrough of the 2026 Cost of a Data Breach report on a quiet evening, then opened the PDF and started circling numbers. Same feeling as the Aikido / Sapio survey I wrote about earlier: the industry keeps buying tools and hiring people, and the mean breach still costs almost five million dollars.

This one is different in shape. Aikido asked 450 teams how AI code and tool sprawl felt from the inside. IBM contracted the Ponemon Institute to interview people who already had a breach. About 602 organizations, roughly 3,558 interviews, 17 industries, 16 countries and regions, breaches from March 2025 through February 2026. Extremes get trimmed so one mega-incident does not drag the average into fantasy land. Twenty-one years of the same series, so trends mean something.

I ship backends for a living. Most of the report is about SOC maturity, ransomware pressure, and board-level spend. A smaller slice is pure API work: access controls, agent identities, encryption defaults, supply chain, and how long you leave a hole open once someone is already in. That smaller slice is where people like us can still move the average.

The bill went up again

Worldwide average cost of a data breach: USD 4.99 million, up 12% from last year. The US average: USD 11.5 million, more than double the global mean and an 11% climb of its own. The report translates the open window into something you can feel: about $1,100 for every hour a breach stays active.

Detection and escalation plus lost business made up most of that bill (63%). Inflation alone does not explain a 12% jump after a slight dip last year. Somebody is getting better at staying invisible, or we are getting worse at noticing them, or both.

// Rough math from the report's $1,100/hour figure.
// 247 days open x 24 hours is not a fun spreadsheet.
const HOURLY_COST_USD = 1_100;
const DAYS_OPEN = 247; // MTTI + MTTC global average this year

function roughOpenCost(days = DAYS_OPEN): number {
  return days * 24 * HOURLY_COST_USD;
}

// ~$6.5M if you stay at the mean for the full lifecycle.
// Shorter detection is the lever that actually bends this curve.

What still did not improve

Phishing is still number one in both cost and frequency. Voice and SMS phishing ran about 17% of attacks and led the cost ranking at roughly $5.29M per incident. Social engineering (help desk impersonation, MFA fatigue) sat near the top on cost. Supply chain compromise sat near the top on frequency. If you only remember three causes from this year, remember those three.

Mean time to identify: 183 days. Mean time to contain after that: 64 days. Add them up and you get 247 days, about two-thirds of a year with an attacker somewhere in the building. That total rose six days versus last year and sits near the ten-year average. Internal IT teams did better when they found the breach themselves (209 days end to end). When a third party found it, the clock ran past 280 days. When the attacker was the one who told you, the average cost hit $5.12M.

Ransomware among breached organizations moved from 34% to 39%. Encrypting systems is still a tactic (23%), and brand reputation threats are now the most common pressure method at 41%. Employee PII, intellectual property, customer data, and even internal Slack-style comms show up in the extortion mix. Attackers lock disks and price your shame.

AI showed up on both sides of the ledger

More than one in four organizations in the study saw a malicious AI-driven attack. That is a 56% increase over last year. Deepfake and impersonation attacks led the AI mix at 45%. AI-enabled malware sat at 19%. When AI was part of the attack, average malicious breach cost rose by about $1 million above the non-AI baseline.

Separately, breaches that involved the organization's own AI models or applications grew to 21% from 13% last year. Among those AI-related breaches, 92% lacked proper AI access controls (role-based access, MFA, the boring stuff). The expensive incidents clustered around model inversion (~$6.07M), prompt injection (~$5.89M), cloud misconfigurations around AI workloads (~$5.25M), and compromise of connected apps, APIs, or plugins. Open-source and third-party model deployments got hit at similar rates. Governance and environment security failed more often than the model weights did.

That 92% number is the one I keep repeating to myself. We spent a year arguing about model risk, and the report says the door was often unlocked at the API layer. Plugins, apps, cloud config. The same categories backend engineers already own.

Where automation actually saved money

Organizations that used security AI and automation extensively cut average breach cost to about $4.0M versus $5.93M for teams with no use. That is roughly $1.93 million saved. They also closed the lifecycle about 65 days faster (215 days vs 280 for no use). Only 36% of breached orgs said they used these tools extensively across prevention, detection, investigation, and response. Half of orgs with a SOC have deployed AI agents there, mostly for hunting and response. Only 18% used agents for vulnerability management, which is exactly where frontier models compress the exploit window.

After organizations learned more about frontier-model threat capabilities, 85% said they would increase security spending because of it. That is the rare optimistic chart in a report full of bad charts: money is starting to move before the next incident, not only after.

Non-human identities and the crypto hole

The walkthrough spends real time on non-human identities: service accounts, API keys, agent principals. Some industry commentary puts NHIs around 50:1 versus human identities in heavy automation shops. The report's own data is colder: less than half of breached organizations (46%) said they secured NHIs in AI workflows. Of those who did, machine identity lifecycle management led (55%), then secrets managers (39%), behavioral monitoring (36%), and role-based access (30%). Agents are ephemeral. Your identity process cannot be a ticket that takes three days.

Encryption is still embarrassing. Only 37% of breached organizations said sensitive data was encrypted at rest and in motion when the breach happened. 53% said no. 10% were not sure. Post-quantum prep is worse: about 26% reported a post-quantum crypto project. If attackers harvest ciphertext now, they can decrypt later when quantum or better classical attacks arrive. Crypto agility (rotating algorithms without rewriting the product) is the practical ask.

What a backend can still own

I cannot fix your SOC staffing from a TypeScript package. I can refuse to ship the API shape that keeps landing in the "compromise of connected apps, APIs, or plugins" bucket. Here is the open version of an AI tool endpoint I have seen in the wild more times than I want to admit:

// The shape of "we shipped an AI feature" that ends up in next year's
// report. No auth on the tool surface, no bound on who can call it,
// plugins and APIs reachable from wherever the model can reach.
app.post("/tools/refund", async (req, res) => {
  const { orderId, amountCents, reason } = req.body;
  // Whoever holds the URL can refund. The model, a prompt injection,
  // a leaked internal hop, a curious coworker on the same VPN.
  await refunds.create({ orderId, amountCents, reason });
  res.json({ ok: true });
});

There is no principal, no bound on amount, and no record of who called it. If a model, a prompt injection, or a lateral hop can reach that URL, they can refund. Shrink the report's 92% access-control failure to one handler and it often looks like this.

Same feature with the boring controls bolted into the structure instead of a wiki page:

// Same tool surface, but the route is the contract: principal required,
// body shape fixed, response shape fixed, rate limited, egress blocked
// from walking into the metadata service.
// Progressive shorthand: app.post(path, contract, handler).
// Response contracts use body:, and handlers return { status, body }.
import { z } from "zod";
import {
  App,
  bearerAuth,
  fetchGuard,
  rateLimit,
  requestId,
  secureHeaders,
} from "@daloyjs/core";

export const app = new App()
  .use(requestId())
  .use(secureHeaders())
  .use(rateLimit({ windowMs: 60_000, max: 30 }))
  .use(
    fetchGuard({
      allow: ["https://api.stripe.com", "https://api.openai.com"],
    }),
  )
  // NHI token for the agent, not a shared human password reused across services.
  .use(
    bearerAuth({
      validate: async (token) => Boolean(await tokens.lookupAgent(token)),
    }),
  )
  .post(
    "/tools/refund",
    {
      operationId: "toolRefund",
      request: {
        body: z
          .object({
            orderId: z.uuid(),
            amountCents: z.number().int().min(1).max(50_000),
            reason: z.string().min(1).max(200),
          })
          .strict(),
      },
      responses: {
        200: {
          description: "queued",
          body: z
            .object({ id: z.uuid(), status: z.literal("queued") })
            .strict(),
        },
      },
    },
    // Auth already ran. Keep amount and shape bounds in the schema so a
    // prompt-injected agent cannot invent fields or refund $1M in one call.
    async ({ body }) => {
      const queued = await refunds.queue(body);
      return { status: 200 as const, body: queued };
    },
  );

Auth is required, the body is strict, and the response cannot smuggle extra fields. Rate limits bound blast radius. Egress is default-deny so a compromised process does not casually walk into cloud metadata. The agent has an identity you can revoke. That is NHI hygiene at the HTTP layer.

Access control for AI surfaces includes more than "is there an API key." It includes which tools exist, which arguments they accept, and which fields ever leave the process:

// 92% of AI-related breaches lacked basic access controls.
// Access control includes IAM in the cloud console, and also:
// which fields a caller can write, which fields a response may emit,
// and which keys a plugin is allowed to send.
import { z } from "zod";
import { App, ForbiddenError, jwk } from "@daloyjs/core";

export const app = new App()
  .use(
    jwk({
      // Asymmetric allowlist only. HS* with a JWKS source is refused at boot.
      algorithms: ["EdDSA", "ES256"],
      jwks: process.env.JWKS_URL!,
      issuer: "https://auth.example.com/",
      audience: "agent-tools",
    }),
  )
  .post(
    "/agents/:agentId/invoke",
    {
      operationId: "invokeAgent",
      request: {
        params: z.object({ agentId: z.uuid() }).strict(),
        body: z
          .object({
            tool: z.enum(["search", "summarize", "draft"]),
            input: z.string().min(1).max(4_000),
          })
          .strict(),
      },
      responses: {
        200: {
          description: "result",
          // No raw prompts, no system keys, no neighbor tenant data.
          body: z
            .object({
              tool: z.enum(["search", "summarize", "draft"]),
              output: z.string().max(8_000),
            })
            .strict(),
        },
      },
    },
    async ({ params, body, state }) => {
      const user = state.user as { sub?: string; scopes?: readonly string[] };
      if (user.sub !== params.agentId && !user.scopes?.includes("ops:agents")) {
        throw new ForbiddenError("agent scope mismatch");
      }
      const result = await agents.invoke(params.agentId, body);
      return { status: 200 as const, body: result };
    },
  );

On supply chain, the report's frequency ranking matches what we already gate in CI for libraries people install into production APIs:

# Supply chain is #2 by frequency this year. For a TypeScript library
# that still means: no postinstall surprise, no hallucinated package
# name, no quiet remote install from a random host.
pnpm verify:no-lifecycle-scripts
pnpm verify:known-dep-names
pnpm verify:no-runtime-deps
pnpm verify:lockfile
pnpm verify:sbom

Binary gates beat homework. A named failing check is something you fix. A 40-item scanner queue is something you learn to dismiss. The Aikido survey already showed what that costs in false-positive fatigue.

Report finding to backend default

What I would do on Monday

• Inventory every HTTP surface a model or agent can call. If it can move money, data, or identity, it needs a principal, a schema, and a rate limit. No shared god keys.
• Treat AI plugins and tool bridges as public-facing APIs, even when they live on a private network. The report keeps finding the hole in the connector layer.
• Measure your own open window. You may not have Ponemon's $1,100/hour, but you have detection lag. Put a real number on it before the next budget meeting.
• Encrypt sensitive fields and plan crypto agility. The 37% figure means a lot of teams still ship plaintext because encryption was a later ticket.
• Prefer automation that shortens time-to-fix over tools that only lengthen the alert queue. The $1.93M savings sat with people who used AI and automation extensively in the security lifecycle. Buying another unread dashboard does not produce that number.

A framework will not stop phishing, negotiate ransomware, or staff your SOC. It can stop the boring failures that keep sitting next to the scary AI headlines: open tool routes, mass assignment, secret leakage in responses, unscoped agent tokens, and supply-chain install surprises. Those still fit in a pull request.

Attackers already use AI to shrink the window between discovery and exploit. Defenders get the same tools, and they still need the unglamorous ones: identity, schemas, encryption, and supply-chain gates. The report spends 36 pages showing those still move cost.

pnpm create daloy@latest my-api