AI powers a 12% YOY increase in data breach costs: IBM

As if having your data compromised, exfiltrated, and ransomed wasn’t bad enough, the price of handling a breach is rising, too.

IBM’s annual Cost of a Data Breach report saw an increase of 12% year over year in incident expense, due to what a company researcher described as a bigger “blast radius” per breach, higher remediation pricetags, and AI-based automation that makes attacks cheap for cybercriminals and pricy for defenders.

Here are two standout stats from a report, which studied just over 600 companies that suffered a data compromise between March 2025 and February 2026:

• The global average breach reached a record $4.99 million. Main factors, according to the report, included “detection” and “lost business.”
• More than one in four organizations experienced an AI-generated malicious attack—a 56% increase year over year.

Patrick Fussell, global head of adversary simulation at threat-intel and research team IBM X-Force, divided the AI-powered tactics into those that can be seen—deepfakes, AI-crafted malware—and the hidden ones, like AI “sitting sidesaddle with an attacker,” a kind of cybercrime assistant.

“This is the new reality: AI is powering a lot of what’s happening here,” Fussell told IT Brew.

The report begins by mentioning “a frontier model that managed to find thousands of high-severity vulnerabilities—including some in every major operating system and web browser.” That might sound like Mythos Preview, a model announced by Anthropic in April 2026, which IBM didn’t state specifically in its intro, but called a “signal warning” that “in the hands of attackers, these tools will collapse the time between vulnerability discovery and exploitation.”

Fussell spoke with us about how AI is powering this year’s attacks, and why that’s leading to increased costs.

This interview has been edited for clarity and length.

If AI has made it cheaper for threat actors to conduct attacks (through AI-assisted phishing, vulnerability detection, and malware creation), why has it made defense more expensive for companies?

It’s very likely that what’s happening is that bad guys are getting further. They’re getting more data. They’re able to affect more within an organization, so the remediation steps are probably more impactful. Or if you imagine something like a ransomware group that’s going to sell data: If they’re able to get more data and pull it out, now there’s more financial impact to an organization.

Given what you learned this year in the report, what adversarial tactic stands out?

We develop zero days frequently. It’s a big part of looking at software and doing the sorts of engagements that we do. Seeing the power of being able to leverage AI to [find zero-day vulnerabilities], especially in the hands of a skilled expert, is something else. I can’t deny that that’s probably the one that, at least for the moment, is the most impactful.

After reading this, what’s the number one recommendation for IT teams?

I’m deeply biased, obviously, because I work in the offensive security space, but I always say, testing is probably one of the more powerful things you can do. If you think about any industry where we’re building something and then putting it into a production instance, you always test those things, no matter what it is. Even if it was a car, right? You would never put a car on the road without extensive testing. I think it’s the same thing for computers, networks, and security services.

And I think it comes with your security stack. If you put all these fancy EDRs and AI-powered things into place, how do you verify they’re actually doing what you think that they’re going to do? So, making sure you’re coming behind those implementations and verifying those with somebody who actually knows what they’re doing.

What does a test look like? What are some steps in that process?

It starts with identifying, what are my entry points, and how do I verify if they’re exploitable? So, take a security expert who understands how to do exploitation against an application or something like that, point them at my external attack surface, and have them understand: What happens if an attacker goes after this thing?

The YOY cost jump is a big one, despite seemingly normal factors like lost business. What other factors might be causing this increase?

My guess is hackers might be getting more impact on the organizations post-breach now that they have AI to power them, and they’re probably breaching more frequently, so that we’re having to have more people ready to respond to these sorts of things than possibly we did before.