AI rewrites breach economics, hits BFSI and energy sectors hardest: Report

AI-enabled attacks are increasing breach costs as enterprise adoption outpaces governance, access controls and security safeguards, according to IBM and Kiteworks reports

Artificial intelligence (AI) is proving to be a double-edged sword for enterprises. On the one hand, it is helping organisations automate workflows, speed up decision-making and improve productivity. On the other, it is giving cybercriminals more sophisticated tools to exploit vulnerabilities while exposing critical gaps in enterprise security and governance.

 

As AI adoption accelerates across industries, businesses are finding that innovation and risk are advancing at a similar pace.

 

Recent reports by IBM and Kiteworks highlight this growing paradox. IBM's Cost of a Data Breach Report 2026 shows how AI-enabled attackers, shadow AI and weak governance are increasing the scale and cost of cyberattacks.

 

 

Meanwhile, Kiteworks' Data Security and Compliance Risk: 2026 Forecast Report finds that organisations are adopting AI faster than they are implementing the oversight and security controls needed to protect sensitive enterprise data.

 

Together, the findings suggest that while AI is reshaping business operations, it is also redefining enterprise cybersecurity, making governance and data protection as important as adoption itself.

 

AI is changing the economics of cyberattacks

 

IBM's report shows that AI is reshaping both the scale and cost of cyber incidents. AI-driven attacks increased 56 per cent over the previous year, with one in four malicious breaches involving the use of AI. Such breaches cost organisations an average of $6 million, about $1 million more than the global average breach cost of $4.99 million.

 

Deepfake impersonation, AI-generated malware and AI-assisted phishing are becoming increasingly common, allowing cybercriminals to automate parts of the attack process and operate at greater speed and scale.

 

Financial services and energy were among the sectors most frequently targeted by AI-driven attacks because of their importance to the economy, according to IBM.

 

India also recorded an increase in the average cost of a data breach. According to the report, the average cost in the country rose to $2.79 million in 2026 from $2.51 million in 2025.

 

While India remained a lower-cost market than regions such as the US and West Asia, the upward trend reflects the growing financial impact of cyber incidents as enterprises expand their use of digital technologies and AI. 

 

AI adoption outpaces governance

 

While AI deployment continues to grow, governance is lagging.

 

Kiteworks' survey of 225 security, information technology, compliance and risk leaders found that every organisation surveyed had agentic AI on its roadmap, with more than half already operating AI agents in production.

 

However, only 40 per cent could quickly terminate an AI agent that behaved unexpectedly, while 37 per cent could enforce limits on the purposes for which an agent could access data. About 45 per cent could isolate AI systems from wider network access.

 

The report argues that organisations are deploying AI faster than they are building the systems needed to govern it.

 

As AI systems gain access to more business information and infrastructure, weak controls increase the risk of security incidents, compliance failures and data exposure.

 

An EY survey published in March found a similar gap. It said 85 per cent of technology leaders prioritised speed to market over exhaustive AI vetting, while 52 per cent of department-level AI initiatives operated without formal approval or oversight.

 

EY noted that governance policies were not always translated into day-to-day operational practices, creating a gap between AI deployment and effective oversight.

 

Governance gaps increase business risk

 

IBM's findings reinforce the governance challenge. The report found that many organisations lacked adequate access controls governing AI models, applications and the data they use. This makes identity and access management one of the most important gaps in enterprise AI security.

 

Kiteworks reached a similar conclusion, finding that organisations had invested more heavily in monitoring AI systems than in their ability to contain them.

 

About 59 per cent had human oversight mechanisms and 58 per cent used continuous monitoring. However, 60 per cent could not quickly terminate a misbehaving agent and 63 per cent could not enforce restrictions on what an agent was authorised to do.

 

The report also found that 33 per cent of organisations lacked adequate audit trails, while 61 per cent operated fragmented data-exchange systems that made it harder to reconstruct events after an incident.

 

This can make incident response and regulatory compliance more difficult because organisations may be unable to trace an AI-generated output to its source data or determine how the system reached a particular decision.

 

A recent Business Standard report, citing Deloitte, noted that as enterprises deploy AI across customer-facing services and internal operations, concerns over data security, privacy and regulatory compliance are increasingly shaping their strategies.

 

Organisations are also becoming more cautious about sharing sensitive information with external AI providers, particularly public large language models, amid concerns over data residency, confidentiality and compliance.

 

Shadow AI adds to exposure

 

The widespread use of unapproved AI tools is creating an additional layer of risk. Employees may enter source code, contracts, customer records or confidential business information into public AI tools without the knowledge or approval of their organisations.

 

This shadow AI activity can move sensitive information beyond the reach of enterprise monitoring and access controls.

 

Kiteworks cited industry findings showing that generative AI use had increased rapidly, while the volume of information employees sent to such tools had risen even faster.

 

The average organisation experienced 223 data-policy violations involving generative AI applications each month, with source code accounting for 42 per cent of such incidents and regulated data for 32 per cent.

 

The risks are likely to grow as autonomous agents gain access to company data and systems and begin carrying out tasks without approval at every step. 

 

AI security becomes a business priority

 

Despite the risks, the reports suggest organisations are beginning to rethink their AI security strategies.

 

IBM found that organisations making extensive use of AI and automation in security operations reduced breach costs by an average of $1.93 million and shortened the time taken to identify and contain breaches by 65 days.

 

This suggests that the same technology helping attackers increase their speed and scale can also help defenders detect incidents earlier and respond more effectively.

 

Kiteworks similarly found that organisations were placing greater emphasis on AI governance, data visibility and technically enforceable controls.

 

However, its findings point to a persistent gap between intent and implementation.

 

The most mature organisations embedded governance directly into their technology architecture through automated, measurable and enforceable controls. Less mature organisations continued to depend on manual processes, employee compliance or policy statements.

 

The findings suggest that recognising AI-related risks is not enough. Enterprises must be able to limit what AI systems can access, trace their actions and stop them quickly when something goes wrong.

 

Security must evolve with AI

 

The IBM and Kiteworks reports reach a similar conclusion: AI is changing enterprise security as much as it is transforming business operations.

 

As organisations integrate AI into customer-facing services and core workflows, governance can no longer be treated merely as a compliance exercise. It is becoming a central part of enterprise risk management.

 

IBM's findings show that AI is making cyberattacks faster, more scalable and more expensive. Kiteworks' research suggests that many organisations have yet to build the controls needed to manage these risks effectively.

 

Enterprises will need to embed security into every stage of AI adoption through stronger access controls, continuous monitoring, reliable audit trails and technically enforced governance rather than relying only on policies or manual oversight.

 

The challenge for organisations is no longer whether to adopt AI, but whether they can scale it securely.

 

As AI is integrated across business functions, the ability to balance innovation with governance and data protection is likely to determine how effectively enterprises manage cyber risks in the years ahead.