India takes months to spot breaches as AI aids attackers move faster: IBM

IBM's Cost of a Data Breach Report 2026 shows AI is accelerating cyberattacks while many Indian organisations still take months to detect breaches, increasing both financial losses and cyber risk

The cost of a data breach in India has reached a record Rs 25.5 crore in 2026, according to IBM's Cost of a Data Breach Report 2026. But beyond the headline figure, the report points to a more fundamental shift in enterprise cybersecurity. Artificial intelligence is not only making cyberattacks more sophisticated, it is compressing the time organisations have to detect and respond to them.

 

The findings, based on breaches experienced by organisations between March 2025 and February 2026, suggest that while attackers are increasingly using AI to automate phishing campaigns, generate malware and scale attacks, many organisations are still relying on slower, largely manual security operations. Among Indian organisations surveyed, those without AI and security automation took an average of 236 days to identify a breach, compared with 175 days for organisations that had extensively deployed AI across their security operations.

 

AI accelerating cyberattacks in India

Cybercriminals are not abandoning traditional attack methods in favour of entirely new AI-powered techniques. Instead, the report suggests AI is making existing attacks faster, cheaper and more convincing.

 

Among the malicious breaches analysed in India, 26 per cent involved AI-generated attacks. At the same time, phishing, including voice and SMS phishing, remained the country's most common initial attack vector, accounting for 19 per cent of incidents. Drive-by compromise and supply chain compromise followed at 16 per cent and 15 per cent respectively.

Globally, IBM observed a similar pattern. More than one in four organisations affected by malicious attacks reported that AI was used during the attack, representing a 56 per cent increase over the previous year's study. Deepfake impersonation and AI-enabled malware were among the fastest-growing attack methods, while AI-driven attacks added an average of $1 million to breach costs.

 

AI-based cyberattacks are also reducing the time taken by an attacker to get into a system. As per CrowdStrike's 2026 Global Threat Report, the average eCrime breakout time has fallen to just 29 minutes, meaning attackers can move laterally across a compromised network in under half an hour.

The real cost is often the time attackers remain inside networks

The IBM report suggests breach costs are increasingly linked to how quickly organisations discover an intrusion rather than the attack itself.

 

As per IBM’s report, Indian organisations without AI required an average of 236 days to identify a breach. In such organisations, average breach cost rose up to Rs 31.6 crore. This is significantly higher than the breach cost of Rs 21.3 crore for organisations extensively using AI and automation, where detection also took shorter averaging 175 days.

The global findings tell a similar story. Organisations using AI extensively shortened the overall breach lifecycle by 65 days and reduced breach costs by an average of $1.93 million. Conversely, breaches that remained active for more than 200 days cost organisations an average of $5.65 million compared with $4.32 million for shorter incidents.

Financial services are paying the highest price in India

The report suggests the financial sector remains the most expensive industry in India when it comes to recovering from a cyberattack.

 

Among the organisations studied, financial services recorded the highest average breach cost at Rs 40.9 crore, followed by the technology sector at Rs 35.7 crore and communications at Rs 34.5 crore. According to the report, these sectors store large volumes of sensitive financial, customer and enterprise data, making them attractive targets for cybercriminals.

 

The global findings broadly reinforce the trend, although healthcare recorded the highest average breach cost worldwide at $6.64 million, followed by financial services at $6.29 million. IBM also found that financial services and energy accounted for a significant share of AI-driven attacks because of their critical role in national infrastructure.

Prevention alone may no longer be enough

The report identifies offensive security testing as the biggest cost-reducing measure among Indian organisations. Red teaming and penetration testing reduced breach costs by an average of Rs 2.47 crore, followed by proactive threat hunting and AI governance technologies.

 

It also points to new sources of risk emerging alongside AI adoption. Shadow AI, where employees use AI tools outside approved enterprise policies, increased the average breach cost by Rs 1.79 crore among organisations where it was present, making it one of the three largest factors contributing to higher breach costs in India alongside cloud migration and regulatory non-compliance.

 

Globally, IBM also found that AI-related breaches were often linked not to the choice of AI model itself but to weaknesses in APIs, cloud configurations and access controls surrounding AI deployments. The report noted that 92 per cent of organisations experiencing AI-related breaches lacked adequate AI access controls.

Organisations are changing how they spend on cybersecurity

The report also indicates that organisations are shifting cybersecurity investments towards improving resilience rather than relying solely on prevention.

 

Among Indian organisations surveyed, 67 per cent said incident response planning and testing would receive additional investment following a breach. This was followed by threat detection and response technologies such as SIEM, SOAR and EDR at 51 per cent, identity and access management at 49 per cent, AI security and governance tools at 39 per cent, and employee awareness and training at 36 per cent.

 

The global report reflects a similar change in priorities. After learning about emerging risks associated with frontier AI models, 85 per cent of organisations said they planned to increase spending on security tools and governance, significantly higher than the proportion that had initially planned additional security investments following a breach.