Glonce

IBM: 92% of AI security breaches trace back to weak access controls

securityThe Glonce editorsThe Decoder🔥73Glonce rating73Impact70Novelty60Relevance90Surprise65Players75Credibility85
IBM: 92% of AI security breaches trace back to weak access controls

IBM's Cost of a Data Breach Report 2026, based on research by the Ponemon Institute across 602 companies, found that among companies that experienced an AI-related security incident, 92 percent had inadequate access controls in place for their AI systems. In about one in five affected companies, the entry point was not the model itself but a compromised API, a connected application, or a misconfigured cloud service. Whether a company ran an open-source or a proprietary model made almost no difference to the outcome. IBM traces the gaps back to basic oversights that do not require sophisticated attackers to exploit.

On cost, incidents involving AI averaged $5.33 million, compared with $4.70 million for incidents without an AI component. Across all data breaches, the global average cost rose 12 percent to $4.99 million. Breaches where the attackers themselves used AI cost more still, averaging $6.04 million, versus $5.03 million when attackers did not use AI.

Key facts

  • 92% of companies hit by an AI-related security incident had inadequate access controls for their AI systems, per IBM's Cost of a Data Breach Report 2026, based on Ponemon Institute research across 602 companies.
  • About one in five affected companies were breached through a compromised API, a connected application, or a misconfigured cloud service, not the AI model itself.
  • Open-source versus proprietary models made almost no difference to breach outcomes.
  • AI-related incidents cost $5.33 million on average versus $4.70 million for non-AI incidents; the global average across all breaches rose 12% to $4.99 million.
  • Breaches where attackers used AI cost $6.04 million on average, versus $5.03 million when attackers did not use AI.

Why it matters

The report puts a number on a gap security teams have long suspected: companies are rushing to deploy AI systems faster than they are securing access to them. A 92% failure rate on basic access controls, among companies that already suffered an incident, suggests the weak point in enterprise AI security is rarely the model itself but the ordinary infrastructure around it: APIs, connected apps, and cloud configuration.

Who it affects

The finding applies broadly across the 602 companies covered by the Ponemon Institute's research for IBM, spanning both open-source and proprietary AI deployments; the report notes the choice between the two made almost no difference to the outcome. Any organization running AI systems connected to APIs, third-party applications, or cloud services is implicated.

How to use it

The report's practical takeaway is prioritization: since about one in five breaches entered through a compromised API, a connected application, or a misconfigured cloud service, security teams evaluating AI deployments should treat access controls, API hardening, and cloud configuration review as immediate, basic fixes rather than advanced measures, since IBM notes the exploited gaps did not require sophisticated attackers.

How solid is it

The figures come from IBM's Cost of a Data Breach Report 2026, based on Ponemon Institute research across 602 companies, a large and established annual study. The source article does not give a publication date beyond the year 2026, nor a breakdown by industry, region, or company size, nor specifics on what 'basic access controls' means in practice or which measures were missing.

Risks and caveats

The article does not detail how attackers used AI in the incidents that cost $6.04 million on average, nor does it compare this year's AI-incident costs to prior years beyond the 12% global rise across all breaches. Without a breakdown by sector or region, it is unclear whether the 92% figure holds evenly across industries or is skewed by particular types of organizations.