The alert arrives at 2 a.m., when almost no one is watching.
A message, a voice, a login, each one convincing, each one fake. The servers are already open before the first human analyst wakes up. What changed is not the target. It is the weapon. And the question companies are racing to answer is how much that weapon is now costing them.
How AI turned a skilled attacker’s toolkit into an assembly line
For most of the last decade, a convincing deepfake or a bespoke piece of malware required real expertise and real time. Generative AI collapsed both requirements almost overnight.
A criminal group can now feed a target’s public video into an AI model, produce a phone call that sounds exactly like that person’s CEO, and use it to talk a help-desk agent into resetting credentials, all in an afternoon and for a few hundred dollars in compute costs. That same automation applies to malware. AI-generated phishing is personalized at a scale no human writing team could match, pulling details from social media and corporate filings to craft messages that pass the instinct checks most people rely on.
The result is an attack pipeline that is simultaneously faster, cheaper and harder to spot than anything that existed three years ago. Meanwhile, defenders are still largely operating on human timescales. Detection takes days. Escalation takes meetings. The clock runs in the attacker’s favor from the moment a credential is stolen.
What a single compromised login now looks like on a balance sheet
One in four malicious breaches were AI-enabled, a 56 percent increase over the prior year, and these breaches cost an average of $6 million, roughly $1 million more than the global breach average of $4.99 million, according to IBM’s 2026 Cost of a Data Breach Report.
That extra million is not a rounding error. At scale, across hundreds of incidents a year, it represents a structural shift in what the cybersecurity budget needs to absorb. Deepfake and impersonation attacks accounted for 45 percent of AI-driven incidents; AI-enabled malware made up 19 percent; AI-generated phishing contributed another 17 percent.
So the picture is less one of science-fiction hacking and more of social engineering at machine speed. A combined 62 percent of AI-driven attacks hit critical infrastructure, with financial services and energy taking the heaviest share.
The numbers behind the finding and where they came from
The 2026 report is based on breaches experienced by 602 organizations globally between March 2025 and February 2026, conducted by Ponemon Institute and sponsored and analyzed by IBM. That sample size makes it the most closely watched annual benchmark in the industry. The primary report was published on July 29 on IBM’s official newsroom.
The global average breach cost reached a record $4.99 million, a 12 percent increase from the prior year. In the United States, the average was more than double that global figure at $11.5 million, reflecting higher regulatory exposure and the concentration of high-value targets in finance, healthcare and technology.
The mean time to identify and contain a breach rose to 247 days, reversing five straight years of decline. In the first half of this year alone, there were 1,803 reported data compromises in the US, against 1,732 during the same period a year earlier, according to the Identity Theft Resource Center. The volume trend and the cost trend are moving in the same direction at the same time.
Where the defense is gaining ground and where it is still losing
Companies using AI and automation in their security operations cut breach costs by an average of $1.93 million. Yet only about one in three organizations have deployed these tools extensively, and this imbalance, where attacks can be launched for thousands while breaches cost millions, is fundamentally changing the economics of cyber risk.
That saving is reshaping vendor positioning. Identity and access management platforms are pushing phishing-resistant passkeys as a direct answer to credential theft. Endpoint detection vendors are leaning into AI-powered anomaly tools, arguing that only machine-speed defense can keep pace with machine-speed offense.
IBM also reported that 43 percent of AI-related security incidents now involve shadow AI, employees using tools IT has not approved or monitored, more than doubling year over year from 20 percent. You can read about a similar dynamic in how trusted channels became the entry point in the npm supply-chain poisoning wave. No perimeter tool can fully solve it, because the data leaves through a door the employee opened themselves.
What the shift means for companies still running yesterday’s defenses
The report’s math creates a straightforward business case that security teams can put in front of a CFO. AI-enabled attacks cost roughly a million dollars more per incident. Deploying AI in defense cuts costs by nearly two million. The number that goes to the board needs no footnote.
Breaches identified by a managed security service provider were contained in 230 days against the 247-day global average. Seventeen days is the gap that faster detection buys, narrowing the window in which an attacker can move laterally, exfiltrate data and establish persistence.
It is also roughly where the newest automation research is being applied hardest, as labs race to cut the time between anomaly and alert. None of that erases the 43 percent of AI-related incidents tied to shadow AI beyond the IT team’s line of sight. The gap between the fastest-moving defenders and the slowest is widening at exactly the moment when attackers have the most powerful tools they have ever had. Companies that close it first will pay closer to $3 million per breach. The ones that do not will keep paying closer to $6 million, and the trend line says that number is not finished moving.
