Are AI-driven cyberattacks putting business data and operations on the brink? The evidence points to a changing threat environment, not a universal crisis caused by AI. Attackers are using generative AI in some incidents, but familiar weaknesses—software vulnerabilities, compromised accounts, weak access controls, third-party exposure and ransomware—remain central to business risk. The practical response is to protect identities and systems, govern AI access to data, and plan how to keep operating and recover.
What do the latest breach findings actually show?
These reports describe different populations, periods and measures. Their numbers are not an individual business’s odds of being breached, and their cost estimates should not be treated as a direct year-over-year comparison.
As an Amazon Associate I earn from qualifying purchases.
| Report and scope | Finding | What it means for a business |
|---|---|---|
| Verizon 2026 DBIR; incidents from November 1, 2024, through October 31, 2025 | Software vulnerabilities were the starting point for 31% of breaches; ransomware was involved in 48%; 15% involved techniques bolstered by generative AI. | AI is part of the threat picture, but the figures also underscore the importance of patching and ransomware readiness. They do not show that AI caused every breach. |
| IBM’s 2026 Cost of a Data Breach study; Ponemon Institute study conducted with IBM sponsorship and analysis, covering breaches at 602 organizations globally from March 2025 through February 2026 | One in four malicious breaches were AI-enabled, with an average cost of $6 million; IBM reported a $4.99 million global average. | These are study findings, not a forecast or the amount every organization should expect to pay. |
| IBM’s 2025 Cost of a Data Breach report | IBM estimated a $4.4 million global average breach cost for that edition. | This is a separate edition’s estimate. The figures should not be read as a like-for-like trend with IBM’s 2026 study. |
| IBM’s 2025 AI-related findings | 13% of surveyed organizations reported breaches involving AI models or applications. Among that group, 97% said they lacked proper AI access controls; the reported incidents involved compromised data in 60% of cases and operational disruption in 31%. | The 97%, 60% and 31% figures describe the subset reporting AI-related breaches, not all surveyed organizations. |
For additional context, Verizon’s 2025 DBIR analyzed more than 22,000 incidents and over 12,000 confirmed breaches worldwide. Its report highlighted third-party involvement, vulnerability exploitation and ransomware. Those counts and findings belong to that edition; they should not be mixed with the 2026 report’s figures.
How can AI expose data or interrupt operations?
AI can enter a security incident in more than one way. Attackers may use generative AI to bolster techniques, as Verizon’s 2026 report describes. Separately, an organization can have an incident involving its own AI model or application, as in IBM’s 2025 findings. Neither statistic means that every use of AI creates a breach.
#1 Best Overall
For a business, the key questions are what data an AI tool or application can access, who can use it, and what happens if that access is abused. IBM’s 2025 findings show that AI-related incidents can involve both compromised data and operational disruption. A data incident may expose information; an operational incident may make systems or services unavailable. Ransomware can threaten both, which is why data protection and recovery planning need to be considered together.
Risk also extends beyond AI. Unpatched software can provide an entry point, compromised accounts can give attackers access, and third-party connections can widen the attack surface. The Verizon findings make clear why an “AI versus traditional hackers” framing is too narrow: businesses need controls for the systems, people and suppliers that attackers may reach.
What should a business prioritize first?
Use this as a discussion checklist with your IT or security provider. The order puts high-impact access and recovery controls alongside the work of understanding what needs protection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Identify critical systems and dependencies. List important business data, applications, suppliers and connections. Decide which systems matter most to revenue or service continuity and the order in which they must be restored. CISA’s StopRansomware Guide recommends identifying critical assets and related dependencies.
- Require multifactor authentication. Enable MFA for email, file storage, remote access and privileged accounts. Prefer phishing-resistant MFA where a service supports it; CISA identifies physical security keys as a strong option among the methods it describes. Check that the chosen method works with the service and devices in use. A security key is one implementation choice, not a complete security program. See CISA’s MFA guidance for businesses.
- Patch exposed and important software. Maintain an inventory, apply updates promptly and prioritize known-exploited vulnerabilities, particularly on internet-facing systems. Verizon’s 2026 report identifies vulnerability exploitation as a leading breach entry pattern; CISA’s small-business resources also cover software updates.
- Set rules and access controls for AI. Ask which AI tools and applications staff use, what business data they can reach, and who is authorized to use them. Establish clear handling rules for business information and review permissions for AI systems, just as you would for other applications. IBM’s 2025 findings make AI access controls a concrete area to examine; they do not establish that any single security product will prevent breaches or reduce a particular organization’s costs.
- Prepare backups and recovery. Keep offline, encrypted copies of critical data and test that they can be restored. Include the risk that ransomware could reach connected or accessible backups. Maintain an incident-response and communications plan so staff know who makes decisions and how the business will coordinate during an outage. CISA’s ransomware guide covers backups and response planning. Backups can support recovery, but they do not prevent data theft or guarantee every impact can be reversed.
- Review supplier access and exposure. Ask which third parties can access business systems or data, whether that access is still needed, and how it will be handled during an incident. Verizon’s 2025 DBIR highlighted third-party involvement, making supplier connections a practical part of the security review.
How should leaders judge whether they are prepared?
Instead of asking only whether the business has an AI security product, assess readiness across six areas:
Rank #3
- Attack surface: Are critical systems, data and dependencies known?
- Identity: Is MFA enabled on the accounts and services that could expose business data or systems?
- Vulnerabilities: Is there a process to update software and prioritize known-exploited flaws?
- Third parties: Is supplier access understood and limited to what is needed?
- AI governance: Are AI tools and applications identified, with clear rules and access controls?
- Recovery: Are backups offline and encrypted, and has restoration been tested?
These checks do not guarantee that an organization will avoid an incident. They help leaders and providers find gaps in prevention, data protection and continuity planning before an outage or breach forces the issue.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
