IBM: 92% of AI breaches traced to missing access controls, costs hit $5.3M

The flashy headlines about prompt injection and model poisoning make it easy to forget that most AI security failures are remarkably boring. IBM’s latest Cost of a Data Breach Report, drawing on Ponemon Institute research across 602 organizations, found that 92 percent of companies hit by an AI-related security incident had one thing in common: they hadn’t bothered with basic access controls.

Think about that. We’re talking about the digital equivalent of leaving the front door unlocked while installing a laser grid in the living room. IBM’s data shows the entry point in roughly one in five cases wasn’t even the AI model itself — it was a compromised API, an improperly connected application, or a cloud service bucket someone forgot to lock down. Open-source versus proprietary models made virtually no difference in breach rates. The vulnerability wasn’t in the algorithm; it was in the operations.

The financial stakes are climbing fast. Incidents with an AI component cost organizations an average of $5.33 million, compared to $4.70 million for breaches without one. When attackers wielded AI themselves, that figure jumped to $6.04 million. The global average across all breaches rose 12 percent year-over-year to $4.99 million. These are not theoretical numbers — they reflect actual response costs, lost business, and regulatory fines hitting budgets right now.

What’s striking here is how little this has to do with the frontier-model safety debates consuming Silicon Valley. No advanced adversarial technique is required to exploit a public S3 bucket or an unauthenticated inference endpoint. The 92 percent figure suggests that before any organization worries about alignment or jailbreaking, they’d get a much better return on investment by auditing who can actually call their models and from where. That’s not glamorous work, but the $5.3 million average price tag makes a compelling case for doing the unsexy stuff first.