Enterprise AI systems breached due to lack of access controls and governance
IBM's 2025 data breach report found that 13% of surveyed organizations experienced breaches of AI models or applications, with 97% lacking proper access controls. These AI-related breaches cost significantly more than conventional breaches and frequently resulted in data compromise or operational disruption.
What happened
IBM's 2025 Cost of a Data Breach Report found that 13% of 600 surveyed organizations globally reported breaches of AI models or applications between March 2024 and February 2025.
Of the organizations reporting AI breaches, 97% reported lacking proper AI access controls in place. The report noted that 63% of breached organizations either lack an AI governance policy or are still developing one.
Reported impact
Breaches involving AI tools cost an average of $308,000 more than those not involving AI. In Canada specifically, the average breach cost reached $6.98 million in 2025, a 10.4% increase from 2024.
Of AI-related security incidents, 60% led to compromised data and 31% led to operational disruption.
Index analysis
IBM stated that AI adoption is greatly outpacing AI security and governance, with threat actors beginning to exploit the gap between deployment and oversight. The report characterized ungoverned AI systems as more likely to be breached and more costly when compromised.
Governance controls
IBM found that organizations using AI and automation extensively throughout their security operations saved an average of $1.9 million in breach costs and reduced the breach lifecycle by an average of 80 days.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.