A new report commissioned by IBM has found that one in four breaches is now AI-enabled, up 56% from last year.
“Most AI-driven attacks reported in the study targeted critical infrastructure sectors (62%), with financial services and energy organizations experiencing the highest concentration, raising the risk of broader systemic disruption,” the report says. “Financial services breaches were reported to cost on average $6.3 million, while energy breaches cost on average $5.2 million. The concentration of attacks across these sectors increases the potential for cascading impacts across economies, supply chains, and essential services.”
Additionally, these AI-enabled breaches cost an average of $6 million, around $1 million higher than the global breach average.
“AI‑driven attacks led to significant financial impacts, adding USD 1 million to the average malicious breach cost,” the report says. “As attackers adopt more advanced frontier AI model capabilities, these attacks will likely reshape breach economics by accelerating attack speed, scaling targeting and increasing downstream business impact. That speed can compress timelines from weeks to days and push the cost of delayed response even higher.”
Many of these AI-enabled attacks involved deepfake impersonations, as phishing remained the top initial access vector.
“Attackers used impersonation for conducting high-damage data breaches,” the researchers write. “Voice and SMS phishing, used in 17% of attacks, led to the highest average breach costs among attack vectors, USD 5.29 million. Social engineering, such as impersonating help desk staff, was used in 13% of attacks and led to average breach costs of USD 5.23 million. Valid account abuse was slightly less costly at USD 5.07 million, suggesting that phishing and social engineering attacks are targeting credentials with access to prized data. In nearly 10% of data breaches, attackers illicitly replicated data on removable media, showing that even in the age of cloud computing and AI, it’s important not to overlook these decades-old threat vectors.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 Platform to strengthen their security culture and reduce workforce risk.
IBM has the story: https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
