AI security statistics travel fast and far from their source, so many figures in board papers about AI-enabled attacks, shadow AI and AI governance cannot be traced to a report, a sample or a year. This page collects AI security figures only from the publishers' own report pages, press releases and PDFs: IBM and Ponemon Institute, Verizon, ENISA, Stanford HAI, the UK Department for Science, Innovation and Technology (DSIT), Microsoft, Google Cloud, GitGuardian, the Cloud Security Alliance and the MITRE ATLAS dataset. Each figure carries its report name, publisher and as-of year in the same row, so you can check it and refresh it when the next edition appears. It is written for security leaders, AI governance leads and analysts who need numbers they can defend, and it explains what each figure does and does not measure. Last reviewed: October 2026.
Key takeaways
- AI-enabled attacks are now a measurable share of breaches. IBM's Cost of a Data Breach Report 2026 says one in four malicious breaches were AI-enabled, a 56% increase on the previous year, and those breaches averaged USD 6 million.
- AI systems are themselves being breached. More than 20% of organisations in the IBM 2026 study reported a breach targeting AI models or applications, most often through compromised APIs, applications or plug-ins (27%) and cloud misconfigurations affecting AI workloads (27%).
- Shadow AI is mainstream on corporate devices. The Verizon 2026 Data Breach Investigations Report (DBIR) finds 45% of employees are regular AI users on corporate devices, up from 15%, and 67% of users reach AI services through non-corporate accounts.
- Governance trails adoption. In IBM's 2025 study, 63% of breached organisations had no AI governance policy or were still developing one, and 97% of organisations with an AI-related breach lacked proper AI access controls.
- AI credentials are leaking at scale. GitGuardian's State of Secrets Sprawl 2026 counts 1,275,105 exposed AI-service secrets in 2025, up 81% year on year, which ties AI risk directly to non-human identity hygiene.
Headline statistics
| Figure | Report, publisher, as-of year |
|---|---|
| One in four malicious breaches were AI-enabled, up 56% year on year; AI-enabled breaches averaged USD 6 million against a USD 4.99 million global average | Cost of a Data Breach Report 2026, IBM with Ponemon Institute (602 organisations, breaches March 2025 to February 2026) |
| More than 20% of organisations reported a breach targeting AI models or applications | Cost of a Data Breach Report 2026, IBM with Ponemon Institute |
| 13% of organisations reported breaches of AI models or applications; 97% of those lacked proper AI access controls | Cost of a Data Breach Report 2025, IBM with Ponemon Institute (600 organisations, breaches March 2024 to February 2025) |
| 45% of employees are regular AI users on corporate devices, up from 15% the year before | Data Breach Investigations Report 2026, Verizon (executive summary) |
| The median threat actor researched or used AI assistance in 15 documented attack techniques | Data Breach Investigations Report 2026, Verizon (executive summary) |
| 362 reported AI incidents in 2025, a record high | AI Index Report 2026, Stanford Institute for Human-Centered Artificial Intelligence (HAI), Responsible AI chapter |
| 1,275,105 AI-service secrets exposed in public GitHub commits, up 81% year on year | The State of Secrets Sprawl 2026, GitGuardian (data year 2025) |
| 78% of organisations lack documented, formally adopted policies for creating or removing AI identities | The State of Non-Human Identity and AI Security, Cloud Security Alliance, sponsored by Oasis Security (383 respondents, August to September 2025, published January 2026) |
Statistics by theme (each with primary source and as-of date)
AI-enabled attacks and attacker use of AI
| Figure | Report, publisher, as-of year |
|---|---|
| AI-driven attacks rose 56%, led by AI deepfake impersonation and AI-enabled malware | Cost of a Data Breach Report 2026, IBM with Ponemon Institute |
| 62% of AI-driven attacks targeted critical infrastructure sectors | Cost of a Data Breach Report 2026, IBM with Ponemon Institute |
| 16% of studied breaches involved attackers using AI tools, most often for phishing or deepfake impersonation | Cost of a Data Breach Report 2025, IBM with Ponemon Institute |
| The median threat actor used AI assistance in 15 documented techniques (some actors in 40 or 50); fewer than 2.5% of AI-assisted malware observations involved less common techniques | Data Breach Investigations Report 2026, Verizon (executive summary) |
| Attackers mostly use consumer-grade AI tools to strengthen existing skills rather than to gain breakthrough capabilities; ENISA expects more kill chain phases to be directly enabled by AI in 2026 | ENISA Threat Landscape 2026, European Union Agency for Cybersecurity (calendar year 2025, published September 2026) |
| An AI-assisted cloud intrusion reportedly reached administrative access within 8 minutes (outside the reporting period) | ENISA Threat Landscape 2026, ENISA |
Verizon's GenAI figure describes how widely actors use AI as an assistant, not how many breaches AI caused. ENISA's assessment is qualitative and deliberately cautious. Read the two together: AI is spreading across attacker workflows but mostly amplifies familiar techniques such as phishing, reconnaissance and malware development. See the AI-Powered Cyber Attacks Guide and the AI-Driven Account Takeover Guide.
Attacks on AI models, applications and agents
| Figure | Report, publisher, as-of year |
|---|---|
| More than 20% of organisations reported a breach targeting AI models or applications; top causes were compromised APIs, applications or plug-ins (27%) and cloud misconfigurations affecting AI workloads (27%) | Cost of a Data Breach Report 2026, IBM with Ponemon Institute |
| Breaches involving AI model inversion attacks averaged USD 6 million | Cost of a Data Breach Report 2026, IBM with Ponemon Institute |
| 13% reported breaches of AI models or applications and a further 8% did not know; of those compromised, 60% said data was exposed and 31% reported operational disruption | Cost of a Data Breach Report 2025, IBM with Ponemon Institute |
| 57 case studies in the ATLAS knowledge base (17 real-world incidents, 40 exercises), with 14 dated 2025 and 5 dated 2026 | MITRE ATLAS 5.6.0 dataset, MITRE (as of October 2026) |
| Most frequent techniques across ATLAS case study procedures: AML.T0065 LLM Prompt Crafting (20 case studies), AML.T0015 Evade AI Model (17), AML.T0053 AI Agent Tool Invocation (14), AML.T0051.001 Indirect LLM Prompt Injection (13) | MITRE ATLAS 5.6.0 dataset, MITRE (as of October 2026, count by NHI Mgmt Group) |
| 24,008 unique secrets exposed in Model Context Protocol (MCP) configuration files; Google API keys were 19.2% and PostgreSQL connection strings 14% | The State of Secrets Sprawl 2026, GitGuardian (data year 2025) |
The ATLAS counts describe a curated knowledge base, not incident prevalence: they show which techniques defenders and researchers have documented most, which is a useful guide to test coverage. Indirect prompt injection appears in real incidents such as EchoLeak 2025, a zero-click Microsoft 365 Copilot flaw (CVE-2025-32711) that Microsoft fixed server-side with no evidence of exploitation. See the Prompt Injection Guide, the AI Model Security Guide and the AI Red Teaming Guide.
Shadow AI and workforce AI use
| Figure | Report, publisher, as-of year |
|---|---|
| 45% of employees are regular AI users on corporate devices, authorised or not, up from 15% | Data Breach Investigations Report 2026, Verizon (executive summary) |
| 67% of users access AI services through non-corporate accounts on corporate devices, a slight decrease on the prior year | Data Breach Investigations Report 2026, Verizon (executive summary) |
| Shadow AI is the third most common non-malicious insider action in Verizon's DLP dataset, a fourfold increase in share; source code was the most common data type submitted to external GenAI models | Data Breach Investigations Report 2026, Verizon (executive summary, 2025 DLP dataset) |
| In 3.2% of DLP policy violations, research and technical documentation was uploaded to unauthorised AI systems | Data Breach Investigations Report 2026, Verizon (executive summary) |
| One in five organisations reported a breach linked to shadow AI; high shadow AI added an average of USD 670,000 per breach | Cost of a Data Breach Report 2025, IBM with Ponemon Institute |
| Shadow AI incidents compromised personal data in 65% of cases (53% global average) and intellectual property in 40% (33%) | Cost of a Data Breach Report 2025, IBM with Ponemon Institute |
Shadow AI often enters through OAuth grants rather than browser tabs. In the Vercel Context.ai OAuth Breach 2026, a stolen OAuth token for an AI tool that an employee had granted full Google Workspace access led into Vercel and to customer environment variables. See the Shadow AI Discovery Guide and the AI Usage Monitoring Guide.
AI governance, policy and AI identities
| Figure | Report, publisher, as-of year |
|---|---|
| 63% of breached organisations lacked an AI governance policy or were still developing one; 37% had policies to manage AI or detect shadow AI | Cost of a Data Breach Report 2025, IBM with Ponemon Institute |
| Of organisations with an AI governance policy, 34% regularly audit for unsanctioned AI | Cost of a Data Breach Report 2025, IBM with Ponemon Institute |
| Information security held primary responsibility for AI governance in 21% of organisations in both 2024 and 2025; risk and compliance rose from 13% to 19% | AI Index Report 2026, Stanford HAI, Responsible AI chapter |
| GDPR influenced responsible AI decisions in 60% of organisations and the EU AI Act in 43% (2025) | AI Index Report 2026, Stanford HAI, Responsible AI chapter |
| 78% lack documented, formally adopted policies for creating or removing AI identities; more than 16% do not track when new AI-related identities are created | The State of Non-Human Identity and AI Security, Cloud Security Alliance, sponsored by Oasis Security (2026) |
| Only 14% say creation and removal of AI-related identities is fully automated; 27% handle it entirely by hand | The State of Non-Human Identity and AI Security, Cloud Security Alliance, sponsored by Oasis Security (2026) |
| Of UK businesses already using AI, 40% had AI-specific cyber security practices, 47% did not and 13% were unsure | AI Cyber Security Survey, DSIT (350 businesses, fieldwork January to February 2024, published May 2024) |
The CSA figures come from a vendor-sponsored survey and should be presented as such; they remain one of the few published measures of how organisations govern AI agent identities. See the AI Governance Guide, the Agentic AI Identity Guide and the AI Register and AI Inventory Template.
AI credentials and the identity link
| Figure | Report, publisher, as-of year |
|---|---|
| 1,275,105 AI-service secrets exposed on public GitHub in 2025, up 81% year on year | The State of Secrets Sprawl 2026, GitGuardian |
| AI-assisted commits leak secrets at twice the baseline rate | The State of Secrets Sprawl 2026, GitGuardian |
| Fastest growing leaked AI service keys (detectors with over 1,000 hits): OpenRouter 48x, DeepSeek 23x, Brave Search 13.5x | The State of Secrets Sprawl 2026, GitGuardian |
| 24% of organisations take more than 24 hours to rotate or revoke a credential after potential exposure | The State of Non-Human Identity and AI Security, Cloud Security Alliance, sponsored by Oasis Security (2026) |
Leaked AI keys are monetised directly. The LLMjacking campaigns from 2024 to 2026 used stolen cloud access keys and AI service API keys, some exposed on GitHub, to consume and resell model access at the victims' expense. For machine identity and secrets figures in depth, see the Non-Human Identity and Secrets Statistics Guide and the API Key Management Guide.
AI adoption and AI in defence
| Figure | Report, publisher, as-of year |
|---|---|
| Organisations using AI and automation extensively in security saved USD 1.93 million compared with those using none | Cost of a Data Breach Report 2026, IBM with Ponemon Institute |
| One in four organisations had not adopted AI or automation in security operations; more than 50% use agents for threat detection and containment, only 18% for vulnerability management | Cost of a Data Breach Report 2026, IBM with Ponemon Institute |
| Extensive security AI and automation shortened the breach lifecycle by an average of 80 days | Cost of a Data Breach Report 2025, IBM with Ponemon Institute |
| 88% of enterprises are experimenting with AI agents and 82% of leaders plan broader rollouts within 12 to 18 months | Microsoft Digital Defense Report, Microsoft (report page reviewed October 2026; period not stated for these figures) |
| 68% of surveyed UK businesses were using AI and 32% planned to adopt it | AI Cyber Security Survey, DSIT (2024; not representative of all UK businesses) |
See the AI SOC Guide and the Agentic AI in the SOC Guide.
What the numbers mean for defenders
- Treat AI applications as an access control problem first: IBM's top causes of AI breaches are compromised APIs, plug-ins and cloud misconfiguration, not exotic model attacks. Inventory every AI workload, the identities it runs as and the data stores it can reach. See the AI Security Posture Management (AI-SPM) Guide.
- Measure shadow AI with telemetry, not surveys: Verizon's 67% non-corporate account figure means policy alone will not hold. Use DLP, secure web gateway and CASB logs to count sanctioned versus unsanctioned AI destinations and data types sent.
- Govern AI identities like other machine identities: the CSA and GitGuardian figures show AI agents and AI keys inherit every weakness of service accounts and secrets: no owner, long-lived keys, slow revocation. Apply ownership, short-lived credentials and rotation SLAs. See the AI Agent Authorisation Guide.
- Prioritise phishing and impersonation defences for AI-amplified attacks: IBM and ENISA both point to deepfake impersonation and AI-written phishing. Phishing-resistant MFA and out-of-band verification for payments and help desk resets address the outcome regardless of how the lure was made.
- Test against documented techniques: use the most frequent ATLAS techniques (prompt crafting, model evasion, agent tool invocation, indirect prompt injection) as the starting test set for AI red teaming and guardrail evaluation.
- Use AI in defence where the evidence is strongest: IBM's savings figure is consistent across two editions; start with detection, triage and containment workflows and measure dwell time before and after.
Metrics worth tracking internally
| Metric | Why it maps to the external figures |
|---|---|
| Percentage of AI applications and agents in the AI register with a named owner | Counters the ownership gap (51% report no clear ownership, CSA 2026) |
| Share of AI traffic to unsanctioned services, by data class | Internal equivalent of Verizon's shadow AI DLP findings |
| Median time to revoke an exposed AI or LLM API key | Benchmarks against the 24% taking more than 24 hours (CSA 2026) |
| AI-service secrets detected in code, MCP configs and tickets per month | Tracks the trend GitGuardian measures publicly |
| Coverage of AI red team tests across the top ATLAS techniques | Links test scope to documented attack patterns |
Methodology notes and caveats
- IBM and Ponemon: the Cost of a Data Breach study covers organisations that had a breach (602 in 2026, 600 in 2025), so its percentages describe breached organisations, not all organisations. Costs are modelled estimates from interviews, not audited losses. The 2026 report page and the 29 July 2026 press release are the sources here; the 2025 figures come from IBM's 30 July 2025 press release.
- Verizon DBIR: the GenAI and shadow AI figures come from contributor datasets (threat intelligence and DLP telemetry), not from confirmed breach analysis. "Regular AI user" is Verizon's definition based on corporate device telemetry.
- Stanford AI Index: the 362 incidents figure counts publicly reported AI incidents of all kinds (safety, bias, misuse and security), not security incidents alone, and reporting volume grows with media attention.
- MITRE ATLAS counts: computed by NHI Mgmt Group from the ATLAS 5.6.0 dataset. Case studies are curated and include red team exercises, so they indicate documentation, not frequency in the wild.
- GitGuardian: counts come from scanning public GitHub commits (GitGuardian states 43% of public commits were scanned) and are vendor research.
- CSA and DSIT surveys: self-reported. The CSA survey was sponsored by Oasis Security, which co-developed the questionnaire. DSIT states its 2024 AI survey is not representative of the wider UK business population because medium and large businesses were over-represented and results were unweighted.
- Microsoft: figures are taken from the Digital Defense Report web page, which does not state a period for the AI agent adoption figures; treat them as directional.
- Refresh cadence: IBM usually publishes in late July, Verizon in spring, Stanford HAI in April, ENISA in the autumn and GitGuardian in March. Check each publisher's page when updating.
Practitioner checklist
- Quote every AI statistic with report name, publisher, sample and year, and say whether the population is breached organisations, survey respondents or telemetry.
- Build and maintain an AI register covering models, AI applications, agents, MCP servers and the identities each uses.
- Scan code, MCP configuration files, notebooks and tickets for AI-service keys and connect findings to automated revocation.
- Set a revocation SLA for exposed AI keys and measure it monthly.
- Instrument shadow AI: count unsanctioned AI destinations, OAuth grants to AI apps and data classes sent.
- Review OAuth consent policies so AI apps cannot obtain broad Workspace or Microsoft 365 scopes without approval.
- Test AI applications against the most documented ATLAS techniques, including indirect prompt injection and agent tool invocation.
- Record AI-enabled phishing and impersonation attempts separately in incident data so you can compare against IBM and Verizon trends.
Standards and references
- IBM: Cost of a Data Breach Report 2026
- IBM Newsroom: One in four malicious breaches are AI-enabled
- IBM Newsroom: 13% of organisations reported breaches of AI models or applications (2025 report)
- Verizon: 2026 Data Breach Investigations Report executive summary
- ENISA: Threat Landscape 2026
- Stanford HAI: AI Index Report 2026, Responsible AI
- MITRE ATLAS: Adversarial Threat Landscape for AI Systems
- DSIT: AI cyber security survey, main report
Further primary sources used: GitGuardian: The State of Secrets Sprawl 2026, Cloud Security Alliance: State of NHI and AI Security survey release and Microsoft: Digital Defense Report.
Related NHI Mgmt Group resources: Cybersecurity Statistics Guide · Non-Human Identity and Secrets Statistics Guide · Data Breach Statistics Guide · LLM Security Guide · Top 10 Shadow AI Risks