AI breach rates are rising: what are security teams missing?

TL;DR: 89.5% of organizations suffered a generative AI breach and 88.4% suffered an AI agent breach in the past year, while more than 80% still said they were confident in preventing unauthorized data access, according to AvePoint’s State of AI 2026 Report. Confidence without continuous control is now a governance failure, not a maturity marker.

Editorial analysis by NHI Mgmt Group, based on content published by AvePoint: “The State of AI 2026: Security Insights CISOs Need to Know”.

By the numbers:

• 89.5% of organizations experienced a generative AI-related breach in the past 12 months, up from 75.1% in 2025.
• 88.4% of organizations reported at least one AI agent-related breach in the past 12 months.
• 72% of the respondents who were very confident still experienced an AI-related unauthorized access incident.

Key questions

Q: What breaks when AI agent access is broader than the task it is trying to complete?

A: When agent access is broader than the task, the identity can touch systems, data, and tools that were never necessary for the work.

Q: Why do high-confidence AI programmes still experience breaches?

A: High-confidence programmes often rely on policy declarations, not continuous enforcement.

Q: How should security teams govern shadow AI without slowing adoption?

A: Start with continuous discovery, then classify tools by data access, system connectivity, and provider trust.

Practitioner guidance

• Map every AI agent to an owner and access boundary Create an inventory of sanctioned and unsanctioned agents, then record which data, tools, and actions each one can reach.
• Enforce task-scoped authorization for agent actions Limit each agent to the minimum privileges needed for the specific task, and require approval or policy checks for higher-risk actions such as data changes, external sharing, or system updates.
• Instrument logging for agent decisions and side effects Capture what the agent accessed, what it changed, and which tools it invoked so investigations can reconstruct behavior after the fact.

Bottom line: The report points to a widening mismatch between AI confidence and actual control, which means governance maturity must be measured operationally rather than claimed on paper.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →