Topic starter
11/07/2026 8:21 pm
TL;DR: Breach costs fell globally to $4.4 million for the first time in five years, Swarmnetics reports in IBM's 2025 Cost of Data Breach Report, but AI governance is now a cost variable. Shadow AI and unmanaged AI tools can add hidden access paths that raise recovery drag and widen what security teams must track.
Editorial analysis by NHI Mgmt Group, based on content published by Swarmnetics: “New IBM Cost of Data Breach Report: Costs Down Globally, But Control of AI is Key”.
By the numbers:
- The 2025 report puts global average breach cost at $4.4 million, down for the first time in five years.
- The report says organisations using extensive AI-driven automation in defence recovered 80 days faster.
- IBM found that 63% of respondents still lacked an AI governance policy.
Key questions
Q: Why does shadow AI create such a high breach risk?
A: Shadow AI creates high breach risk because it can access sensitive data outside normal oversight, then process or reproduce that data in places security teams do not control.
Q: What signs show AI governance is too weak for security operations?
A: Common warning signs include no formal approval process for AI deployments, no clear owner for AI tools, and employees using assistants or plugins outside sanctioned channels.
Q: What fails when organisations let AI tools bypass approval and inventory controls?
A: The failure is governance visibility.
Practitioner guidance
- Govern AI tools as access paths Map every sanctioned AI assistant, app, API, and plugin to an owner, approval route, and data-access scope before rollout.
- Inventory shadow AI with identity controls Add employee-used AI tools to discovery, access review, and offboarding processes so delegated permissions do not escape oversight.
- Require formal approval for AI deployments Make approval a prerequisite for any AI system that can read data, call APIs, or integrate into business workflows.
Bottom line: AI governance is now part of breach economics because unmanaged assistants, plugins, and apps can expand access without normal oversight.
Glossary terms: AI Governance, Shadow AI, Delegated Access, Governed AI access
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 hours ago by NHI Mgmt Group
11/07/2026 8:51 pm
AI governance debt is now a breach-cost driver, not a side issue. The report ties breach economics to policy maturity, approval discipline, and the ability to govern AI tooling before it touches data or workflows. That makes governance lag a measurable security liability rather than an administrative gap. Practitioners should treat AI governance as part of core identity and access control.
A few things that frame the scale:
- The global average cost of a data breach reached $4.99 million in 2026, up 12% on the previous year, according to IBM's 2026 Cost of a Data Breach Report.
A question worth separating out:
Q: How should IAM and NHI teams respond to AI tools that access data and APIs?
A: They should treat them as governed non-human access paths. That means defining ownership, limiting data scope, reviewing permissions, and including AI tools in onboarding and offboarding processes. The key question is not whether the tool is intelligent, but whether its access can be controlled like any other privileged integration.
👉 Read our full editorial: AI governance gaps are reshaping breach costs in IBM’s 2025 report