Topic starter
01/08/2026 8:53 pm
TL;DR: IBM's 2026 Cost of a Data Breach Report, published by Mind, shows breaches increasingly exploit gaps between point tools, with AI-enabled malicious incidents averaging $6 million, shadow AI incidents reaching 43%, and only 37% of breached organisations encrypt data at rest and in transit. The real control failure is incomplete coverage across data states, AI workloads, and identity boundaries.
Editorial analysis by NHI Mgmt Group, based on content published by Mind: “IBM's 2026 breach report: the cost of incomplete data security”.
By the numbers:
- IBM's 2026 Cost of a Data Breach Report put the global average breach cost at $4.99 million, up 12% from a year earlier.
- The share of security incidents involving shadow AI rose to 43% year over year.
Key questions
Q: What breaks when data security tools only cover part of the workflow?
A: Coverage breaks at the handoff points.
Q: Why do shadow AI tools create risk even when endpoint and DLP controls exist?
A: Shadow AI creates risk because those controls depend on sanctioned channels and known destinations.
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped.
Practitioner guidance
- Map control boundaries across the full data path Document where your DLP, DSPM, endpoint, SaaS and AI controls each begin and end, then flag every handoff that depends on a different team or product.
- Inventory shadow AI and unmanaged assistants Build an inventory of approved and unapproved AI tools, browser-based assistants and plug-ins that can touch sensitive data, then classify them by business use and data exposure.
- Scope AI agent permissions like privileged access Review AI agents and automations as governed identities, with explicit data-read, data-move and data-disclose permissions that can be revoked when the use case changes.
Bottom line: The report's core lesson is that modern breaches exploit coverage gaps between tools, not just weaknesses inside a single control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:02 pm
Incomplete coverage is now the dominant data security failure mode. The report's most important signal is not that a single control failed, but that the control stack stopped at the seams between data states, AI workloads and delegated access. That means the governance problem is architectural, not cosmetic. Practitioners should stop asking which tool failed and start asking which handoff is unowned.
A question worth separating out:
Q: What should organisations do when AI tools can take actions on behalf of users?
A: Treat agent actions as governed identity events and require logging of tool calls, delegation chains, and execution context. Without that layer, investigations cannot tell whether an action came from the human operator, the agent, or a downstream delegated workflow.
👉 Read our full editorial: IBM’s 2026 breach report shows where data security breaks down