What happened
According to IBM's 2026 Cost of Data Breach report, U.S. companies are spending more on AI-driven security tools than ever. However, breach costs are also increasing, with a record $11.5 million on average, up 11% from last year and nearly double the global average. The problem is that companies don't use AI evenly across their security work, with most using it for detection and response, but not for prevention.
IBM's 2026 Cost of Data Breach report found that U.S. companies are spending more on AI-driven security tools than ever.
Breach costs are also increasing, with a record $11.5 million on average, up 11% from last year and nearly double the global average.
The problem is that companies don't use AI evenly across their security work, with most using it for detection and response, but not for prevention.
Lucie Cardiet, cyberthreat research manager at Vectra AI, says vulnerability discovery and exploitation that once took a skilled team weeks now happens in hours.
Faster breaches leave less time to detect and contain them, and large-scale attacks also drive up forensic and legal costs, on top of lost revenue from the disruption.
Source details: spiceworks.com ↗
Why it matters
The paradox security teams are living with is that AI adoption keeps climbing, and so do the bills. The two aren't moving in opposite directions, as many assumed. The real cost reduction won't materialize until AI is integrated into prevention-focused work, including patch management, vulnerability remediation, and access governance.
The real cost reduction won't materialize until AI is integrated into prevention-focused work, including patch management, vulnerability remediation, and access governance.
Agentic AI raises the stakes, allowing attackers to automate an entire chain, from reconnaissance to data theft, in minutes.
Researchers at Palo Alto Networks claim to have simulated an AI-assisted attack and data exfiltration in just 25 minutes.
The harder problem is that most security controls were built to catch something that looks wrong, but the problem today is that nothing looks wrong.
Shadow AI is adding to the bill, with incidents involving shadow AI more than doubling this year.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').A route planner searches possible journeys using explicit rules. What does this illustrate about AI?
What to watch next
The adoption of AI in security operations is lopsided, with most using AI for detection and response instead of prevention. Only 18% of enterprises use AI agents for vulnerability scans and management, and more than a third of organizations don't use AI for front-line work like finding and patching vulnerabilities before attackers do.
The adoption of AI in security operations is lopsided, with most using AI for detection and response instead of prevention.
Only 18% of enterprises use AI agents for vulnerability scans and management, and more than a third of organizations don't use AI for front-line work like finding and patching vulnerabilities before attackers do.
BCG found similar gaps, with only 41% of enterprises having formal policies, and only 20% having shadow AI monitoring, -injection detection, or non-human identity governance in place.
Alfredo Hickman, CISO at Kai, notes that attackers can find and exploit a weakness in minutes, yet 60% of organizations still take more than a week to fix a critical vulnerability.
David Lee, field CTO at identity security firm Saviynt, warns that as environments get more automated, gaps get harder to see and easier to scale.