92% of companies hit by AI breaches had no access controls. IBM just put a $4.99M price tag on your negligence.

IBM's 2026 Cost of a Data Breach Report dropped this week.

The average breach hit $4.99 million. A record.

But the number that should keep every CISO awake is this:

92% of organizations that suffered an AI-related breach had no proper access controls in place.

Not weak controls. Not outdated controls. No controls.

The two costliest attack types weren't exotic. They were access failures wearing an AI label.

Model inversion: $6.07 million per breach. Attackers query your model enough times and reconstruct sensitive training data from the outputs.

Prompt injection: $5.89 million per breach. Crafted input hijacks your AI agent and reaches whatever its identity allows.

Both attacks need one thing to work: wide-open access to your models and data.

Only 40% of organizations control access to their AI models and data. The rest are running frontier AI with the security posture of a public API.

Meanwhile, AI-driven attacks climbed 56% and added $1 million to every breach they touched.

Organizations using AI and automation for security saved $1.93 million per breach. But only 18% use AI for vulnerability scanning. The defenders automate cleanup. The attackers automated finding the door.

Audit your non-human identities and AI model access controls today.

If you can't answer who has access to your models and what they can reach, you're already a target.