How to cut data breach costs with AI and automation

TL;DR

AI can both fuel and mitigate data breaches. The cost of a breach worldwide averages about 5 million per incident and US costs are higher, while AI and automation can reduce breach costs by about 2 million and shorten breach duration by around 65 days. To defend effectively, organizations should deploy AI agents for threat detection and response and improve access controls for AI deployments.

Transcript

Powerful new AI frontier models are revolutionizing cybersecurity. Models like Anthropic Mythos and similar ones from other vendors are popping up everywhere and exposing security vulnerabilities that have been lying just under the surface for decades. Their ability to have identified these gaps with a velocity and volume never seen before is compr... Read More

Key Insights

• AI is accelerating cyber threats but also enabling defenses by automation.
• The average global cost of a data breach is around 5 million, with the US higher, reflecting global variability in impact.
• Ransomware remains a major driver of breach cost and frequency, increasing attacker pressure on victims.
• AI-assisted attacks grew 56 percent, and AI-driven malware can raise costs by about 1 million per incident.
• One in four breaches involved AI in some form, highlighting the need for robust AI security controls.
• Automating threat detection and response with AI reduces breach costs and containment time significantly.
• Only 18 percent of organizations use foundation models for vulnerability management, indicating room for growth in AI security tooling.
• Weak access controls for AI systems are common, with 92 percent lacking proper protections, pointing to misconfigurations and API risk as key weak spots.

Questions & Answers

Q: How can AI and automation lower the cost of a data breach?

AI and automation can lower breach costs by enabling faster detection, response, and containment. By reducing the time to identify and contain a breach, organizations can limit data loss and associated expenses. The analysis shows an approximate 2 million reduction in breach cost when AI and automation are extensively used, along with a shorter breach duration by about 65 days.

Q: What is the global average cost of a data breach, and how does the US compare?

The worldwide average cost per incident is about 5 million, reflecting a broad range of breach sizes and responses. In the United States, the cost is higher, indicating more expensive consequences or reporting requirements. These figures illustrate the financial impact of breaches and the importance of effective breach prevention and response.

Q: Which attack types showed persistent costs and frequency, and why are they concerning?

Phishing attacks and social engineering remained high in both cost and frequency, signaling that attackers continue to rely on manipulation and credential theft. Supply chain issues also emerged as frequent threats, especially as AI enables broader, more complex attack vectors across vendors and ecosystems.

Q: How does ransomware factor into overall breach costs and trends?

Ransomware remains a significant driver of breach impact, with its share of breaches increasing from 34% to 39%. This indicates attackers are adopting higher impact extortion tactics, targeting data, brand reputation, employees, and intellectual property, which compounds financial and operational damage.

Q: What role does AI play in driving or mitigating breaches, according to the report?

AI drives breaches by enabling faster, more scalable attacks, including AI-generated malware and deepfakes. It was implicated in about one in four breaches and can add roughly 1 million in cost per incident when AI is involved. Conversely, AI and automation in security can also reduce costs and containment times when deployed effectively.

Q: What containment and response metrics are highlighted, and what do they imply?

Mean time to identify averaged 183 days and time to contain and mop up averaged 64 days, totaling 247 days to address a breach. This is a long window that allows attackers to do damage, underscoring the need for faster detection, improved monitoring, and more proactive defense strategies.

Q: What positive trends were observed with AI in security operations?

Organizations using AI agents in security operations saw reductions in breach costs and faster response, demonstrating that AI can enhance detection, investigation, and containment. About half of organizations reported using AI agents for threat detection and response, indicating growing adoption of AI in SOC workflows.

Q: What gaps exist in AI security practices that need attention?

A large gap exists in access controls for AI deployments, with about 92 percent lacking proper protections for AI-related systems. This highlights risks from misconfigurations, insecure APIs, plugins, and cloud environment exposures. Closing these gaps is essential to prevent AI-driven breaches and maximize security benefits.

Summary & Key Takeaways

• A data breach costs are substantial and rising, with worldwide averages around 5 million and US averages higher, driven in part by ransomware and AI-enabled attacks.

• AI and automation can lower breach costs by about 2 million and reduce breach duration by roughly 65 days when deployed in security operations.

• Improved access controls and careful use of AI models, including foundation models, are essential to reduce attacks and manage risk in AI-driven security environments.