Vic SolAI breaches don't start in the model; they start with who has access
For anyone approving AI tools connected to company data who answers for the risk if something leaks.
In 30 seconds
- IBM's annual data breach study finds that among organizations that suffered an AI-related breach, 92% lacked proper access controls for those systems.
- The AI risk in your operation is less exotic than it sounds: it is who gets in, with which permissions and through which connection.
- Before adding another tool, review access, connections and encryption on what already runs.
The exhibit
| No proper AI access controls (among orgs with an AI breach) | 92% |
|---|---|
| Use access controls on AI models and data | 40% |
| Encrypt sensitive data at rest and in transit | 37% |
| Apply agents to vulnerability management | 18% |
IBM and Ponemon Institute, Cost of a Data Breach Report 2026, July 29, 2026. 602 organizations breached between Mar. 2025 and Feb. 2026.
Fact
- The study covers 602 organizations breached between March 2025 and February 2026. The global average cost reached a record $4.99 million, up 12% from the prior year.
- More than 20% of organizations reported a breach targeting AI models or applications. Main causes: compromised APIs, applications or plug-ins (27%) and cloud misconfigurations affecting AI workloads (27%).
- Of organizations with AI-related breaches, 92% lacked proper access controls. Only 40% reported using access controls on AI models and data.
- One in four malicious breaches was AI-enabled, at an average cost of $6 million.
- Only 37% encrypt sensitive data both at rest and in transit.
My read
The AI risk conversation often drifts to sophisticated topics. This study points to something more basic: permissions, connections and configuration. That is good news for a manager, because it can be reviewed without being a model expert. A tool connected to email, the CRM or a shared folder inherits whatever permissions you gave it. If nobody knows what those are, that is the first risk worth closing.
What to do on Monday
- List the AI tools your area already uses, which data they connect to and who granted access. Sheet: inventory of the AI you already pay for
- Add three rows to your risk register: AI access, connections and plug-ins, and cloud configuration. Sheet: risk and readiness register
- Publish a short policy stating which data goes into no tool without approval. Sheet: one-page AI policy
What we don't know
- It only includes organizations that were breached; there is no comparison with those that weren't.
- IBM sponsors and publishes the study and sells security and identity products related to its findings.
- The release does not list countries; we don't know how many Latin American companies are in the sample.
Vic Sol · Decision Desk · vicsol.org/resources/ · Free to use with attribution. Independent summary of a public source; figures belong to their author. Not legal, financial or audit advice.