97% of AI Breaches Share One Root Cause: No Access Controls

For the first time, IBM's Cost of Data Breach Report studied the state of security and governance for AI — and the findings should alarm every CISO in the enterprise.

Thirteen percent of organizations reported breaches of AI models or applications. Another 8 percent did not know whether they had been compromised. Of those that confirmed a breach, 97 percent reported that they lacked AI access controls at the time of the incident.

That statistic deserves emphasis. Not 97 percent lacked advanced threat detection. Not 97 percent lacked zero-trust architecture. Ninety-seven percent lacked basic access controls for their AI systems.

The consequences of these breaches were severe: 60 percent resulted in compromised data, and 31 percent caused operational disruption. The report's conclusion is direct: organizations are bypassing security and governance for AI in favor of immediate adoption.

This pattern mirrors what happened in the early days of cloud computing. Organizations rushed to deploy cloud services before establishing identity management, encryption, or access policies. The result was a decade of cloud security incidents that were entirely preventable. We are now repeating that cycle with AI, but at a faster pace and with higher stakes.

The 63 percent of breached organizations that either lack an AI governance policy or are still developing one represents a governance vacuum. But even among organizations with policies in place, only 34 percent perform regular audits for unsanctioned AI usage. Policy without enforcement is aspiration, not governance.

What would adequate AI access controls actually look like? At minimum: centralized authentication tied to corporate identity (Active Directory, Entra ID, or equivalent), per-user and per-application permissions for model access, real-time content inspection for sensitive data, immutable audit logs of every AI interaction, and budget controls that cap spending before it occurs.

None of these capabilities are exotic. They are the same controls enterprises apply to every other category of technology infrastructure. The failure to apply them to AI is not a technology gap. It is a priorities gap — and IBM's data suggests the cost of that gap is measurable and growing.