Security teams are pouring money into AI tools, yet U.S. breach costs hit a record this year. The problem isn’t the AI — it’s where teams are using it.
According to IBM’s 2026 Cost of Data Breach report, U.S. companies are spending more on AI-driven security tools than ever. They’re also paying more for breaches — a record $11.5 million on average, up 11% from last year and nearly double the global average.
That’s the paradox security teams are living with: AI adoption keeps climbing, and so do the bills. The two aren’t moving in opposite directions, as many assumed.
READ MORE:
Decoding tokenomics and real AI costs with the Linux Foundation
It’s not for lack of investment, cybersecurity spending grew 12% last year, driven by new AI-powered tools. According to a 2026 BCG report, most CISOs expect AI-led spending to keep growing for another one to two years before it levels off.
So why isn’t more AI bringing breach costs down? IBM says the problem is simple: companies don’t use AI evenly across their security work. Most businesses use AI to find and respond to threats, but very few use it to scan for and handle vulnerabilities.
This is the critical issue to address. Organizations invest in AI-powered detection systems while neglecting AI applications in breach prevention activities. The real cost reduction won’t materialize until AI is integrated into prevention-focused work—including patch management, vulnerability remediation, and access governance.
Why breaches keep getting pricier
AI is rewriting the economics of attack — by lowering the barrier for attackers who don’t have much skill.
Take phishing. Drafting a convincing email used to take 16 hours; with generative AI, it takes about five minutes, according to IBM. Check Point Software warns in a blog post that GenAI models can spin up unique, working malware variants in seconds, and its research found phishing-as-a-service kits now ship with jailbroken language models baked in.
Agentic AI raises the stakes. Attackers can automate an entire chain, from reconnaissance to data theft, in minutes. Researchers at Palo Alto Networks claim to have simulated an AI-assisted attack and data exfiltration in just 25 minutes.
READ MORE:
Modernizing IT Device Management with the Cytrence Kiwi KVM Family
Lucie Cardiet, cyberthreat research manager at Vectra AI, says vulnerability discovery and exploitation that once took a skilled team weeks now happens in hours — the window between a flaw being found and being used has collapsed. The harder problem, she says, is that “most security controls were built to catch something that looks wrong. The problem today is that nothing looks wrong.”
Faster breaches leave less time to detect and contain them. Large-scale attacks also drive up forensic and legal costs, on top of lost revenue from the disruption. Jaguar Land Rover is a case in point: after a major cyberattack, the U.K. automaker reported a 24% year-over-year drop in quarterly revenue in 2025, from £6.5 billion ($8.6 billion) to £4.9 billion (about $6.5 billion), and posted a £485 million (about $643 million) loss, as per the BBC.
Shadow AI is adding to the bill, too. IBM found that incidents involving shadow AI more than doubled this year.
Where AI adoption falls short
A May report from the World Economic Forum found 94% of industry leaders see AI as a defining force in cybersecurity, and 77% of companies already use it in security operations.
However, the adoption is lopsided. IBM says only 18% of enterprises use AI agents for vulnerability scans and management — most use AI for detection and response instead. Prevention lags worst: more than a third of organizations don’t use AI for front-line work like finding and patching vulnerabilities before attackers do, which is exactly where it could cut exposure fastest.
BCG found similar gaps: only 41% of enterprises have formal AI governance policies, only 23% monitor or log their agents, and just 20% have shadow AI monitoring, prompt-injection detection, or non-human identity governance in place.
Underneath the new tools sits an old, slow problem. Alfredo Hickman, CISO at Kai pointed out that attackers can find and exploit a weakness in minutes, yet 60% of organizations still take more than a week to fix a critical vulnerability. “Defenders are often still opening tickets, assigning owners, investigating issues, and deciding what to fix first based on operating models and SLAs that are now obsolete. That process can’t keep up anymore,” he said in an email communication to Spiceworks.
What actually cuts breach costs
Used well, AI helps security teams move faster — but handing work over to it takes trust, and that trust is thin. Hickman notes that more than half of CISOs say a lack of trust in automated decisions is one of the biggest barriers to automating more. “As more execution becomes automated, security professionals who evolve will reap the asymmetric advantage of AI and spend more time setting the rules, governing those systems, and making the judgment calls machines shouldn’t make for us,” he says.
The basics still matter most — and they don’t need advanced tools. In an email to Spiceworks, David Lee, field CTO at identity security firm Saviynt, warns that as environments get more automated, gaps get harder to see and easier to scale. His advice is that “establish visibility, enforce least privilege, continuously monitor access, and remove it when it’s no longer needed. The fundamentals haven’t changed, but the speed and scale at which organizations need to apply them have.”
For lean IT teams, the order of operations matters. Get the fundamentals right first — know what has access to what, revoke what you don’t need, and watch both — then add AI where it earns its place. You don’t need an AI platform to do the basics; you need the basics before an AI platform will help.
Then there’s the question nobody has solved: how much access do you give to agentic AI? For detection, it’s easy — limited privileges and surface-level data. For prevention, it’s a much bigger ask, because agents need broad access to hunt down unknown vulnerabilities across your systems. That’s the trust gap in a nutshell, and it drags compliance questions along with it.
Your Essential Daily Tech Brief
Sign up for the Spiceworks Newsletter and stay ahead with a curated mix of expert advice, technical tips, and the trending discussions your peers are having right now.
