E66 - Shadow AI Is Already Costing You $670,000

By FIR Risk Advisory | Cybersecurity Fraud Intelligence

Weekly Risk Intelligence Brief  

Source: IBM — 2025 Cost of a Data Breach Report

The 30-Second Brief  

IBM’s annual Cost of a Data Breach report tells two stories. The first: breaches are getting more expensive — U.S. organizations now face $10.22 million average breach costs, a 9% increase. The second: AI is on both sides of the fight. 1 in 6 breaches now involve AI-powered attacks. But organizations using extensive security AI reduced their breach lifecycle by 80 days and saved $1.9 million on average.

The question isn’t whether AI is involved in your security. It’s whether it’s working for you or against you.

The Cost Reality  

U.S. Breaches: $10.22 Million Average  

The U.S. continues to lead globally in breach costs — more than double the $4.44 million global average. Healthcare remains the most expensive sector at $7.42 million per breach with the longest recovery time at 279 days.

The average breach lifecycle: 241 days — 181 to identify, 60 to contain. That’s 8 months of exposure before you even start recovering.

INTEL [TREND]: U.S. breach costs hit $10.22M average — a 9% year-over-year increase. The 241-day average lifecycle means most organizations are compromised for over 6 months before containment. Every day you reduce that lifecycle saves real dollars.

Phishing Still Wins — Now With AI  

Phishing remains the top breach vector at 16% of all incidents. But the game has changed: 1 in 6 breaches now involve AI-powered attacks. AI-generated phishing is more convincing, more personalized, and harder to detect. The volume problem just became a quality problem.

INTEL [ATTACK TECHNIQUE]: AI-powered phishing has moved from theoretical to operational — 1 in 6 breaches now involve AI-driven attacks. Traditional awareness training built around spotting grammatical errors and generic templates is increasingly ineffective. Detection must evolve to behavioral analysis and sender verification.

The Shadow AI Tax: $670,000  

This is the number that should alarm every CISO and CFO. Shadow AI systems — AI tools deployed without governance oversight — add $670,000 to breach costs when involved in an incident. That’s the price tag for AI adoption without guardrails.

Employees are using AI tools. The question is whether you know which ones, what data they’re processing, and what controls are in place.

INTEL [VULNERABILITY]: Shadow AI adds $670,000 to average breach costs. Organizations that don’t inventory and govern AI tool usage across their workforce are carrying hidden risk. Establish an AI governance framework — not to block adoption, but to ensure it happens safely.

AI as a Defender: The $1.9 Million Advantage  

Organizations using extensive security AI and automation saw dramatic improvements:

• 80-day reduction in breach lifecycle
• $1.9 million savings in average breach costs
• Faster identification and faster containment

The organizations that invest in AI-driven security operations aren’t just keeping up — they’re fundamentally changing the economics of breach response.

INTEL [GLOBAL RECOMMENDATION]: Security AI and automation deliver measurable ROI — $1.9M in savings and 80 fewer days of exposure per breach. This isn’t speculative. It’s IBM’s data across thousands of breaches. If you’re not deploying AI in your security operations, your competitors (and attackers) are.

What Leaders Should Do Now  

1. Invest in security AI and automation — The 80-day lifecycle reduction and $1.9M savings make this the highest-ROI security investment available

2. Establish AI governance frameworks — Shadow AI is a $670K liability. Inventory AI tools, define acceptable use policies, and implement data handling controls

3. Enhance supply chain security — Third-party breaches continue to compound costs. Contractual controls, attestation requirements, and continuous monitoring are baseline

4. Strengthen identity and access management — Credential-based attacks remain dominant. Phishing-resistant MFA and continuous authentication are non-negotiable

5. Conduct regular breach response drills — The 241-day average lifecycle tells you most organizations are too slow. Tabletop exercises and incident response drills compress that timeline

6. Prioritize post-breach recovery planning — The 60-day containment window is where costs compound. Pre-planned recovery playbooks reduce both time and financial impact

The Bottom Line  

AI is on both sides of every breach now. 1 in 6 attacks are AI-powered. Shadow AI adds $670K to breach costs. But organizations deploying AI defensively save $1.9 million and cut 80 days from their breach lifecycle.

The oversight gap isn’t about whether your organization uses AI. It’s about whether you’re governing it — on offense and defense.

Find all editions on FIR Risk Tuesday | GitHub