IBM: 92% of AI Incidents Traced to Missing Access Controls

IBM analyzed 602 companies following AI-related incidents in 2026 and found that 92% of affected organizations had failed to configure basic access controls for their AI systems. The primary attack vectors were compromised APIs and cloud services — not flaws in the models themselves. Average losses from an AI breach reached $5.33M, compared to $4.70M for conventional attacks.

The problem isn't the novelty of the threat — it's that AI systems aren't being held to the same security standards that have long applied to any other enterprise software. When attackers themselves use AI, losses climb to $6.04M, and that gap is only going to widen.