The $4.4M question: what IBM's 2025 breach report says about AI agents and access
Mert Uzun ·
The global average cost of a data breach was $4.44 million in 2025. In the United States it was $10.22 million (IBM, Cost of a Data Breach Report 2025). Those are the headline numbers. The ones a General Counsel or a CISO should read twice are further in, in the findings on AI.
Read together with Okta's 2026 survey of CISOs, they describe one problem. Companies are giving AI access to their data faster than they are deciding who that AI answers to.
What the reports found
Here are the figures that matter for anyone rolling out AI agents, each with its source.
| Finding | Figure | Source |
|---|---|---|
| Global average cost of a data breach | $4.44M | IBM, 2025 |
| US average cost of a data breach | $10.22M | IBM, 2025 |
| Organizations that reported a breach of AI models or applications | 13% | IBM, 2025 |
| Of those, organizations lacking proper AI access controls | 97% | IBM, 2025 |
| Organizations that reported a breach involving shadow AI | 1 in 5 | IBM, 2025 |
| Added breach cost at high levels of shadow AI | up to $670,000 | IBM, 2025 |
| CISOs confident they can centrally control what AI agents access | 46% | Okta, 2026 |
| Organizations governing agent access with shared credentials or broad service accounts | 21% | Okta, 2026 |
Read the numbers together
Shadow AI is what happens when people use AI tools the company never approved. They are not being careless. They have work to do, the approved tool cannot see what they need, so they paste it somewhere that can. One in five organizations in IBM's 2025 study reported a breach involving exactly that.
The 97% is the other side of the same coin. Where AI was approved and still got breached, it almost always had no proper control over who could see what through it. The AI could see more than the person asking it.
Okta's numbers say this is not getting solved by itself. Fewer than half of CISOs, 46%, are confident they can centrally control what AI agents can access, and 21% of organizations govern agent access with shared credentials or broad service accounts (Okta, Global CISO Insights 2026).
The service-account problem
Most agent setups connect each tool once, with one powerful login. That login sees every channel, every folder, every deal. Then the agent answers anyone who asks it.
So the intern and the CFO get answers drawn from the same pile. The tools had permissions all along: the intern could never open the board folder in the drive. The agent simply walked around them, because it signed in as someone who could.
This is the failure the IBM numbers price. It does not take an attacker. It takes one ordinary question from a person who should not have received that answer.
What access built into the structure means
The fix is not a second permission system that someone in IT has to maintain by hand. It is a memory that already knows, for every record, who at the company may see it, and answers each person accordingly. In plain words, at Mithrandir that means four things.
- Each person sees only what they can already access at work. If you cannot open a Slack channel, no agent you use can answer from it.
- Permissions come from each tool itself, across 26 sources. Where a tool has none of its own, the company hierarchy decides.
- Ethical walls sit on top. A lawyer screened from a matter, or a banker on the wrong side of an information barrier, stays walled off even where a tool would let them in.
- Restricted content never reaches a model. What the person cannot see is removed before the question is answered, not hidden after.
- The same rules, whatever your company already has, hold for every department. Legal, finance, HR, engineering, support and sales each get their own answers from the same memory. This is not a sales memory, or an engineering one. It is the company's.
Three questions to ask any AI vendor
If you are a General Counsel or a CISO and an AI vendor is in front of you this quarter, these three questions sort the field quickly. The weak answers are common. They are worth hearing in full.
| Ask | A weak answer | What to hear |
|---|---|---|
| When an agent answers one of our people, whose permissions does it use? | "An admin connects the workspace." Or "we respect permissions" with no word on whose. | The asking person's, taken from each source tool, for every answer. |
| Can restricted content ever reach the model? | "We filter the output." | No. It is removed before the model sees the question, and every answer shows its sources. |
| Where does our data live, and who holds the keys? | "In our cloud, encrypted." | In your cloud, under your keys, with your own model account. |
Why each question matters
The first question finds the service account. If the vendor cannot say the asking person's permissions are applied to every answer, assume they are not. That is the 21% in Okta's survey, and it is where most leaks start.
The second question finds the filter. A filter on the way out means the restricted material was already in front of the model. It may not be shown, but it was read, and it can shape the answer in ways nobody sees. Removal before the question is answered is the only version a lawyer can sign off on.
The third question finds the copy. If your company's memory sits in a vendor's cloud, you now have one more place to secure, one more contract to negotiate and one more breach to price. If it sits in yours, under your keys, it inherits the controls you already run.
The cheaper path is also the safer one
Companies do not reach for shadow AI out of malice. They reach for it because the approved tool cannot answer. The way to shrink the 1 in 5 is not a stricter policy. It is an approved agent that can answer each person with everything they are allowed to see, in the tool they already use: Claude, ChatGPT, Copilot, Cursor and 16 more.
That is what we built Mithrandir to do. One memory of the whole company, in the company's own cloud, that every agent asks, and that answers each person with exactly what their job already lets them see.