The hard truth - AI expands opportunity and attack surface

One in four malicious breaches in the past year were AI-enabled - a 56% jump year over year - and those breaches cost an average of $6 million, roughly a million more than the global average. More than 20% of organisations reported a breach that targeted their AI models or applications (IBM 2026 Cost of a Data Breach Report).

62% of enterprises say their developers don't have the training to implement security for AI apps (Harness).

Breaches involving shadow AI cost materially more on average (~$670k extra) and increase exposure scope because data flows are untracked (Kiteworks).

83% of security teams report being "flying blind" on automated AI controls and increased API and identity attack vectors (Kiteworks).

Gartner projects information-security spending growth and flags AI-driven risk as a major driver of that investment. Security budgets will continue to expand where business leaders demand safe AI at scale (Gartner).

And the regulatory cost of that exposure now varies sharply by region. The EU AI Act carries fines up to EUR 35M or 7% of global turnover; India's DPDP Act and the RBI's AI directions add breach-notification duties and supervised expectations; and the UAE and Saudi Arabia have moved AI and data obligations (PDPL, DIFC Regulation 10, SDAIA) into active enforcement. Wherever you operate, the exposure is compounding.

What that means for security teams and AI app owners

If you don't know the state of your AI risk, you can't safely expand AI use. Lack of visibility will either lead to risky implementations - with costs like those above - or force risk-averse decisions: slower launches, limited automation and missed revenue or opportunity windows.

AI systems are like high-performance race cars. You can either drive blind and pray or instrument them with sensors and boundaries so you can drive harder, faster, recover from skids - and most importantly - win.