Shadow data and AI breaches are driving up costs

Summary

IBM's 2024 Cost of a Data Breach Report covers 604 organizations across 17 sectors. Findings indicate that unmanaged 'shadow data' plays a role in 35% of breaches. This situation raises the average cost to $5.27 million and extends detection and containment times by approximately one-quarter. On the other hand, only 24% of new-generation AI initiatives include a security component.

Why it matters

As organizations race to deploy generative AI in multi-cloud environments, unclassified and unencrypted data along with unauthorized 'shadow models' create a blind spot that attackers actively exploit. A 26.5% increase in intellectual property theft and a loss of $173 per record demonstrate that the financial and competitive damage of a single breach now extends far beyond the initial incident. This shifts data governance from an afterthought in IT to a board-level priority.

Highlights

• Shadow data was present in 35% of breaches in 2024; resolving these breaches took an average of 291 days and cost $5.27 million.
• According to an executive survey cited in the report, only 24% of new-generation AI initiatives are deployed with a security component.
• Intellectual property theft increased by 26.5% year-over-year; IP loss per record rose by 11% to $173. Lost business and reputation added an average of $1.47 million to breach costs.

Critical take

The article was published on IBM's own Think platform, and all findings steer toward a clearly IBM-branded prescription (DSPM, confidential computing, post-quantum encryption) while giving the impression of vendor neutrality. The text reads more like a product roadmap than an independent analysis. The 'shadow AI' framework also struggles to distinguish genuinely new risks (unauthorized model deployments) from known hygiene deficiencies (unencrypted data in transit). This blurring of distinctions weakens the urgency of the more specific threats highlighted in the text.