Digital trust in the age of AI: the 2026 cybersecurity briefing

Executive summary

Breach costs fell globally but reached a record in the US. IBM puts the global average cost of a breach at $4.44 million, the first decline in five years, and the US average at $10.22 million.[1]
Exploited software has overtaken stolen passwords as the main way in. Vulnerability exploitation was the initial access vector in 31% of breaches in Verizon’s 2026 DBIR[2] and 32% of Mandiant’s 2025 intrusions.[4] Only 26% of critical known-exploited vulnerabilities were fully remediated in 2025.[3]
Attackers now move in minutes. CrowdStrike measured average eCrime breakout time at 29 minutes in 2025, with the fastest at 27 seconds.[5] Mandiant found the handoff from access broker to follow-on group fell to 22 seconds.[4]
AI systems are a new and poorly governed attack surface. 13% of organisations in IBM’s study reported breaches of AI models or applications, and 97% of those lacked AI access controls. High use of shadow AI added an average of $670,000 to breach costs.[1]
Fraud has joined ransomware at the top of the agenda. Chief executives in the WEF survey rank cyber-enabled fraud as their top concern, and 73% of respondents said they or someone in their network was affected in 2025.[7] Ransomware still appeared in 48% of breaches.[2]
Regulatory deadlines keep arriving through 2028. Cyber Resilience Act reporting duties have applied since 11 September 2026,[19] high-risk AI Act obligations moved to December 2027 and August 2028,[20] and four member states face court action over NIS2.[15]

Key findings

01Vulnerability exploitation was the initial access vector in 31% of breaches, overtaking stolen credentials

02Average eCrime breakout time fell to 29 minutes in 2025, with the fastest at 27 seconds

0313% of organisations reported breaches of AI models or applications, and 97% of those lacked AI access controls

Average cost of a data breach

United States

$10.22m

Global

$4.44m

Source: IBM, Cost of a Data Breach Report 2025

What leaders should do

Map dependencies on critical third parties and test recovery from their failure.
Treat identity as the primary control point.
Rehearse incident reporting against regulatory deadlines.

In the full report

How AI is changing the attack
Breach costs and the economics of ransomware
Identity is the main attack surface
Securing AI systems
AI in security operations and the skills gap
Regulation: what applies and when
Post-quantum cryptography
What to do in 2027
Sources

Methodology

We built this briefing from public, dated sources opened during research in October 2026: annual threat and cost studies from IBM, Verizon, Mandiant, CrowdStrike, Microsoft, ENISA, the World Economic Forum and ISC2, guidance from the UK NCSC and NIST, and official regulatory pages. Where we relied on a law firm or trade press summary rather than the primary document, the source list says so. Each study uses its own sample, period and definitions, so figures from different sources should not be added together. Where the sources disagree, we say so in the text.