Shadow AI emerging as new insider threat, IBM report warns

•Insurers urge stronger governance as unregulated AI drives up breach costs

Shadow AI, the use of artificial intelligence tools without formal oversight or security controls, is fuelling cyber risks and inflating the cost of data breaches, according to IBM’s latest Cost of a Data Breach Report.

The global study, released Friday, found that 63 percent of breached organisations have no AI governance policy, while only 34 percent conduct audits to detect unauthorised AI use.

The report analysed 600 breaches across 17 industries in 16 countries between March 2024 and February 2025, supported by interviews with more than 3,000 senior executives.

IBM’s findings show that shadow AI contributed to 20 percent of breaches, adding an average £523,000 to costs for organisations with high levels of ungoverned AI.

Personal identification data was the most frequently compromised (65 percent), but intellectual property, though targeted in only 40 percent of cases, was the most expensive to lose, costing an average £139 per record.

Ethan Godlieb, associate partner at specialist reinsurance broker Consilium, said the findings should serve as a wake-up call for brokers and corporate clients.

“Most organisations have adopted AI tools to some degree in the workplace, but few are governing it. The question now isn’t whether clients use AI, but how they use it. Relying solely on broad cyber wordings may not be enough given rising scrutiny on AI governance. Brokers need to push clients to audit AI usage, implement governance policies, and ensure affirmative AI coverage is embedded in their cyber policies,” Godlieb said.

The report also noted a drop in global average breach costs for the first time in five years, falling to £3.47 million, a decline largely attributed to the use of AI in defence, detection, and containment.

However, the same technology is increasingly weaponised, with AI used in one in six cyber attacks, including phishing and deepfake campaigns, signalling an escalating “AI arms race” in cyber warfare.

Industry experts warn that without formal oversight, shadow AI could evolve into a persistent insider threat, eroding trust and exposing companies to higher legal, reputational, and financial risks.

READ ALSO: How organisations reinvent themselves