VakavفارسیStart a pilot
← BlogPrivate AI and governance

IBM's 2025 breach report: ungoverned AI makes data breaches costlier

IBM's 2025 Cost of a Data Breach report finds most organizations have no rules or access controls for AI. What that means, and where to start.

Every year IBM and the Ponemon Institute measure what data breaches actually cost organizations. The 2025 report, published on 30 July 2025 and based on 600 organizations, gives AI a large share of its attention. Its main message is simple: organizations have adopted AI faster than they have set rules for it, and that gap is expensive.

What the report found

  • 13% of organizations reported an attack that affected their AI models or applications.
  • Of those, 97% lacked proper access controls for AI, meaning nobody had defined who could reach which model and which data.
  • 63% of organizations have no AI governance policy to manage AI or to stop shadow AI.
  • Where shadow AI use was high, a breach cost USD 670,000 more on average. The global average cost of a breach in the report is USD 4.44 million.
Two data paths: above, data passes a controlled gate into a secure store; below, it bypasses the gate and scatters.
Governed AI use versus shadow AI: on the second path, nobody knows where the data went.

Shadow AI means AI tools that employees use without the organization knowing or approving them: an employee who pastes a contract or a production report into a public chatbot to get a summary, for example. The data has left the organization, and nothing recorded it.

Why it matters more in industry

In a plant, data is not just email and contracts. Operating procedures, process drawings, failure reports and product specifications are technical know-how built up over years. When an engineer pastes part of a report into a public AI service to finish it faster, that know-how leaves the company's control, without anyone meaning harm.

Banning AI does not solve it. People do not give up a tool that makes their work easier; they just stop talking about it. What works is giving them a safe alternative that is just as useful.

Where to start

  1. Take an inventory. Find out which teams use which AI tools, and for what. No policy can be enforced without it.
  2. Classify your data. Decide which data must never leave the organization. In most plants that includes control-system data, drawings and technical documents.
  3. Provide an approved tool. An assistant that runs on your own servers, knows your internal documents and sends nothing outside removes the reason to use public tools.
  4. Grant access by role. Each user reaches only the documents and models their work needs.
  5. Review how it is working. A policy that nobody checks stays on paper.

Vakav's view

We built Vakav Autonomous for exactly this gap: a knowledge assistant that runs entirely on the organization's own servers, gives each department its own workspace with defined access, and answers from the organization's own documents with the sources cited. The goal is not less AI. It is AI that is visible and under control.

To see what this would look like in your organization, start a pilot with us.