The column itself was not reviewed for this summary, so the account rests on the IBM data it cites. The column is dated October 14, 2026, later than the most recent coverage found, which dates from about August 2026. No development tied to that date is documented. Two other figures in circulation come from outside IBM. A vendor analysis of the report says 92% of organizations that suffered an AI-related breach lacked proper AI access controls. A separate PagerDuty survey, not IBM research, found that 66% of office workers used AI they believed was banned.
For attorneys, the report points to governance gaps, not AI use alone, as the main driver of cost. Counsel advising on AI policy should confirm whether their clients know which unapproved tools employees are using, whether access controls cover AI systems, and whether breach-response plans address AI-related incidents. Fine exposure in roughly one in five shadow AI breaches makes these questions relevant to regulatory risk, not just IT operations. Policies that ban tools without offering approved alternatives may push usage further out of view, so the design of those policies deserves attention too.