AI Is Your Biggest Security Risk

The Cost of a Data Breach Is Falling—But AI Is Creating a New Security Gap IBM’s Cost of a Data Breach Report 2025 delivers a surprising headline: for the first time in five years, the global average cost of a data breach has declined, dropping to $4.44M . The reason? Faster detection and containment, driven largely by security automation and AI. But buried inside the report is a far more concerning trend, one that should be a wake-up call for security teams adopting AI at speed. The AI Oversight Gap Is Real and Expensive According to IBM’s research, 97% of organizations that experienced an AI-related breach lacked proper AI access controls . As enterprises race to deploy LLMs, copilots, plugins, and autonomous agents, governance and identity controls are lagging badly. This gap shows up in multiple ways: Shadow AI (unsanctioned AI usage) now contributes an additional $670K per breach 16% of breaches involved attackers using AI , primarily for phishing and deepfake impersonation AI systems and APIs are becoming high-value targets , especially through supply-chain compromise and unauthorized access Attackers Are Logging In, Not Breaking In One of the report’s clearest signals is that modern breaches are increasingly driven by misused credentials , not zero-day exploits. Malicious insiders, compromised credentials, phishing, and third-party access dominate the most costly breach vectors. That reality is even more dangerous in an AI-driven environment, where: AI agents authenticate using long-lived secrets APIs and plugins act autonomously across systems Lateral movement happens at machine speed If you can’t precisely control who (or what) can access an internal resource (and under what conditions) you don’t really have Zero Trust. Why Access Control Is the Missing Layer for AI Security IBM’s recommendations repeatedly return to one foundational idea: identity is the new perimeter . That applies equally to humans and machines. As the report notes, organizations must apply the same rigor to non-human identities (NHIs) , including AI agents, as they do to employees: Strong authentication Least-privilege access Continuous authorization Visibility into credential use and lifecycle This is exactly where traditional IAM, VPNs, and static network controls fall short. How Pomerium Helps Close the AI Oversight Gap Pomerium was built for a world where: Users are remote Infrastructure is hybrid Access decisions must be identity-aware, context-aware, and continuous That model translates directly to AI. With Pomerium, organizations can: Enforce per-request, identity-based access for humans and AI agents Eliminate static credentials with short-lived, identity-derived access Apply Zero Trust policies to internal APIs, MCP servers, model endpoints, and admin surfaces Gain visibility and auditability across both human, machine and agentic access requests Instead of trusting networks, IPs, or embedded secrets, Pomerium treats every request (human, machine or AI) as untrusted. Security Outcomes That Actually Reduce Breach Costs IBM’s data shows that organizations using strong identity controls, automation, and AI-assisted security see: $1.9M lower breach costs 80 fewer days to identify and contain incidents Reduced blast radius when breaches do occur Those aren’t theoretical benefits. They’re measurable outcomes tied directly to better access control and faster containment. The Takeaway AI isn’t just another application. It is a force multiplier for both defenders and attackers. In this new agentic era, the organizations that will win will be the ones that govern agentic access with fine-grained, real-time authorization . If AI agents can reach your internal systems, they need the same Zero Trust guardrails as your employees. Pomerium exists to make that possible—without VPNs, without shared secrets, and without blind spots.