The clock finally moved. Organizations needed a mean of 241 days to identify and contain a breach last year — 181 days to spot one, 60 to shut it down. That is the lowest figure IBM has recorded in nine years, and it dragged the price of being breached down with it.
IBM's Cost of a Data Breach Report 2025, published July 30 and built on 600 real breaches investigated between March 2024 and February 2025, put the global average cost at $4.44 million — down 9% from $4.88 million, the first decline in five years. Getting breached got cheaper last year. That has not happened in a while.
The researchers point at faster detection and containment, and behind that, at AI and automation spreading through security operations centers. The 241-day lifecycle sits well under the 287-day peak of 2021 — and detection is still the long half, three times the containment half, which is precisely the half automation attacks first. Detection speed is the exchange rate between days and dollars.
One caution on stale numbers. The "277 days" figure still quoted everywhere comes from IBM's 2022 report — 207 to identify, 70 to contain — and it has been out of date since 2023. The current number is 241. Anyone building a business case on 277 is overstating their improvement by 36 days.
Where the $1.9 million comes from
The report is blunt about the dividing line. It is not who bought AI. It is who runs it everywhere.
Organizations using AI and automation extensively across security operations — embedded in detection, investigation and response, not parked in a pilot — saved an average of $1.9 million per breach and cut 80 days off the breach lifecycle, compared with organizations using none. Assessors classify usage by how many AI capabilities an organization deploys; the extensive tier, AI running through detection, investigation and response at once, is where the $1.9 million lives.
Notice the shape of that definition. It is not a purchase; it is a posture. A pilot in one corner of the SOC does not reach the extensive tier.
What does extensive look like on the ground? AI-driven SIEM platforms pull telemetry from across multi-cloud estates and correlate events rules walk straight past: an impossible-travel login followed by API call volumes nobody has seen before; a service account suddenly touching repositories it has never accessed. Neither event trips a serious rule on its own. Together, they are a story.
Generative assistants sit on top of that layer — Microsoft's Security Copilot, Google's Chronicle AI, CrowdStrike's Charlotte AI — letting analysts ask questions in plain language, auto-summarize incidents, and generate response playbooks. The analyst's job shifts from gathering to judging. Repeat that shift across thousands of alerts, and you can see where 80 days go.
Put the 80 days against the 241-day mean and the scale sharpens. The extensive users are not trimming a few percent — they are removing roughly a third of the entire average lifecycle. Because the lifecycle is where costs accumulate, a third off the clock is the mechanism behind the $1.9 million.
The savings land where you would expect. Detection and escalation costs — assessment, audits, crisis management, board communications — fell nearly 10% to $1.47 million on average, tied directly to shorter investigations. Shorter investigations mean fewer days of outside assessors and fewer board updates that begin with "we still don't know."
Kevin Albano, global head of threat intelligence at IBM X-Force, told IT Brew: "When I saw that the overall cost of a data breach went down, I was like, 'Yes, it's working!'" He credited practitioners' proactive measures, incident response planning among them. Not the tools — the preparation around the tools.
The same wave, breaking the other way
Then the report turns. Among breached organizations that suffered an AI-related security incident, 97% said they lacked proper AI access controls.
Read that again. Ninety-seven percent.
And 63% of the 600 organizations surveyed had no AI governance policies at all — nothing governing AI use, nothing stopping employees from feeding sensitive data into unapproved tools. In the SOC, automation is being rolled out with playbooks and checkpoints. In the rest of the building, adoption is happening by improvisation, one browser tab at a time.
Shadow AI is no longer a policy footnote; it is a line item. High levels of unapproved AI tool usage added an extra $670,000 to the global average breach cost. Attackers are not waiting around: one in six incidents involved AI-driven attacks, generative-AI phishing and deepfakes included. The same deployment speed helping defenders is creating security debt, because adoption is outrunning oversight.
Put two of the report's numbers side by side and its real argument appears. AI inside the SOC is saving serious money. AI outside anyone's control is adding it back — $670,000 at a time. The extensive users automated deliberately, stage by stage. The 97% adopted by accident, tool by tool, with no access controls waiting at the door. Same wave. One group surfed it. The other got billed for it.
The one-in-six figure deserves its own pause. AI-driven attacks are not a separate threat arriving from outside the story. They are the same adoption curve, read from the other side. The tooling that lets a SOC summarize an incident in seconds also lets an attacker personalize a lure in seconds. Defense and offense are drinking from the same well.
Stolen logins still run the table
The costliest ways in tell the same story from the other side. Breaches that began with compromised credentials still averaged $4.67 million, with a 246-day lifecycle. Supply-chain compromises were the second most frequent vector at 15% and the second costliest at $4.91 million, taking 267 days to resolve. Malicious insiders were rarer but carried the highest average cost of all, $4.92 million.
Slow-burn, high-dwell scenarios, every one. The credential lifecycle — 246 days — runs longer than the 241-day average, even though stolen credentials are the most familiar vector in the study. Familiarity has not produced speed.
And notice what unites them: none begins with an event a rule can catch. A stolen login looks, event by event, like an employee doing their job. Only the pattern betrays it. Which is exactly where AI correlation across identity, endpoint and cloud telemetry earns its keep. Rules see events. Correlation sees the pattern. That is also why the same access-control discipline shows up in neighboring defenses, from authorization checks that stop API abuse to protection that lives inside the running application.
Geography tells it too. The global average fell. The American bill did not. US breach costs rose 9% to $10.2 million, pushed up by higher regulatory fines and detection costs. An organization planning against the global figure while its exposure is American is under-budgeting by more than half.
Industry is just as uneven. Healthcare remained the costliest at $7.42 million — a sharp improvement on its $9.77 million in 2024, but still the top of the table — followed by financial services at $5.56 million. Healthcare breaches also took the longest to contain: 279 days, more than five weeks above the global average. An endpoint in a warehouse can be isolated on suspicion. A system a ward depends on cannot.
Geography, industry, vector. The averages hide all three.
Telemetry first, or don't bother
So what should a security leader actually do with this? Three conclusions fall out of the data, in an order.
Automate the triage layer first. The 80-day reduction came from organizations that embedded AI across detection and response — not from buying a chatbot. The priority use cases are alert correlation and deduplication, automated enrichment with threat intel, asset criticality and identity context, and guided investigation that assembles timelines without manual pivoting.
Second: govern AI as you deploy it. The $670,000 shadow-AI penalty and that 97% access-control failure rate argue for pairing every AI rollout with approved-tool registries, data-loss controls on AI inputs, and audit trails of AI-assisted actions. The organizations saving $1.9 million are the ones that did both — the automation and the paperwork, in the same quarter, by the same team.
And third, measure lifecycle, not alert volume. Mean time to identify and contain — 241 days, its nine-year best — is the metric that ties SOC performance to business cost. Teams still reporting success in alerts triaged are measuring activity. The report measures outcomes.
Turned into a roadmap, sequencing matters more than tooling. Phase one is telemetry consolidation: AI correlation cannot work across fragmented data, so the first investment is getting endpoint, identity, cloud and network logs into a single SIEM data lake with consistent schemas. Skip that step and you get impressive demos and unchanged detection times. An organization that buys the AI before consolidating the telemetry has purchased the narrator before writing the book.
Phase two is use-case automation, ranked by analyst-hours saved — phishing triage and user-reported email analysis first, then enrichment and deduplication, then guided investigation playbooks for the top five incident types. Each use case ships with a measured baseline. Start where the hours are, not where the demo is prettiest.
Phase three is response automation with guardrails: isolating endpoints, disabling compromised accounts, blocking malicious indicators automatically — but only inside pre-approved playbooks where the blast radius is understood. The 80-day advantage belongs to organizations that automated confidently because they had built the governance first.
Notice what the laggards skipped. It was not the tooling. It was the paperwork around the tooling: the approved-tool registry that keeps shadow AI out, the audit trail that shows what an AI-assisted action actually did, the human checkpoint standing between an automated response and a disabled account. IBM's numbers describe both halves of the same wave — and the halves differ in preparation, not in budget or vendor choice.
The pressure, meanwhile, is not easing. State-level actors are collecting now and planning to decrypt later, which is one more reason detection speed compounds: every day cut from the lifecycle is a day less of exposure for data whose value may only grow. Detection gains drove the first cost decline in five years, and the organizations capturing them treated AI as operational infrastructure rather than experimentation. Threat actors are doing the same with the same tools.
Sources
- Infosecurity Magazine — Data Breach Costs Fall for First Time in Five Years (IBM Cost of a Data Breach Report 2025)
- IBM — 2025 Cost of a Data Breach Report: Navigating the AI Rush Without Sidelining Security
- NeuralWired — IBM Data Breach Report 2025: Detection Falls to 241 Days
- IT Brew — Finding Good News in IBM's 'Cost of a Data Breach' Report (Kevin Albano, IBM X-Force)
- SpyCloud — IBM 2025 Data Breach Report: 6 Key Insights Shaping Threats
