Published breach research puts the average cost in the millions and adds a substantial premium where shadow AI was involved. The figures move every reporting cycle, so the defensible business case is built on your own exposure rather than on somebody else's average.
The published figures
Averages are a starting point, not an argument.
IBM's Cost of a Data Breach research is the most cited source here, and its 2025 edition put the additional cost where shadow AI was involved at roughly $670,000 above an average breach. Industry reporting through 2026 has shadow AI rising sharply as a share of insider-related DLP events.
Check them before you present them. These studies are re-cut annually, the methodology changes, and a figure quoted from last year's edition is the easiest thing in the room to challenge.
An average is also the wrong unit for a specific decision. A thousand-person firm holding health records and a fifty-person firm holding none do not share a risk profile.
What drives the number
Notification is the cost that scales with record count.
Breach cost is mostly determined by how many people have to be told, under which regime, and how quickly. Regulatory exposure, forensic work, legal advice and remediation follow from that.
A single prompt carrying one record is a very different event from a prompt carrying a spreadsheet of four hundred. That distinction is why detection that understands context and count matters more to the eventual bill than detection that simply fires.
Building the case
Measure your own exposure first.
The strongest version of this business case is not a cited average. It is a month of log-only measurement on your own fleet: how many sends carried regulated data, of which classes, to which tools.
That number is specific, it is yours, and it is very hard to argue with. It also costs almost nothing to produce, which is why measuring before deciding is the recommendation whatever you eventually buy.
The unbounded part
What you cannot measure is what makes the number large.
The expensive property of a prompt disclosure is not the record count. It is that there is usually no record count at all.
A breach of a database has a scope: the table, the rows, the window. An assessment can be bounded, notification can be scoped to the people actually affected, and the cost follows from that scope. A disclosure made by typing has none of that. Without a record of what was in the message, the honest answer to "how many people were affected" is that you do not know, and the conservative assumption is what you end up notifying against.
This is the practical argument for keeping a redacted record rather than no record. A line saying that eleven cardholder numbers went to an unsanctioned host at 14:06 is not the data, so it is not a second copy to protect, and it turns an unbounded assessment into a bounded one. It will not tell you which eleven, which is a real limit and occasionally the thing your counsel wants.
Sector
The same disclosure costs very different amounts by sector.
A generic breach figure hides the one variable that moves the number most, which is what the disclosure obliges you to do next.
In healthcare, a disclosure of protected health information triggers a defined assessment and, above a threshold, notification to individuals, to the regulator and in some cases to media. Under GDPR the clock is 72 hours to a supervisory authority, with notification to individuals where the risk is high. Card data brings scheme obligations and a forensic investigation whose scope you do not control. A disclosure of commercial information with no regulated class in it may oblige nothing at all, and may still cost you a negotiation.
Which is why the useful first question is not what a breach costs on average. It is which regulated classes your staff actually handle, because that decides which of these regimes you would be in. That is answerable in a fortnight of measurement and not answerable by reading a report.
What you cannot price
The slow cost is the one nobody puts in the model.
Incident costs are at least countable. The expensive part of a disclosure in a business where confidence is the product tends not to arrive as an invoice at all.
A regulator that has taken an interest does not stop at the incident: an undertaking brings a programme of work, reporting, and a period during which ordinary decisions need review. Enterprise customers who read about it ask harder questions at renewal, and the deals do not fail so much as slow down. Internally, the cost is a year of security proposals being judged against one event rather than on their merits, which is how organisations end up over-controlled in the place they were burned and unchanged everywhere else.
None of that belongs in a spreadsheet, and pretending otherwise produces a business case somebody can argue with. It belongs in the sentence that follows the spreadsheet.
Questions
What is the average cost of a data breach?
Published research has put the global average in the millions of dollars, varying widely by sector and region, with healthcare consistently highest. Treat any single figure as a headline rather than a forecast, and check the current edition before quoting it.
Is there a specific number for AI-related leaks?
The most quoted is IBM's finding of roughly $670,000 in additional cost where shadow AI was a factor. It is a useful order of magnitude for a business case and not a prediction for any particular organisation.
How do we estimate our own exposure?
Run a control in log-only mode for a month and count. Sends carrying regulated data, by class, by destination. That gives you a rate, and a rate multiplied by a plausible per-record consequence is a defensible model.
What costs do the studies miss?
Two, consistently. The engineering and security time consumed by an investigation, which is real salary cost diverted from other work, and the commercial drag when a prospect's security review finds the incident. Neither appears in the breach averages.
Does cyber insurance cover this?
Often partially, and increasingly with conditions. Insurers have been asking more detailed questions about AI tool governance, and the answers you can evidence tend to matter at renewal. Your broker is the right person to ask what your policy actually says.
Is the cost argument the best way to get budget?
It opens the conversation, and specificity closes it. The organisations that get funded usually walk in with their own measured number rather than an industry average, because the first invites a decision and the second invites a debate.
Why are published breach cost averages so hard to apply?
They average incidents that have almost nothing in common, from a stolen laptop to a ransomware event affecting millions of records. The average is real and tells you very little about your own exposure. A measured count of what your staff actually sent, to where, is a better input to a budget.
What cost do organisations most often leave out?
Internal time. The people who stop their normal work to run an investigation do not appear on any invoice, and in the first month they are frequently the largest real cost. Second is the remediation programme that follows an undertaking with a regulator, which can run for years.
Does having a record of the incident make it cheaper?
It makes it boundable, which is usually the same thing. Notification scales with the number of people you believe were affected, and without a record the conservative assumption is what you notify against. A redacted record narrows that without creating a second copy of the data.
Keep reading
- Discovery Finding shadow AI Four ways to find out which AI tools your staff actually use, what each one misses, and why the survey is the least reliable of them. 7 min read
- HIPAA No AI tool is HIPAA compliant on its own Compliance depends on a BAA and on how you use the tool. What counts as PHI in a prompt, and what a disclosure is. 6 min read
- Evaluation How to evaluate an AI DLP tool The questions that separate these products, starting with the one most datasheets avoid: where does classification actually execute. 6 min read
- Product Deployment Signed installers through Intune, Jamf, Kandji or Ansible, browser extension by policy. Product page