26% of India breaches AI‑generated as costs hit ₹25.5 cr: IBM 2026 report

For security operations teams, the ₹25.5 crore average breach cost isn’t just a number—it’s a direct result of adversaries weaponizing AI. With 26% of malicious breaches now AI‑generated, the attack surface is evolving faster than most defenders can adapt. Yet IBM’s data offers a path forward: organizations that embed agentic AI across the full security lifecycle—from detection to remediation—cut their breach costs by nearly a third.

India’s data breach landscape has crossed a grim milestone. According to IBM’s 2026 Cost of a Data Breach Report, the average cost of a breach in the country has soared to an all-time high of ₹25.5 crore, representing a 15.9% jump from ₹22 crore in 2025. The scale of breaches also widened, with an average of 39,500 records compromised per incident, up from 38,200 the year prior. This twin escalation—cost and volume—underscores a rapidly intensifying threat environment, driven significantly by the adoption of artificial intelligence by adversaries.

“

The report lays bare the consequence of inaction: only 32% of Indian organizations have achieved extensive AI and security automation; another 36% report limited adoption, and 32% have none at all.

Nearly 26% of malicious breaches in India were AI‑generated, the report notes, illustrating that AI is no longer a fringe tool for cybercriminals. It enables faster reconnaissance, more convincing phishing campaigns, and the ability to launch scalable attacks that evade traditional, signature‑based defenses. The sophistication of these AI‑powered attacks is raising the baseline cost of every breach, from detection and containment to post‑incident response and reputational damage.

Yet the report’s most striking finding is the defensive power of AI and security automation. Organizations that have extensively deployed these technologies experienced an average breach cost of ₹21.3 crore—nearly ₹10 crore less than the ₹31.6 crore average for those with no AI or automation. This cost differential of 48% is a powerful economic signal to chief information security officers and boardrooms. It also explains why 73% of Indian firms now say they plan to increase security investments in the wake of a breach. The report lays bare the consequence of inaction: only 32% of Indian organizations have achieved extensive AI and security automation; another 36% report limited adoption, and 32% have none at all. This leaves a substantial portion of the enterprise landscape dangerously exposed.

Phishing, including voice‑based vishing and SMS‑based smishing, remains the top initial attack vector, accounting for 19% of breaches. This prevalence, combined with AI’s ability to craft hyper‑personalized lures, suggests that the attack surface will only expand. The human element continues to be the weakest link, and AI is making exploitation more efficient.

From a regulatory and compliance perspective, India’s Digital Personal Data Protection Act 2023 is yet to be fully operationalized, but its impending enforcement will add financial and legal penalties to the already high cost of breaches. Companies that have not invested in AI‑driven security and data governance will find themselves doubly vulnerable—to attackers and to regulators.