India’s Average Data Breach Cost Reaches All-Time High In 2025: IBM
Shadow AI — the use of AI tools without oversight — was among the top three cost drivers of a breach in India.
The average total organisational cost of data breach in India reached an all-time high of Rs 220 million in 2025 (13% higher than last year), as per IBM’s new Cost of a Data Breach Report.
The report found that globally, AI adoption is outpacing AI security and governance. While the overall number of organisations globally experiencing an AI-related breach is a small representation of the researched population, the report suggests AI is already an easy, high-value target.
Key India Findings
AI Governance Policies: Nearly 60% of breached organisations either don’t have an AI governance policy or are still developing a policy. Of the organisations that have AI governance policies, only 34% use AI governance technology.
Cost Of Shadow AI: Shadow AI — the use of AI tools without oversight — was among the top three cost drivers of a breach in India, added Rs 17.9 million to the cost of a breach on average. Despite this, only 42% of organisations have policies to manage AI or detect shadow AI.
Phishing Remains Top Attack Vector: In India, the top three initial cause/attack vector for the data breaches were phishing (18%), third party vendor and supply chain compromise (17%), and vulnerability exploitation (13%).
Research Breaches Become Costliest: The research sector in India faced the highest impact from data breaches, with average cost reaching Rs 289 million, followed by the transportation industry at Rs 288 million and the industrial sector at Rs 264 million.
Security AI Investments Still Lacking: Data showed that using AI and security automation less than halved the cost of a data breach. Despite the proven benefit, 73% of those surveyed reported limited or no use of AI and security automation.
Organisations Bypassing Security, Governance For AI
Organisations are bypassing security and governance for AI in favour of do-it-now AI adoption. Globally, ungoverned systems are more likely to be breached, and more costly when they are.
In the Indian context, only 37% of organisations reported having AI access controls in place. Nearly 60% of organisations either don’t have AI governance policies in place or are still developing them in India.
“The absence of access controls and AI governance tools are not just a technical oversight, it’s a strategic vulnerability. CISOs must act decisively — embedding trust, transparency, and governance into AI systems by design,” said Viswanath Ramaswamy, vice president, technology, IBM India and South Asia.
