India’s data breaches now cost Rs 25.5 crore on average — up 16% as AI fuels both attacks and defense
The average cost of a data breach in India has hit an all-time high of INR 255 million (INR 25.5 crore), according to IBM’s 2026 Cost of a Data Breach Report — a 15.9% jump from INR 220 million (INR 22 crore) last year. Breaches are also growing in scale, with the average incident now exposing 39,500 records, up from 38,200 in 2025.
The report’s starkest finding: AI has become a double-edged sword for Indian cybersecurity. A full 26% of malicious breaches in India were AI-generated — attacks that are faster, more sophisticated, and more scalable than ever. Yet the same technology is proving to be one of the strongest defenses available, with organizations that deployed AI and security automation extensively cutting both costs and response times dramatically.
“India’s accelerating AI adoption is creating immense opportunities for innovation, but it is also enabling cyber threats to evolve rapidly. The findings underscore that organizations using AI and strong governance were significantly better positioned to fend off cyberattacks,” said Gaurav Agarwal, Vice President, Technology, IBM India & South Asia. “Today, most organisations apply AI in limited ways, often focused on detection. To keep pace, AI with agentic capabilities must be embedded across the full security lifecycle — from detection and analysis to prioritization and remediation. That should be the strategic imperative for businesses to build resilience and a competitive advantage.”
The AI Gap Is Costing Organisations Crores
Despite the clear payoff, most Indian organizations have yet to embrace AI-driven security:
Only 32% report extensive use of AI and security automation
36% report limited use
32% report none at all
That gap shows up directly on the balance sheet. Organisations with no AI or automation paid INR 316 million (INR 31.6 crore) per breach on average — nearly 50% more than the INR 213 million (INR 21.3 crore) paid by organisations with extensive deployment, and well above the INR 231 million (INR 23.1 crore) for those with limited use.
Speed tells the same story. Breaches at organisations with no automation took 236 days to identify and 75 days to contain — compared to 175 days to identify at heavily automated organisations, though those organizations took slightly longer to contain (81 days).
Shadow AI is an emerging cost driver. Where present, unsanctioned AI tools added an average of INR 17.9 million (INR 1.79 crore) to breach costs — now ranking among India’s top three cost amplifiers, alongside regulatory non-compliance and cloud migration.
Where the Money Goes: Sector and Attack Vector Breakdown
Financial services pays the highest price. At INR 409 million (INR 40.9 crore) per breach, financial services organizations face the costliest breaches in India, ahead of technology (INR 357 million / INR 35.7 crore) and communications (INR 345 million / INR 34.5 crore).
Phishing is still the front door for attackers. It accounted for 19% of initial attack vectors in India, including a rising share of voice and SMS phishing, ahead of drive-by compromise (16%) and supply chain compromise (15%).
Offensive security is the single biggest money-saver. Red teaming and penetration testing delivered the largest cost reduction in India — an average savings of INR 24.7 million (INR 2.47 crore) per breach — ahead of proactive threat hunting and AI governance technology.
Organisations Are Responding
Nearly 73% of Indian organisations plan to increase security investment following a breach. Their top five priorities:
Incident response plans and testing — 67%
Threat detection and response technologies (SIEM, SOAR, EDR) — 51%
Identity and access management — 49%
AI security and governance tools — 39%
Employee awareness and training — 36%