AI attacks push Middle East breach costs higher

The average cost of a data breach in the Middle East has climbed to $8 million as cybercriminals increasingly use artificial intelligence to launch faster and more scalable attacks.

More than a quarter of malicious breaches examined across the region involved AI-enabled methods. Another 11 per cent of affected organisations could not determine whether attackers had used the technology, highlighting the growing difficulty of identifying increasingly automated threats.

The findings show a widening gap between companies using AI to defend their networks and those relying on conventional security systems. Organisations that extensively deployed security AI and automation recorded average breach costs more than $3 million lower than businesses without those capabilities.

Despite the potential savings, 23 per cent of organisations examined had not introduced AI or automation into their security operations. The imbalance allows attackers to exploit generative AI, automated reconnaissance and rapidly produced phishing material while many corporate defence teams remain constrained by manual processes and fragmented tools.

“As the number of cybercriminals harnessing the power of AI for malicious purposes rises, attacks are becoming faster and cheaper to launch, while breaches keep getting more expensive to find and fix,” said Saad Toma, general manager of IBM Middle East and Africa.

He said the shift was changing the economics of cyber risk and increasing the need for advanced detection and response systems supported by AI and automation.

Lost business accounted for the largest share of regional breach costs, averaging $3.57 million. The category includes operational disruption, lost customers, revenue declines and the cost of restoring confidence after an incident.

Post-breach response expenses averaged $2.17 million, while detection and escalation costs reached $1.9 million. Notification expenses, covering communications with regulators, customers and other affected parties, averaged $360,000.

Financial services and technology companies suffered the highest average losses, at $10.67 million for each sector. Industrial businesses followed with an average breach cost of $9.6 million, reflecting the financial impact of halted operations, damaged production systems and the complexity of securing connected infrastructure.

Phishing remained the leading initial route into corporate networks, accounting for 18 per cent of the breaches analysed. Incidents beginning with phishing produced an average financial impact of $10.41 million, the highest among the main attack vectors.

AI is making phishing campaigns more difficult to detect by allowing attackers to produce convincing messages in multiple languages, imitate internal communication styles and tailor approaches to individual employees. Automated tools can also help criminals analyse publicly available information before targeting executives, finance departments and IT support teams.

Supply-chain compromises represented 16 per cent of breaches and generated average costs of $8.45 million. Social-engineering attacks accounted for another 16 per cent, with average losses of $7.32 million.

Such attacks increasingly include criminals impersonating IT helpdesk staff or repeatedly sending multifactor authentication requests until an employee approves access. Compromised suppliers can give attackers indirect entry into several organisations through a single trusted connection.

Mismanaged passwords, cryptographic keys and other digital secrets were among the biggest factors increasing losses. Excessive user privileges, weak role management and failures to prioritise the most serious threats also pushed costs higher.

Encryption, DevSecOps practices and endpoint detection and response systems were associated with lower losses. Yet only 35 per cent of breached organisations had encrypted sensitive information both while stored and during transmission when the incident occurred.

Sixty-nine per cent had formal controls for monitoring cryptographic assets. The difference suggests that many organisations have established governance procedures without consistently applying protection to the underlying data.

Security spending is expected to rise after the breaches. Fifty-nine per cent of organisations planned to increase investment in tools and governance, while identity and access management emerged as the leading priority, selected by 44 per cent.

Incident-response planning and testing were prioritised by 39 per cent. The same proportion identified quantum security for stored and transmitted information as an investment focus, reflecting concern that future computing advances could weaken widely used encryption methods.

AI agents are also moving into corporate security operations centres. Among organisations operating dedicated centres, 55 per cent had deployed agents to assist with monitoring, investigation or response.