Singapore – Organisations across ASEAN recorded an average data breach cost of US$4.12 million in 2026, the highest level reported in the region, according to IBM’s latest report.
The report, sponsored and analysed by IBM and conducted by the Ponemon Institute, found that nearly three in 10 ASEAN organisations that experienced malicious breaches said the attacks were AI-generated. The findings point to increasing operational and financial pressure on organisations as attackers adopt AI-enabled tactics and target increasingly complex digital environments.
Organisations with extensive use of AI and security automation reported an average breach cost of US$3.66 million, compared with US$4.86 million among organisations that did not use these tools. They also identified and contained breaches 123 days faster.
“As AI continues to lower the cost and increase the speed of cyberattacks, organisations across ASEAN are facing longer breach investigations and growing financial consequences,” said Catherine Lian, General Manager, IBM ASEAN. “The report findings underscore the value of AI and automation in cybersecurity. Organizations that have integrated these technologies into their security operations are containing breaches faster and reducing associated costs, at a time when critical infrastructure sectors face unprecedented levels of risk and pressure.”
Financial services organisations recorded the highest average breach costs in ASEAN at US$6.53 million, followed by industrial organisations at US$5.99 million and communications organisations at US$4.28 million.
The figures reflect heightened cyber risk across sectors that play a significant role in critical infrastructure, with organisations facing growing exposure to attacks involving AI and other emerging technologies.
The report also found that 71% of ASEAN organisations planned to increase investments in security tools and governance following a breach.
Separately, research by the Ponemon Institute found globally that 85% of organisations aware of advanced frontier AI cyber capabilities planned to increase security spending. IBM said the findings indicate that organisations are beginning to address emerging cyber risks before experiencing an incident.
Identity-based attacks were among the costliest initial attack vectors in ASEAN. Breaches involving the abuse of valid accounts averaged more than US$4.5 million.
Encryption also remained an area of concern. Only 29% of organisations said sensitive data was encrypted both at rest and in transit when the breach occurred.
Organisations that invested in offensive security testing, security orchestration and automation, and key lifecycle management reported some of the largest reductions in breach-related costs, according to the report.
The ASEAN findings were based on data from 26 organisations studied between March 2025 and February 2026. A follow-on study conducted in May 2026 received responses from 456 of the 602 organisations included in the broader Cost of a Data Breach research. Of those respondents, 78%, or 356 organisations, said they were aware of recent reports about highly advanced frontier models such as Mythos.
