AI is rapidly becoming a critical part of business operations. At the same time, recent data breach analyses show that security and governance are struggling to keep pace with this development.

In a three-part series based on the IBM/Ponemon Cost of a Data Breach Report 2025 , Jurgen Otten discusses:

– the risks of rapid AI adoption and shadow AI;
– the dual nature of AI as both a threat and a defense mechanism; and
– why investing in IAM, SOC, and GRC demonstrably pays off.

The insights from the 2025 edition describe trends that are already continuing to develop and which will most likely be quantitatively confirmed in the 2026 edition.

The 2026 edition of the IBM/Ponemon Cost of a Data Breach Report is expected sometime this summer.

Why investing in IAM, SOC, and GRC demonstrably pays off.

The main conclusion from the first two articles is clear: AI is no longer a temporary technological experiment, but is evolving into a structural component of business operations. This also shifts the risk profile. AI and shadow AI not only make data breaches more likely, but also more impactful.

At the same time, research shows that organizations with robust security and governance in place can actively manage these risks and significantly limit the financial consequences.

The core question for executives and security decision-makers has therefore shifted. It is no longer about the question (i) or investment is needed in security and governance around AI, but (ii) where and how that yields the most return.

The IBM/Ponemon report shows that investments in three interconnected domains consistently contribute to lower costs, faster incident resolution, and greater management control: IAM, SOC, and GRC.

Identity & Access Management (IAM) forms the first line of defense. A large proportion of AI-related incidents can be traced back to inadequate access control — not only for human users, but also for machine and AI accounts. By bringing AI systems under the same identity regime as other critical assets, organizations gain insight, control, and enforceability. This not only reduces the risk of misuse but also accelerates intervention as soon as an incident occurs.

Security Operations (SOC) forms the second domain. AI-driven detection, correlation, and response demonstrably lead to shorter detection and containment times. This is not a theoretical advantage: it directly reduces the duration of business disruption and limits escalation costs. Organizations that strengthen their SOC with automation and AI capabilities move faster from incident to recovery — a decisive factor in limiting 'lost business'.

Governance, Risk & Compliance (GRC) finally ensures coherence and predictability. Not as a paper exercise, but as a framework for decision-making and accountability. Clear policy choices, defined responsibilities, and embedded review and approval processes make the difference between reactive crisis management and controlled response. Organizations that have thought about AI use and risks in advance no longer have to do so under the pressure of an incident.

The return lies precisely in this combination. Investing in all three domains — IAM, SOC, and GRC — ensures that the whole is greater than the sum of its parts. It leads to lower incident costs, faster decision-making, and reduced uncertainty/liability at the board level.

For organizations wondering where they stand, this presents a clear invitation. By making risks around AI and shadow AI transparent and managing them proactively, security and governance transform from a cost item into a strategic prerequisite. In this case, investing is not a leap of faith, but a calculated and sensible choice.

Navaio is happy to discuss with you where your organization stands, what risks are real, and where targeted efforts can yield the most value.

‍

Part 1: The calm before the storm: AI adoption, shadow AI, and the underestimated data breach risk. [link]

Part 2: The devil's dilemma: why AI increases the data breach risk AND limits the damage. [link]

‍