IBM has released its 2026 Cost of a Data Breach Report, revealing that the average cost of a data breach for organisations across the Middle East has reached US$8 million, underscoring the growing financial impact of cyberattacks across the region.
According to the report, cybercriminals are increasingly exploiting artificial intelligence to carry out malicious attacks. Among malicious breaches analysed, 26 per cent involved the use of AI, while 11 per cent of respondents said they were unable to determine whether attackers had employed AI during the incident.
The findings also show that organisations making extensive use of artificial intelligence and cybersecurity automation incurred breach costs that were, on average, more than US$3 million lower than those experienced by organisations that had not adopted these capabilities. However, 23 per cent of organisations surveyed have yet to implement AI-driven security and automation technologies.
Business disruption remained the largest cost component associated with data breaches in the Middle East during 2026, averaging US$3.57 million per incident. This was followed by post-breach response costs of US$2.17 million, detection and escalation expenses of US$1.9 million, and notification costs averaging US$360,000.
The findings highlight the significant financial pressures organisations continue to face throughout every stage of responding to cyber incidents, from initial detection to containment and recovery.
The financial and technology sectors recorded the highest average breach costs, at US$10.67 million per incident each. The industrial sector followed, with an average cost of US$9.6 million.
Saad Toma, General Manager of IBM Middle East and Africa, said the growing number of cybercriminals leveraging artificial intelligence for malicious purposes has made attacks faster and less expensive to execute, while the costs of detecting and responding to breaches continue to rise.
He added that this widening imbalance is fundamentally reshaping the economics of cyber risk, making it essential for organisations to invest in advanced AI-powered threat detection and response capabilities, together with greater automation, to keep pace with emerging threats and strengthen their cyber resilience.
