Firms using AI extensively spent $3.41 million less per breach, IBM finds, and closed incidents faster
The average data breach now costs a Canadian organization $7.11m, with longer incidents and attacks on critical infrastructure driving the bill higher.
That total is the highest since the study began, according to the 2026 IBM Cost of a Data Breach Report, and it lands as breaches in Canada grow both larger and slower to resolve.
The average number of compromised records rose 8 percent year over year to 28,500, the report found, while the average breach lifecycle lengthened 6 percent to 205 days.
Globally, the average cost reached a record US$4.99m, leaving Canadian costs well above it.
Supply-chain compromise has become the single largest factor pushing Canadian breach costs upward, IBM said, adding roughly $367,899 per incident on average.
A shortage of security skills contributed a further $314,500, according to the report, and difficulty prioritizing threats added $311,300.
Even organizations with mature security programs can be exposed through trusted suppliers, contractors, software vendors or business partners, IBM noted, as interconnection extends cyber risk beyond organizational boundaries.
Chris Sicard, IBM Canada security leader, said attackers now target sectors "where disruption creates real operational and economic consequences" and look for the weakest supply-chain link.
A breach in energy, industrial, or technology firms spreads outward, he said, because each connected supplier and third-party platform "expands the attack surface."
Energy organizations reported the highest average breach costs in the country at $9.21m per incident ahead of technology firms at $9.02m and industrial companies at $8.89m.
The same research points to a clear payoff from automation.
Organizations that deployed AI and security automation extensively reported average breach costs of $5.5m, compared with $8.91m for those with no deployment, a gap of about $3.41m per breach.
Those organizations also detected breaches in 124 days and contained them in 57 days against 154 and 71 days respectively for organizations that did not use the tools.
The organizations gaining the biggest security advantage, Sicard said, use AI and automation "extensively across their operations."
They find threats sooner, respond faster, and trim the financial hit from breaches by millions.
Attackers are adopting the same technology. The report found that 28 percent of Canadian organizations reported an AI-generated attack.
IBM urged Canadian organizations to cut costs by strengthening identity and access management and improving visibility into suppliers and third-party partners.
The firm also recommended wider use of AI and automation across detection and prevention, plus regular testing of incident response plans to shorten response times.
