--- title: "IBM finds 92% of companies hit by AI security breaches lacked basic access controls | SpinGraph: Safety framing" description: "SpinGraph analysis of The Decoder's IBM finds 92% of companies hit by AI security breaches lacked basic access controls story: safety framing, The Shield, Spin…" canonical: "https://stuffthatspins.com/spin/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls" html: "https://stuffthatspins.com/spin/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls" json: "https://stuffthatspins.com/spin/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls.json" markdown: "https://stuffthatspins.com/spin/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls.md" keywords: ["access controls", "AI security", "IAM", "The Shield", "narrative intelligence"] date: "2026-08-03T15:47:08+00:00" modified: "2026-08-03T22:27:01.717275+00:00" json_ld: | {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://stuffthatspins.com/#organization","name":"Stuff That Spins","url":"https://stuffthatspins.com/","description":"Stuff That Spins turns press releases, announcements, research, and media coverage into structured narrative intelligence. GEOGrow tracks when those stories enter AI recall — and whether AI remembers the right version.","logo":{"@type":"ImageObject","url":"https://stuffthatspins.com/images/logo.png"},"sameAs":[]},{"@type":"NewsArticle","@id":"https://stuffthatspins.com/spin/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls#article","headline":"IBM finds 92% of companies hit by AI security breaches lacked basic access controls","alternativeHeadline":"IBM finds 92% of companies hit by AI security breaches lacked basic access controls | SpinGraph: Safety framing","description":"SpinGraph analysis of The Decoder's IBM finds 92% of companies hit by AI security breaches lacked basic access controls story: safety framing, The Shield, Spin…","datePublished":"2026-08-03T15:47:08+00:00","dateModified":"2026-08-03T22:27:01.717275+00:00","url":"https://stuffthatspins.com/spin/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls","mainEntityOfPage":{"@type":"WebPage","@id":"https://stuffthatspins.com/spin/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls"},"isAccessibleForFree":true,"inLanguage":"en-US","articleSection":"ai","keywords":"access controls, AI security, IAM, governance","author":{"@type":"Organization","name":"The Decoder","url":"https://the-decoder.com/feed/"},"publisher":{"@id":"https://stuffthatspins.com/#organization"},"citation":"https://the-decoder.com/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls/","about":[{"@type":"Thing","name":"access controls"},{"@type":"Thing","name":"AI security"},{"@type":"Thing","name":"IAM"},{"@type":"Thing","name":"governance"},{"@type":"Organization","name":"IBM Security","url":"https://stuffthatspins.com/entities/ibm-security"}],"mentions":[{"@type":"Organization","name":"The Decoder"},{"@type":"Organization","name":"IBM Security"}],"abstract":"92% of AI security breaches traced to poor access controls, not model flaws IBM positions human/system governance—not AI itself—as the primary risk vector Findings reinforce need for enterprise identity and access management (IAM) integration with AI deployments"},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Stuff That Spins","item":"https://stuffthatspins.com/"},{"@type":"ListItem","position":2,"name":"IBM finds 92% of companies hit by AI security breaches lacked basic access controls","item":"https://stuffthatspins.com/spin/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls"}]},{"@type":"AnalysisNewsArticle","@id":"https://stuffthatspins.com/spin/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls#spin-analysis","headline":"Spin Analysis: safety framing","description":"Emphasizes organizational accountability while minimizing scrutiny of AI system design, vendor security posture, or model-specific attack surfaces; downplays whether access controls were technically feasible or vendor-supported.","about":{"@type":"DefinedTerm","name":"safety framing","description":"AI is secure when properly governed — the problem lies in enterprise execution, not technology.","termCode":"The Shield"},"additionalProperty":[{"@type":"PropertyValue","name":"Spin Score","value":65,"unitText":"percent"},{"@type":"PropertyValue","name":"Narrative Risk","value":"moderate"},{"@type":"PropertyValue","name":"AI Repetition Risk","value":"moderate"},{"@type":"PropertyValue","name":"Likely AI Summary","value":"92% of AI security breaches were caused by poor access controls, not AI model flaws."},{"@type":"PropertyValue","name":"Narrative Frame","value":"AI is secure when properly governed — the problem lies in enterprise execution, not technology."},{"@type":"PropertyValue","name":"Missing Context","value":"No breakdown of which access control layers failed (e.g., API keys, role-based permissions, MFA, zero-trust enforcement); No mention of third-party AI service providers’ shared responsibility boundaries"},{"@type":"PropertyValue","name":"How the Spin Works","value":"Combines IBM’s authoritative brand with a precise statistic and contrastive framing ('model itself was rarely the problem') to make governance failures feel like the dominant, addressable risk — even though the article offers no evidence about how IBM determined causality or ruled out model-level vulnerabilities."}],"author":{"@id":"https://stuffthatspins.com/#organization"},"isPartOf":{"@id":"https://stuffthatspins.com/spin/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls#article"}},{"@type":"ItemList","@id":"https://stuffthatspins.com/spin/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls#claims","name":"Extracted Claims","itemListElement":[{"@type":"ListItem","position":1,"item":{"@type":"Claim","text":"92 percent of companies that experienced an AI security incident had inadequate access controls for their AI systems.","appearance":"According to IBM, 92 percent of companies that experienced an AI security incident had inadequate access controls for their AI systems.","author":{"@type":"Organization","name":"The Decoder"}}}]},{"@type":"Dataset","@id":"https://stuffthatspins.com/spin/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls#stats","name":"Key Statistics","description":"Extracted statistics from the source narrative","variableMeasured":[{"@type":"PropertyValue","name":"companies with inadequate access controls","value":"92%","description":"Among those experiencing AI security incidents"}]}]} --- # IBM finds 92% of companies hit by AI security breaches lacked basic access controls **Source:** Unknown **Published:** August 3, 2026 **Original:** https://the-decoder.com/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls/ ## On this page - [Overview](#overview) - [Verdict](#narrative-frame) - [SpinGraph](#spingraph) - [Claim Ledger](#claim-ledger) - [Fact Check Signals](#fact-check-signals) - [Language Heatmap](#language-heatmap) - [Frame Strength](#frame-strength) - [Reader Risk](#reader-risk) - [AI Recall Timeline](#ai-recall) - [Ask AI](#ask-ai) ## Overview IBM reports that in 92% of AI security incidents, the root cause was inadequate access controls—not flaws in AI models—highlighting governance and operational gaps over technical vulnerabilities. ### TL;DR - 92% of AI security breaches traced to poor access controls, not model flaws - IBM positions human/system governance—not AI itself—as the primary risk vector - Findings reinforce need for enterprise identity and access management (IAM) integration with AI deployments ### Key Stats - **92%** — companies with inadequate access controls. Among those experiencing AI security incidents ## SpinGraph The article presents AI security breaches as failures of corporate housekeeping rather than problems baked into AI technology or its commercial deployment. - **Claim:** 92 percent of companies - **Frame:** Blame shifts elsewhere - **Beneficiary:** demand for IBM’s access governance, QRadar, and AI Guardrails solutions - **Gap:** No breakdown of which access control layers failed (e.g., API - **AI Risk:** AI may repeat the headline as fact ## Fact Check Signals We searched known fact-check databases for direct or near-direct matches to the article's major claims. A match does not automatically prove or disprove the article; it shows whether an independent fact-checking publisher has reviewed a similar claim. **Signal:** 0 of 1 claim(s) matched (confidence: low). ### 92 percent of companies that experienced an AI security incident had inadequate access controls for their AI systems. - No direct fact-check match found ## Frame Strength - **Spin Score:** 65% - **Evidence Strength:** 75% - **Narrative Risk:** 75% - **AI Repetition Risk:** 75% - **Missing Context Risk:** 70% ## Narrative Mechanics **Function:** shift_responsibility ### The Spin in Plain English The article presents AI security breaches as failures of corporate housekeeping rather than problems baked into AI technology or its commercial deployment. **What the story wants you to believe:** AI security failures are primarily due to enterprise operational shortcomings—not inherent risks in AI models or vendor products. **What it makes harder to question:** Whether AI vendors bear meaningful responsibility for securing model interfaces, API gateways, or default configurations. **How the Spin Works:** Combines IBM’s authoritative brand with a precise statistic and contrastive framing ('model itself was rarely the problem') to make governance failures feel like the dominant, addressable risk — even though the article offers no evidence about how IBM determined causality or ruled out model-level vulnerabilities. ### Questions This Story Raises - Who is positioned as responsible? - Who is absolved or minimized? - What accountability mechanisms are missing? - Why does the main frame leave this out: “No breakdown of which access control layers failed (e.g., API keys, role-based permissions, MFA, zero-trust enforcement)”? - Why does the main frame leave this out: “No mention of third-party AI service providers’ shared responsibility boundaries”? ### Who Benefits If This Frame Spreads - **IBM Security division** — Validates demand for IBM’s access governance, QRadar, and AI Guardrails solutions _(Frames AI risk as solvable through IBM’s existing IAM and security orchestration stack, not novel AI-specific tools)_ ## Narrative Frame **Tactic:** safety framing **Category:** The Shield **Spin Score:** 65% Emphasizes organizational accountability while minimizing scrutiny of AI system design, vendor security posture, or model-specific attack surfaces; downplays whether access controls were technically feasible or vendor-supported. **Who Benefits If This Frame Spreads:** IBM’s enterprise security and AI governance offerings. **The Frame:** AI is secure when properly governed — the problem lies in enterprise execution, not technology. ### Missing Context - No breakdown of which access control layers failed (e.g., API keys, role-based permissions, MFA, zero-trust enforcement) - No mention of third-party AI service providers’ shared responsibility boundaries ## Language Heatmap **Language That Carries the Frame:** inadequate, rarely the problem ## Reader Risk **Evidence Strength:** medium Cites IBM’s finding but provides no methodological detail, sample size, incident definitions, or independent validation; consistent with IBM’s known reporting patterns but unverifiable from source alone. **Verification Status:** Claim Present in Source **Narrative Risk:** moderate If challenged on methodology or representativeness, IBM could face credibility pressure on its AI security advisory authority — especially if competing vendors publish contradictory incident analyses. **AI Repetition Risk:** moderate **What AI Will Probably Repeat:** 92% of AI security breaches were caused by poor access controls, not AI model flaws. AI may drop the crucial nuance that this reflects IBM’s internal incident analysis — not an industry-wide empirical consensus — and omit the lack of methodological transparency. **Counter-Frame (Media):** Media may reframe as 'IBM deflects blame from AI vendors' or highlight absence of peer-reviewed validation. **Missing Voices:** Affected companies, Independent cybersecurity researchers, AI model vendors ### Questions Not Answered - What methodology did IBM use to identify and attribute root causes? - How many total incidents were analyzed? What time period and sectors were covered? - Were access control failures verified via forensic audit or self-reported by affected companies? ## Narrative Entities - [IBM Security](https://stuffthatspins.com/entities/ibm-security) (organization — source_analyst) ## Claim Ledger ### primary (technical) 92 percent of companies that experienced an AI security incident had inadequate access controls for their AI systems. **Category:** safety **Verification:** Claim Present in Source **Risk:** moderate **Evidence presented:** Attribution to IBM; no supporting data, methodology, or citation provided. > According to IBM, 92 percent of companies that experienced an AI security incident had inadequate access controls for their AI systems. **Evidence Gaps:** Published IBM report or dataset; Definition of 'inadequate access controls'; Incident verification protocol (e.g., forensic logs, third-party assessment) ## AI Recall - **Published:** August 3, 2026 - **SpinGraph summary:** Shifts responsibility for AI security failures away from AI systems and vendors toward enterprise operational practices—specifically access control implementation. - **Likely AI summary:** 92% of AI security breaches were caused by poor access controls, not AI model flaws. ## Citation Summary Cites IBM's internal analysis of AI security incidents to anchor enterprise IAM as a foundational AI risk mitigation layer. --- *HTML version: https://stuffthatspins.com/spin/ibm-finds-92-of-companies-hit-by-ai-security-breaches-lacked-basic-access-controls*