On Tuesday 6 October, ASOS customers opened the retailer’s app and found a push notification written by criminals: “Engage with us, or we will leak it.” The brand’s own channel had become the breach notice. Two days later the BBC established that the attackers held far more than the “basic” information ASOS first described: names, home addresses, phone numbers, and even the searches customers had run on the site. The way in, according to ASOS, was a single employee login, obtained by “impersonating a trusted contact”. There was no zero-day and no exotic malware. One login, one adjacent platform, and a customer relationship turned into an extortion channel.

I’ve spent the past year arguing that agentic AI will redesign marketing, and I still believe it. I also hold a less fashionable view, which ASOS has just illustrated uncomfortably well: until our foundations are stable, security has to take priority over shipping new features.

Focus On: The Economics Have Flipped

IBM’s Cost of a Data Breach Report 2026 puts the global average cost of a breach at a record $4.99 million, up 12% in a year. One in four malicious breaches was AI-enabled, a 56% increase, and those cost $6 million on average. IBM sells security, so read it accordingly, but Suja Viswesan’s summary is hard to dispute: “AI is making attacks faster and cheaper, while breaches keep getting more expensive.”

When ransomware actors chose a pressure point, the most common was brand reputation, at 41%. Attackers, it seems, understand brand equity perfectly well. More than one in five organisations reported a breach targeting AI models or applications, most often through compromised APIs, applications, or plug-ins, which is to say the connectors we keep adding.

The UK AI Security Institute estimated in February that the length of cyber tasks frontier models can complete on their own was doubling roughly every 4.7 months, and the newest models have since outrun even that. At that pace, a security review starts going stale the day it is signed off.

When the downside lands, it lands in the P&L. Marks & Spencer’s half-year results showed statutory profit before tax falling from £391.9m to £3.4m after last year’s attack, and the Cyber Monitoring Centre estimates the Jaguar Land Rover incident cost the UK £1.9bn and touched more than 5,000 organisations. The bill arrived as weeks without online orders at one and idle production lines at the other.

Agents Remove the Human From the Loop, Including the One Who Says Stop

In January, in When Algorithms Attack Algorithms, I wrote about OpenAI’s red team using a malicious email to make its own browser agent send the user’s resignation to their CEO. That was a lab exercise. Salt Labs has since shown the same trick working against Manus, a widely used agentic platform. A hidden payload in a single email ran code inside the agent’s environment and reached the tokens for the victim’s connected Gmail, Drive, and GitHub accounts. The victim’s only contribution was asking the agent to check their inbox (I ask mine to do the same every morning). Manus’s guardrail did detect the attack. It simply fired after the code had already run.

Salt’s conclusion should be pinned above every AI programme board: “On a system that acts on its own, no human sits between the alert and the action, so a control that fires a moment too late provides no protection.” It’s the failure mode I described last month in Every AI Agent Needs a Stopping Rule. A stopping rule that fires after the damage has a more accurate name: an incident report.

IBM also found shadow AI involved in 43% of incidents this year, up from 20%, at an average cost of $5.39 million. Only 46% of organisations report securing the non-human identities on which agents depend. Marketing, with its appetite for content, social, and analytics tools, sits squarely inside both numbers.

The Precedent: “Do Security”

None of this is a novel argument. In May 2024, Satya Nadella told Microsoft’s employees: “If you’re faced with the tradeoff between security and another priority, your answer is clear: Do security. In some cases, this will mean prioritizing security above other things we do, such as releasing new features…” He tied part of senior leadership pay to it.

Two years on, Microsoft’s July 2026 progress report records phishing-resistant multifactor authentication on 99.97% of user and device pairs and 1.4 million unused apps decommissioned. Note that last figure, because much of security is subtraction. Microsoft kept shipping AI throughout. Nadella’s rule decided what gave way when the two collided.

Isn’t Slowing Down the Bigger Risk?

Slowing down has a cost, and I won’t pretend otherwise. FTI Consulting found that 60% of large companies slowed, paused, or pulled back an AI deployment in the past year, with cybersecurity the top concern, and some of them will lose ground to faster rivals. There is a subtler cost, and IBM’s shadow AI figure points to it. Close the approved route to a tool and people find an unapproved one; a freeze that pushes teams into personal accounts and free trials leaves the estate less safe than it found it.

My reading is that the choice is being framed wrongly. The decision isn’t speed versus safety; it’s sequence. Stabilise identity, permissions, and vendor sprawl, then accelerate. A quarter spent consolidating is recoverable. An ASOS-style week is not, because what you lose is trust, and trust doesn’t come back on a sprint cycle.

A Quarter for Foundations

In August I argued, in The Pilot You Forgot Is Still Logged In, that marketing now runs one of the largest attack surfaces in the enterprise, much of it invisible to the CIO. At ASOS the door was a third-party platform, but as far as customers were concerned, ASOS had sent that notification.

The agenda is short and unglamorous. Declare a quarter in which no new MarTech connector or AI agent goes live without the CISO’s sign-off, with an approved route for what the team genuinely needs. Inventory every token that touches customer data and revoke the ones nobody can justify. Give agents their own scoped identities, with a kill switch someone can pull in minutes. Rehearse what you’d say if your app, your email platform, or your social accounts spoke with someone else’s voice; a US-listed company has four business days from judging an incident material to say it formally, which is no time to write a first draft.

Nor should vendor pledges reassure you. Snowflake is among the 393 signatories of CISA’s Secure by Design Pledge, yet the ASOS attackers claimed to have taken the retailer’s data from Snowflake, apparently using the stolen login rather than any flaw in the platform (Snowflake says its systems weren’t breached). A vendor’s pledge covers the vendor’s product. The login, and whether it demands a second factor, is yours.

Two questions to take into 2027 planning. If you froze every new AI feature for one quarter, what would your team fix first, and what would you genuinely lose? And could you name, today, every agent and platform holding a token to your customer data, then revoke one within ten minutes?

I suspect most of us would struggle with the second question, which rather answers the first.

Follow me

That’s all for this week. To keep up with the latest in generative AI and its relevance to your digital transformation programmes, follow me on LinkedIn or subscribe to this newsletter.

Disclaimer: The views and opinions expressed in Chronicles of Change and on my social media accounts are my own and do not necessarily reflect the official policy or position of S&P Global.