Shadow AI adds $670,000 to the average cost of a data breach. That figure comes from IBM’s 2025 Cost of a Data Breach report — covering 600 organizations globally — and 1 in 5 breaches now involves unauthorized AI tools. Engineering leaders already understand the risk directionally. The harder problem is building a business case that moves budget: specific numbers, framed for a CFO and a CISO who are both already skeptical.
The Risk Numbers That Actually Move Stakeholders
45% of AI-generated code fails security checks. Veracode’s 2025 GenAI Code Security Report tested more than 100 large language models across 80+ coding tasks and found that nearly half of AI-generated code samples introduced OWASP Top 10 vulnerabilities. For Java — the dominant enterprise server-side language — the failure rate was 72%. These are not theoretical weaknesses; they are the same vulnerability classes — Cross-Site Scripting, SQL injection, insecure deserialization — that appear in breach post-mortems and audit findings.
84% of developers now use AI coding tools, according to the Stack Overflow 2025 Developer Survey (n ≈ 49,000 respondents across 177 countries). Only 33% of those developers trust AI output. That combination — near-universal adoption paired with active distrust — describes the governance gap precisely. Volume is outpacing verification, and without a systematic check at the PR layer, vulnerability rates scale with team size.
AI-service credential leaks grew 81% year-over-year in 2025, per the GitGuardian State of Secrets Sprawl 2026. Hardcoded secrets in public repositories hit 28.65 million last year — the largest single-year increase ever recorded. AI coding assistants are the primary accelerant, generating code that embeds credentials in configuration files and inline comments. 64% of valid secrets from 2022 remained exploitable as of January 2026.
Three data points. All measurable. All trending worse. The business case becomes concrete once you pull comparable numbers from your own pipeline — adoption rate, review failure rate, and credential exposure — and apply them to your sector’s average breach cost.
Building the Business Case: Five Numbers to Put in the Deck
A governance pitch that fails usually leads with tools, not exposure. Here is the structure that moves budget conversations forward.
AI adoption baseline. Document how many AI coding tools are in active use — sanctioned and shadow. IBM found that 97% of organizations breached via AI applications lacked proper access controls. Your first deliverable is an inventory that establishes whether that control gap already exists in your environment.
Current exposure rate. What percentage of AI-generated pull requests merge without a security check? Even rough telemetry from your code review pipeline makes the exposure visible. The analysis of security vulnerability rates in AI-generated code provides the current sector benchmarks to compare against.
Breach premium calculation. IBM’s shadow AI breach premium — $670,000 per incident — is straightforward to apply to an estimated annual breach probability. The full cost breakdown of what ungoverned AI coding agents produce walks through how to make this calculation concrete for a specific team size and deployment scale.
Remediation cost trajectory. Veracode’s State of Software Security 2025 found that average remediation time for security flaws has grown 47% since 2020. Pre-merge detection is the only lever that changes this trajectory. Post-production fixes compound the cost because a vulnerability has typically been in production for days or weeks before detection.
Compliance liability surface. An undetected AI-introduced vulnerability is not just a security event — it is a potential SOC 2 finding, an audit exposure under the EU AI Act, and a disclosure risk depending on your jurisdiction and customer contracts. Governance tooling reduces this liability surface in a way that general code review does not.
What re-entry.ai does about this: re-entry.ai scores every pull request for risk factors specific to AI-generated code — flagging vulnerability patterns, secret exposure, and policy violations before merge. That PR-layer data becomes the measurement foundation a business case needs: adoption baseline, exposure rate, and pre-merge detection rate in a single view. For teams evaluating what capabilities matter most, the AI code governance platform evaluation guide covers the five that actually matter.
The data for a governance business case already exists in your development pipeline. The gap is measurement, not justification. See how PR-layer risk scoring closes that gap at re-entry.ai.