The Outsized Shadow: Why 5% of AI Users Are Your Biggest Security Risk
A new report by Akamai finds that 5% of AI users are creating a disproportionate security risk by expanding the use of shadow AI, increasing opportunities for data leakage, and introducing autonomous AI agents.
Intelligence analysis by Llama
The top 5% of enterprise power users interact with AI models at 12 times the rate of the bottom 50% of the workforce, creating a significant security risk. These users are creating a long-tail blind spot by using unvetted AI tools and expanding the use of shadow AI.
Imagine you have a super-smart friend who helps you with your work, but this friend is also a little bit naughty and likes to do things on their own. This is kind of like what's happening with some people who use AI tools at work. They're using these tools to help them get their job done, but they're also creating a security risk because they're not following the rules. It's like having a friend who's a little bit too curious and likes to explore things they shouldn't.
Analysis
The report by Akamai highlights the growing security risk posed by AI super-adopters. These users are creating a disproportionate security risk by expanding the use of shadow AI, increasing opportunities for data leakage, and introducing autonomous AI agents that operate within the enterprise but outside its established guardrails. The report found that the top 5% of enterprise power users interact with AI models at 12 times the rate of the bottom 50% of the workforce, creating a significant security risk. These users are creating a long-tail blind spot by using unvetted AI tools and expanding the use of shadow AI. The report also found that nearly half of all enterprise AI conversations occur through personal identities rather than corporate-managed accounts, creating a stark contrast between housebroken AI and feral AI. AI platforms with dedicated governance controls successfully enforce corporate identity boundaries, while personal-access accounts create significant visibility gaps for IT, security, and compliance teams. The report highlights the need for security teams to identify which employees depend most on AI to know where risk is concentrated. It also emphasizes the importance of establishing continuous visibility to discover all AI applications, browser/IDE extensions, and agents across the network. The report concludes that the expanding AI surface is creating new attack vectors that bypass traditional controls, and that security teams must shift their mindset to identify where AI is operating, which teams depend on it most, and whether those systems remain inside enterprise guardrails.
Key points
- The top 5% of enterprise power users interact with AI models at 12 times the rate of the bottom 50% of the workforce, creating a significant security risk.
- Nearly half of all enterprise AI conversations occur through personal identities rather than corporate-managed accounts, creating a stark contrast between housebroken AI and feral AI.
- AI platforms with dedicated governance controls successfully enforce corporate identity boundaries, while personal-access accounts create significant visibility gaps for IT, security, and compliance teams.
- The expanding AI surface is creating new attack vectors that bypass traditional controls, and security teams must shift their mindset to identify where AI is operating, which teams depend on it most, and whether those systems remain inside enterprise guardrails.
If security teams can identify and address the security risks posed by AI super-adopters, they can reduce the likelihood of data leakage and other security breaches. This can be achieved by establishing continuous visibility to discover all AI applications, browser/IDE extensions, and agents across the network, and by implementing governance controls to enforce corporate identity boundaries.
If security teams fail to address the security risks posed by AI super-adopters, they may face significant security breaches and data leakage. This can have serious consequences, including financial losses, reputational damage, and even legal action.
