Akamai’s August 2026 release recommends focusing AI-security visibility, monitoring, and coaching on a high-risk group it describes as 5% of employees, associated with a majority of interactive AI prompts. That is a risk-management recommendation—not evidence that 5% of workers caused most breaches, or a universal statistic about workforces. Akamai’s public release does not provide enough detail to independently verify the group’s definition or denominator. The useful takeaway is to understand how AI is being used and where sensitive data or permissions can flow, then apply proportionate controls without treating frequent users as malicious.
What Akamai’s 5% figure does—and does not—say
Akamai is the source of the 5% framing. Its August 2026 release says a high-risk employee segment drives the majority of interactive AI prompts and recommends directing telemetry, monitoring, and tailored coaching toward that segment. It does not establish that this group caused a corresponding share of security incidents. The release and report landing page do not provide sufficient accessible detail to verify the population denominator, the precise definition of “high-risk,” or the full telemetry sampling method. Treat the figure as Akamai’s targeting proposal, not a universal workforce benchmark.
As an Amazon Associate I earn from qualifying purchases.
A separate Akamai report landing-page headline says nearly half of “enterprise AI conversations” use unmanaged personal identities. That wording describes conversations, not employees or breaches, and should not be interpreted as a measure of incident frequency. Together, the figures point to a practical concern: organizations may have limited visibility into where workplace AI use happens and which identity is involved.
Frequent use is not evidence of bad intent. It can, however, mean more opportunities for sensitive material to enter prompts, more connections to work systems, and more exposure to services or extensions outside formal procurement. The goal is to find and govern those pathways, not punish people for using AI.
#1 Best Overall
How intensive AI use can expand exposure
Shadow AI and personal accounts
Shadow AI includes AI services used for work without an organization’s approval or oversight. When employees use personal identities, an organization may have difficulty connecting activity to managed accounts, applying consistent policy, or understanding which services receive work information. Akamai recommends continuous discovery of AI services and identity federation, such as single sign-on (SSO), to improve visibility and governance. SSO can help tie access to managed identities; on its own, it does not prevent sensitive information from being entered into a prompt.
Prompts, uploads, and approved tools
Data can be exposed through a pasted prompt, an uploaded document, or information copied from work applications. This remains a concern even when a tool is approved: procurement status does not determine what data a prompt contains, what context an AI feature can access, or where its output goes. Akamai recommends contextual inspection of prompts, copy-and-paste activity, and uploads rather than relying only on static data-loss-prevention rules. That recommendation is a proposed control, not proof of comparative effectiveness.
IBM’s 2025 Cost of a Data Breach summary says one in five organizations in its study reported a breach due to shadow AI. The study, conducted by the Ponemon Institute and sponsored and analyzed by IBM, covered breaches experienced by 600 organizations globally from March 2024 through February 2025. IBM also reported that only 37% of organizations had policies to manage AI or detect shadow AI. These are findings from that study, not a forecast that one in five organizations will experience such a breach in any given year.
Free tools Windows power users keep installed
One-click scans. No signup required.
Browser and IDE extensions
AI extensions can be granted access to browser content, development environments, or other information visible in a user’s session. Akamai reports that, among the AI extensions it analyzed, almost 75% demanded high or critical permissions and 16.3% contained known CVEs. The release does not give enough accessible detail to add a sample size or further methodological qualification. Akamai advises treating extensions as privileged software. In practice, organizations can review permissions, restrict installation to approved extensions, and manage browser and IDE settings; those are implementation options, not tested outcomes established by the report.
Agents and instructions hidden in external content
An AI agent may process web pages, documents, or other tool outputs and may be allowed to take actions or access data. That creates a different exposure pathway from a person simply asking a chatbot a question: untrusted content can contain instructions that attempt to steer an agent. Akamai calls one described method “CometJacking,” in which malicious instructions embedded in a public web page manipulate a local AI agent, potentially prompting it to access files, email, or session credentials. Akamai also uses “Vibe hacking” and “CursorJacking” for other methods; these are report terminology, not universally standardized threat categories.
Rank #3
Check Point’s 2026 report separately discusses how agentic workflows that process external pages and documents increase exposure to indirect prompt injection. It recounts controlled tests involving a browser assistant; those tests are specific to the report and do not establish that every agent is vulnerable in the same way. The practical question is what an agent can read or change, whether a person must approve consequential actions, and whether its activity can be audited.
What other 2025–2026 findings add
IBM’s study reported that organizations with high shadow-AI exposure had average breach costs $670,000 higher than organizations with low or no such exposure. This is a comparison of study groups, not an added charge attributable to any individual breach, and it does not by itself prove that shadow AI caused the cost difference.
Check Point’s 2026 report says high-risk generative-AI prompts rose from 2% to 4% in its observed dataset and that an average organization ran ten AI applications per month. These are Check Point’s measures; they should not be combined with Akamai’s user-segment figures because the sources use different samples and measurement methods.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to govern AI use without blanket bans
A proportionate program combines discovery, identity, data controls, software governance, and clear limits on agents. Akamai recommends several of these layers; IBM’s findings highlight the policy and detection gaps. No source here establishes one control as universally best, so choose controls that fit the organization’s systems, data, and working practices.
Best Value
- Find the real usage. Inventory AI SaaS, personal-account use where observable, embedded AI features, browser and IDE extensions, and agents. Look for frequent use and unusual service patterns as signals for investigation and support—not as proof of misconduct.
- Bring identity into view. Use identity federation or SSO where available, and establish a process for discovering niche AI services. Connect activity to managed identities where feasible, while recognizing that identity controls improve governance and do not replace data controls.
- Set rules for data flows. Define which information may be entered into which tools. Evaluate prompts and uploads in context, including copy-and-paste pathways, and provide a clear route for employees to request an approved tool or resolve a blocked workflow.
- Review extensions as software with privileges. Check requested permissions and known vulnerabilities, restrict installation where appropriate, and manage approved browser and IDE extensions centrally.
- Constrain agents to the task. Apply least privilege: give an agent only the data and actions it needs. Require human approval for consequential actions where appropriate, and retain audit records that help explain what the agent accessed or did.
- Pair monitoring with coaching. Explain what is allowed, why controls trigger, and how workers can complete legitimate tasks safely. Monitoring should support accountable governance and remediation rather than assume that the most active users are the threat.
How to assess an AI-security approach
Whether evaluating internal controls or a security product, compare coverage across AI services, personal accounts, extensions, embedded features, and agents. Check whether activity can be associated with managed identities, whether prompts and uploads can be assessed in context, and whether extension permissions and vulnerabilities are visible. For agents, examine the scope of data access, limits on actions, approval requirements, and auditability. Also assess whether the approach supports useful AI adoption through clear policy and coaching rather than relying solely on blocking. The cited sources do not provide a neutral head-to-head product test or comparative price/performance evidence.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute
