The Outsized Shadow: Why 5% of AI Users Are Your Biggest Security Risk
Top 5% of AI users pose biggest security risk by hardcoding unvetted tools into operations.
A report by Akamai reveals that a small group of AI power users (top 5%) are creating significant security risks by embedding unvetted AI tools into critical business operations. These users interact with AI models at a much higher rate than average, leading to expanded shadow AI use, increased data leakage potential, and the deployment of autonomous AI agents outside of established security guardrails. A significant portion of these interactions occur via personal accounts or corporate emails linked to personal AI subscriptions, bypassing governance and potentially exposing sensitive data to public model training.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Akamai?
Get an email when a new story names Akamai, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA small cohort of high-frequency AI users are independently embedding unvetted AI tools into critical business workflows, bypassing organizational governance entirely. Because these interactions often occur through personal accounts or personal AI subscriptions linked to corporate emails, sensitive business data may be ingested into public model training pipelines without any organizational oversight. This 'shadow AI' phenomenon mirrors the risks of classic shadow IT but moves faster and touches more sensitive data due to AI's capacity to process and retain large volumes of information. The risk is amplified by the deployment of autonomous AI agents outside established security guardrails, which can act on data without human review. If left unaddressed, this behavior can result in regulatory violations, intellectual property exposure, and irreversible data leakage to third-party AI providers.
What helps against this
How we list vendors
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- SaaS security posture management (SSPM)
Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.