Enterprise AI Risk: Concentration Among Power Users and Security Vulnerabilities

Akamai's recent Enterprise AI Usage Risk Report 2026 reveals a critical shift in the landscape of enterprise AI usage, highlighting a concentration of risk among a small group of power users. This report underscores that nearly half of enterprise AI interactions occur through personal accounts, leaving security teams blind to significant vulnerabilities. The findings indicate that the top 5% of users engage with AI tools at a staggering rate—12 times more than the bottom half—transforming AI from a simple productivity tool into an integral part of business operations. This concentration of usage raises alarms about data security and privacy, suggesting that traditional blanket policies are inadequate to address the nuanced risks posed by shadow AI.

The report details that 47.11% of enterprise AI conversations occur through personal identities, which bypass corporate oversight. This lack of visibility is compounded by the fact that the top users average 18 prompts per session, compared to just five for the majority. Such engagement levels indicate that these users are not merely utilizing AI for quick tasks but are increasingly integrating it into their workflows as a collaborative partner. This trend signals a need for organizations to rethink their approach to AI governance, as the very employees driving productivity are also the ones inadvertently expanding the enterprise's exposure to risk.

Akamai's data further reveals that 16.31% of AI browser and IDE extensions contain known vulnerabilities, a figure significantly higher than the 10.80% vulnerability rate for browser extensions overall. Additionally, 14.4% of conversations are initiated through corporate emails linked to personal freemium subscriptions, which can inadvertently expose sensitive information to public AI models. This duality of risk—where the most productive users are also the most vulnerable—highlights a critical gap in identity security that organizations must address.

The implications of these findings extend beyond immediate security concerns. Organizations must recognize that the concentration of AI usage among a small group of employees creates a unique risk profile that traditional security measures may not adequately mitigate. By focusing on the intensity of AI usage rather than simply the number of users, companies can better identify potential vulnerabilities. This approach necessitates a shift in strategy, emphasizing the need for enhanced visibility into AI interactions and the implementation of robust governance frameworks.

To effectively manage these risks, organizations should prioritize the identification of high-intensity AI users and implement Single Sign-On (SSO) solutions to ensure that all AI interactions occur within corporate identity systems. By doing so, companies can significantly reduce the percentage of conversations occurring through personal accounts. Furthermore, treating AI agents and extensions as privileged identities will help enforce stricter controls and reduce the likelihood of data breaches stemming from unvetted tools.

As organizations navigate this evolving landscape, the focus should shift toward understanding the dynamics of AI usage intensity. The same 5% of users who drive productivity gains also represent the most significant risk exposure. By proactively addressing these vulnerabilities, companies can not only safeguard their data but also leverage AI more effectively. The future of enterprise AI governance will depend on a nuanced understanding of user behavior and the implementation of tailored security measures that align with the realities of how AI is being used in the workplace.