iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Akamai’s August 2026 security release recommends focusing telemetry, monitoring, and coaching on a high-risk segment it describes as 5% of employees driving the majority of interactive AI prompts. That is a risk-management recommendation—not evidence that 5% of workers caused most breaches, or a universal statistic about workforces. Akamai’s public release does not give enough detail to independently verify the segment’s denominator or methodology. The useful takeaway is to find where AI use creates meaningful exposure and address it proportionately, rather than treating frequent users as suspects.
What the 5% figure does—and does not—mean
Akamai published the 5% framing on August 5, 2026, as guidance for where security teams might concentrate attention. It describes a high-risk employee segment associated with a majority of interactive AI prompts; it does not say that this segment accounts for a majority of security incidents. The release and report landing page do not provide sufficient accessible detail about the population, definition of “high-risk,” or measurement method to generalize the number to every organization. Akamai’s release and report page should therefore be read as vendor guidance, not a universal workforce benchmark.
Frequent use is relevant because it can mean more opportunities for sensitive data to enter prompts, more reliance on AI integrated into everyday tools, and greater exposure to services or extensions an organization does not manage. These are possible exposure pathways, not proof of careless behavior or bad intent. A user who relies on AI heavily may be doing valuable work; the security task is to understand the data and permissions involved.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesHow AI use can expose company information
Unmanaged services and personal accounts
Employees may use AI services outside approved procurement or sign in with personal identities. That can leave an organization with limited visibility into which tools are being used, what data is submitted, and whether activity is tied to a managed account. Akamai’s 2026 report landing page says nearly half of enterprise AI conversations occur through unmanaged personal identities. That is Akamai’s wording and finding; it should not be restated as a share of employees, companies, or breaches.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Single sign-on federation can help connect approved services to managed identities, while service discovery can reveal a long tail of niche AI applications. Neither measure alone prevents sensitive information from being submitted. They improve visibility and governance when combined with data controls and clear policy.
Prompts, pasted text, and uploads
A prompt can contain source code, customer records, internal documents, credentials, or other sensitive material. File uploads and copied text create similar data flows, including when the AI service is approved. Procurement approval answers which service may be used; it does not establish that every prompt, upload, or use case is appropriate.
Akamai recommends contextual inspection of prompts, copy-and-paste activity, and document uploads rather than relying only on static data-loss-prevention rules. The aim is to distinguish sensitive material and risky destinations from legitimate work, with policies that explain what is allowed. The recommendation is not a comparative efficacy trial establishing one control as best.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Browser and IDE extensions
AI extensions can operate within browsers or development environments and may have access to pages, code, or other user activity. Akamai reports that almost 75% of the AI extensions it analyzed demanded high or critical permissions, and 16.3% contained known CVEs. Those figures apply to the extensions examined in its report; the release does not provide enough sample and methodology detail to infer the same rates for every extension catalog.
Because extensions can be highly privileged software, organizations can review requested permissions, limit installation to approved extensions, and manage browser and IDE settings centrally. These are practical implementation choices, not controls whose effectiveness Akamai tested against one another in the cited release.
Agents and instructions hidden in content
AI agents can process web pages, documents, and other tool outputs, then take actions using whatever access they have been granted. Akamai describes “CometJacking” as malicious instructions placed in a public web page that manipulate a local AI agent, potentially prompting access to files, email, or session credentials. The term is used by Akamai and is not necessarily a standardized threat category.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check Point’s 2026 report separately discusses the larger attack surface created when agents process external pages and documents, including controlled tests involving a browser assistant. Such report-specific demonstrations show why indirect prompt injection deserves attention; they do not prove that all agents are vulnerable in the same way. The key practical questions are what data an agent can reach, which actions it can take, when a person must approve those actions, and whether activity is auditable.
What the broader evidence says about shadow AI
IBM’s summary of its 2025 Cost of a Data Breach study, conducted with the Ponemon Institute, says one in five organizations in the study reported a breach due to shadow AI. The study analyzed breaches experienced by 600 organizations globally from March 2024 through February 2025. IBM also reported that 37% had policies to manage AI or detect shadow AI, and that organizations with high shadow AI exposure experienced average breach costs $670,000 higher than organizations with low or no exposure. These are study findings for that population and period—not a forecast of the cost of an individual incident or proof that shadow AI alone caused the difference. IBM’s study summary includes the figures and context.
Check Point’s 2026 AI Security Report provides a separate view from its own telemetry: it says high-risk GenAI prompts rose from 2% to 4%, and an average organization used ten AI applications per month. These measurements should not be combined with Akamai’s prompt-based segment or IBM’s breach study: the sources use different data, samples, and measures. Check Point’s report is useful as complementary evidence that exposure can involve both prompt content and the tools processing it.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to focus controls without punishing useful AI work
Build visibility across the tools people actually use
Inventory AI SaaS, personal-account use, browser and IDE extensions, embedded AI features, and agents. Identify frequent users as a starting point for understanding workflows, not as a proxy for wrongdoing. Akamai recommends discovering high-use users and the long tail of AI services; IBM’s findings underscore the policy and shadow-AI detection gap reported by organizations in its study.
Connect identity to policy
Where services support it, use identity federation so approved activity can be associated with managed accounts. Define which data classes may be used with which services and for what tasks. Give employees a workable route to request a tool or report a need, so policy does not force legitimate work into less-visible channels.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Apply contextual data controls
Evaluate prompts and uploads for sensitive content in context, and make the response proportionate: warn, block, or request review according to the data and destination. Explain the policy to users and provide coaching when the issue is an unclear boundary rather than deliberate misuse. Akamai proposes interaction-level inspection; the cited sources do not establish a universally superior rule set.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Govern extensions and agents by their access
For extensions, review permissions and vulnerability information and restrict installation where appropriate. For agents, apply least privilege, limit access to only the files and services needed, require human approval for consequential actions, and retain behavioral logs that support investigation. This focuses safeguards on capability and data access instead of assuming that an AI feature is safe simply because it is approved.
Review whether controls support the work
Useful evaluation questions include:
- Coverage: Does the approach include AI services, unmanaged identities, extensions, embedded features, and agents?
- Identity and visibility: Can activity be associated with managed identities, and can unapproved services be discovered?
- Data handling: Can prompts, copied text, and uploads be assessed in context?
- Permissions: Can teams review extension access and constrain agent data and actions?
- Operational fit: Do policies and coaching let employees use AI safely, or do they rely mainly on blanket bans?
These are decision criteria, not a product ranking. The cited sources do not provide a neutral head-to-head comparison of security platforms or evidence that any single control works best in every organization.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
