Akamai Research: Nearly Half of Enterprise AI Use Bypasses Corporate Security, Creating Massive “Shadow AI” Visibility Gaps

Akamai’s 2026 State of the Internet security report warns that enterprise AI risk is concentrating in a small group of “AI power users” and expanding via “shadow AI,” including rogue browser extensions and vulnerable autonomous agents. It highlights three new AI-native attack vectors (vibe hacking, CursorJacking, and CometJacking) that can bypass perimeter defenses, while noting ~75% of AI extensions require high/critical permissions and 16.3% contain known CVEs. Akamai outlines a CISO roadmap—targeting power users, eliminating shadow AI via SSO/continuous discovery, inspecting the interaction layer, vetting extensions, and securing AI agents—implying elevated near-term cybersecurity urgency for enterprises.

Analysis

This is more a demand-creation note for cyber budgets than a near-term earnings driver. The biggest beneficiaries are vendors sitting at the identity/browser/endpoint intersection, because the pain point is no longer perimeter breach prevention but governance of user interaction, extensions, and agent permissions. That argues for continued budget rotation toward PANW, ZS, CRWD, and OKTA; AKAM participates only if it can convert this narrative into measurable attach or cross-sell in enterprise security, not just brand lift.

Second-order, the report implies a broader procurement shift from single-tool visibility to continuous telemetry across unmanaged apps and local environments. That helps platforms with high-switching-cost integration layers and hurts point solutions that only solve one slice of the stack. It also creates a headwind for “approved SaaS only” assumptions: as shadow AI expands, security teams will likely fund discovery/SSO controls first, then agent monitoring, which could delay spend on newer AI-native products by 1-2 quarters.

The market risk is overpaying for the headline while underestimating budget friction. If AI incidents do not spike in the next 1-3 months, this could remain a slide-deck catalyst rather than a revenue catalyst; the thesis breaks if AKAM does not show pipeline or billings improvement in the next earnings cycle. Contrarian view: consensus may be too optimistic that every AI-security headline creates incremental TAM; a meaningful portion is just reclassification of existing security spend, which favors incumbents with clear category ownership more than report publishers.

Key Decisions for Investors

• Buy CIBR on weakness over the next 1-3 weeks as a diversified way to own the AI-security budget rotation; target a 6-12 month hold, with thesis invalidated if cyber spend decelerates in enterprise checks.
• Prefer long PANW or ZS over AKAM on a relative basis for 1-3 months; they have more direct exposure to identity, browser, and interaction-layer controls. Use AKAM only as a secondary beneficiary unless channel data shows security attach accelerating.
• Avoid chasing AKAM as a standalone long until next earnings confirms security pipeline conversion; the report is supportive but not yet a fundamental catalyst. Falsifier: no uptick in security bookings or commentary on AI-driven demand.
• If AKAM gaps on the news, consider a tactical mean-reversion long only for 3-5 trading days with a tight stop, because the event is sentiment-positive for the category but unlikely to change near-term revenue.
• Watch OKTA and PANW for the cleanest read-through on shadow-AI governance spend; if they report stronger deal activity in the next quarter, add to cyber exposure and fade any AKAM-only enthusiasm.