Shadow AI Risk Is Concentrated Among Enterprise Power Users

Google News surfaced a sharp warning from Akamai: 5% of enterprise users generate 12 times more AI conversations than the bottom half of employees. Those workers are not merely asking occasional questions. They are embedding AI into recurring workflows, sharing work context, uploading files, and sometimes deploying agents with access to business systems.

The finding challenges the standard response to shadow AI, meaning workplace AI use that operates outside an employer’s approved controls. Many companies still publish one policy for everyone, block several recognizable websites, and count licenses for sanctioned platforms. That approach treats exposure as evenly distributed when Akamai’s telemetry says it is highly concentrated.

This is not an argument for ignoring casual use. Nearly half of the observed enterprise AI conversations used personal identities instead of corporate-managed accounts. However, the combination of personal access, intensive prompting, and connected agents creates a much more consequential risk than an isolated request.

The primary conflict is therefore not employees versus security teams. It is broad, application-level governance versus identity-aware controls focused on actual behavior. The first approach asks whether an AI service is allowed. The second asks who is using it, under which identity, with what data, and with access to which systems.

That distinction matters because the employees producing the most value with AI can also create the largest unmanaged exposure. Slowing them indiscriminately would waste expertise and encourage further workarounds. Leaving their activity invisible would allow sensitive workflows to grow beyond normal security boundaries.

Google News Reveals a Narrower Shadow AI Problem

Akamai’s data shifts the shadow AI debate from total adoption toward the concentration of activity and access.

The underlying findings come from Akamai’s Enterprise AI Usage Risk Report 2026, released on August 5. Akamai based the report on usage data from LayerX, the enterprise browser security company it acquired. The research examines personal accounts, AI applications, browser extensions, sensitive prompts, and autonomous agents.

According to the enterprise AI report, the average enterprise user generated more than 36 AI conversations. That average conceals a steep distribution. Half of users recorded 12 conversations or fewer, while the top 5% generated at least 144.

The gap is not limited to conversation counts. A typical AI conversation runs about five prompts, according to Akamai. Conversations among the most intensive users reach at least 18 prompts, showing sustained collaboration rather than a single search-like exchange.

Longer conversations create more opportunities for business information to enter an external system. A user might begin with a harmless request for an outline. Later prompts can add customer details, internal constraints, document excerpts, source code, financial assumptions, or instructions copied from private communications.

That accumulated context matters more than any isolated sentence. Modern AI work often develops through fragments. A worker adds facts across multiple prompts, uploads supporting files, and asks the model to revise its output repeatedly. Each individual disclosure can appear modest while the complete conversation reconstructs a sensitive business process.

Akamai also reports that 47.11% of enterprise AI conversations occur through personal identities. Those sessions sit outside corporate identity controls, retention settings, audit systems, and negotiated data protections. Security teams can see that a browser reached an AI service without knowing whether the employee used a managed account.

The identity split varies sharply by platform. Akamai’s telemetry found that Gemini Enterprise kept 98.15% of interactions within corporate identity systems. Microsoft Copilot for Microsoft 365 kept 90.55% within those systems.

Consumer-oriented access showed the opposite pattern. The report associated 61.36% of ChatGPT interactions, 61.09% of Claude interactions, and 63.92% of Microsoft Copilot Standard interactions with personal identities. DeepSeek reached 99.8%.

These figures do not prove that every personal session leaked confidential data. They establish a visibility gap. An employer cannot consistently apply corporate retention, access, and data handling rules when work crosses an identity it does not manage.

The article appearing through Google News also emphasizes a crucial correlation. The same power users who conduct deeper conversations are more likely to upload files, share business information, and connect AI with operational tasks. Risk follows activity because every additional interaction creates another chance for inappropriate exposure.

That is a more useful framing than counting every employee as an equal source of danger. A worker who asks one general writing question does not create the same risk as an engineer who connects an agent to a code repository. Both use AI, but their access, data, and potential impact differ dramatically.

The headline number, 5%, should not become a permanent threshold. Every organization will have a different distribution. The important change is methodological: security teams need to measure concentration before deciding where stronger controls belong.

The Riskiest Users Are Often the Most Productive

The employees most likely to bypass broad AI policy are often the people who have already turned AI into working infrastructure.

Power users usually emerge because they discover repeatable value before formal procurement catches up. They may use AI to summarize customer research, debug code, draft contracts, compare technical documents, analyze sales calls, or prepare financial scenarios. Repeated success encourages deeper integration.

This progression often begins innocently. An employee tests a public chatbot with nonconfidential material. They then create reusable prompts, add reference files, install a browser extension, or connect the model to another application. A personal experiment gradually becomes an undocumented production workflow.

Microsoft observed this adoption pressure years before the Akamai report. Its 2024 workplace AI study found that 75% of surveyed knowledge workers used AI at work. Among those users, 78% brought their own AI tools rather than waiting for an employer-provided option.

That earlier survey measured self-reported behavior, while Akamai presents observed usage telemetry. The sources use different methods and periods, so their figures should not be combined into one statistical claim. They still describe the same organizational tension: workers adopt convenient tools faster than companies can evaluate and govern them.

Broad prohibitions often miss that motivation. A policy can tell employees not to place sensitive information in an unapproved model. It cannot make an approved alternative useful, reduce a long access request, or explain which information is safe within a specific workflow.

When the sanctioned tool lacks needed capabilities, an intensive user faces immediate friction. They can pause productive work, submit a procurement request, or continue through a personal account. If approval takes weeks, the personal account becomes the path of least resistance.

This does not excuse unauthorized data handling. It explains why generic training produces uneven results. A yearly compliance presentation competes with daily deadlines, familiar consumer interfaces, and the immediate value of a working prompt chain.

Akamai shadow AI findings suggest that training should follow observed behavior. Casual users need clear boundaries and approved options. Power users need more detailed guidance covering data classification, identity, extensions, connectors, agent permissions, and incident reporting.

They also need a safer route to experimentation. A company can create controlled environments where advanced users test new models without exposing production data. Security teams can then observe real requirements before choosing which services, integrations, and workflows to approve.

This approach treats shadow AI power users as partners without assuming that expertise equals security awareness. Someone can understand model behavior and still underestimate retention, authorization, or third-party processing risks. Technical confidence sometimes makes an unofficial workflow feel safer than it is.

The productive user can also become a hidden system owner. If a team depends on prompts stored in a personal account, the business has no reliable record of those instructions. If the employee leaves, changes tools, or loses access, the workflow can disappear with them.

The same issue applies to knowledge. Workers often supply AI with notes, documents, meeting context, and decisions scattered across personal spaces. A governed personal knowledge system can reduce that fragmentation, but only when its access and data practices match organizational requirements.

Security teams therefore face a delicate task. They need to preserve the expertise that makes AI useful while moving the surrounding workflow into managed identities, approved data paths, and reviewable systems.

Punishing the most active users can push them further underground. Ignoring them can turn private experimentation into untracked infrastructure. The better response starts by finding them, understanding what they built, and separating valuable practices from unsafe implementation choices.

Broad Policy Sees Applications, Not Exposure

An application list cannot show whether a user asked a general question or gave an autonomous agent access to a critical repository.

Traditional shadow IT programs usually inventory services, classify vendors, and block prohibited domains. That model assumes each application represents a relatively stable unit of risk. Generative AI complicates the assumption because the same interface can support radically different behaviors.

One employee might use ChatGPT to rewrite a public job description. Another might paste unreleased product specifications into the same service. A third might install a coding extension with access to local files and development credentials.

The domain is identical, but the exposure changes with identity, content, permissions, and duration. A simple allowed-or-blocked decision cannot express those differences.

Akamai’s security analysis identifies five connected areas: expanding AI use, personal accounts, data exposure, browser or development extensions, and autonomous agents. The combination matters more than any single category.

Browser extensions deserve particular scrutiny because they operate close to user activity. Depending on their permissions, extensions can read page content, observe input, interact with cloud applications, or send information to external services. Employees can install them without treating the action like a software deployment.

Integrated development environment extensions present a similar problem for engineers. An AI coding assistant might see source files, configuration material, error logs, or nearby secrets. Even when the core service is approved, a particular extension, account type, or configuration can fall outside corporate controls.

Agents raise the stakes again. An AI agent is software that uses a model to pursue a goal through tools with limited human intervention. It can search files, call APIs, modify records, or trigger other applications, depending on the permissions it receives.

A chatbot normally returns text for a person to evaluate. An agent can act. That shift converts inaccurate output, manipulated instructions, or excessive permissions into operational consequences.

An employee experimenting with an agent might connect a personal token, grant broad repository access, or run the system from an unmanaged device. Security teams may not know the agent exists because it appears as ordinary browser, API, or local development activity.

The risk also persists beyond the original conversation. A prompt can disappear from attention after a browser tab closes. An agent can remain scheduled, retain credentials, or continue operating through integrations.

Netskope identified this widening surface in its 2025 shadow AI research. It found that 60% of observed enterprise users still accessed personal generative AI applications in May 2025. The company also tracked custom agents, cloud AI platforms, and on-premises tools as emerging forms of shadow AI.

Netskope reported that the average organization in its dataset used seven software-as-a-service generative AI applications, up from 5.6 three months earlier. It was also tracking more than 1,550 distinct generative AI applications. Those numbers illustrate why maintaining a complete blocklist becomes difficult.

However, replacing a blocklist with surveillance of every prompt would create its own problems. Employee privacy, labor rules, data minimization, and trust remain relevant. More visibility is not automatically better governance if the collection lacks a clear purpose or appropriate safeguards.

The goal should be proportionate control. Organizations can begin with metadata such as identity type, application category, upload events, extension permissions, tool connections, and unusual activity levels. They can apply deeper inspection only where law, policy, and risk justify it.

This model resembles established zero-trust principles. Access depends on identity, device, resource, and context rather than location alone. AI governance should evaluate each interaction using a similar combination of signals.

A managed AI service does not make every action safe. An unapproved service does not make every action equally dangerous. The meaningful question is what the user, model, and connected tools can reach together.

That is why broad policy misses the central concentration problem. It governs the name on the application while the actual exposure accumulates around particular identities and workflows.

Concentrated Control Creates Its Own Risks

Targeted governance is more precise than blanket restriction, but organizations should not mistake usage volume for proof of misconduct.

Akamai’s findings support closer attention to power users. They do not establish that the top 5% caused most confirmed incidents, leaked the most sensitive records, or acted irresponsibly. High activity is a risk indicator, not an incident verdict.

This limitation matters. The telemetry describes conversations, identities, and usage patterns. It cannot reveal the full business purpose behind every interaction. A security analyst testing AI controls can resemble an unsafe user when measured only by conversation volume.

Organizations should therefore avoid turning the 5% figure into an automatic enforcement category. Intensive activity should trigger contextual review. It should not justify immediate account suspension, invasive monitoring, or disciplinary action without additional evidence.

The dataset also reflects Akamai and LayerX visibility. It should not be treated as a universal census of every industry, geography, device, and AI deployment. Companies need their own baseline before assigning thresholds or estimating exposure.

A second concern involves false confidence in enterprise accounts. Managed identity improves auditing, access control, and contractual protection. It does not prevent an employee from entering restricted information, accepting a hallucinated answer, or granting excessive permissions to a connected application.

Corporate versions of Gemini, Copilot, ChatGPT, or Claude can reduce certain risks through administrative controls. They cannot replace data classification, authorization design, workflow review, or human judgment.

A third concern is organizational trust. Employees who believe every AI interaction will be read by management may hide use, move to personal devices, or avoid approved tools. That response reduces the visibility a targeted program was supposed to create.

Companies need transparent monitoring rules. Users should understand which signals are collected, why they matter, who can review them, and how long they remain available. Security teams should separate risk detection from performance monitoring wherever possible.

The NIST AI profile offers a useful counterweight to narrow enforcement. It organizes risk work across governance, mapping, measurement, and management. That lifecycle approach treats controls as an ongoing system rather than a single employee policy.

Governance defines ownership, acceptable use, reporting paths, and accountability. Mapping identifies the business context, affected people, data, and dependencies. Measurement tests whether risks and controls can be observed. Management prioritizes responses according to impact and tolerance.

Applied to shadow AI power users, this sequence prevents a premature jump from detection to punishment. A company first identifies intensive workflows, maps their business purpose and data access, measures concrete exposure, and then chooses a proportionate control.

The response might involve migrating a personal account to a managed one. It might remove an excessive extension permission, replace a personal API key, limit an agent’s tools, or approve a better enterprise service.

Some workflows should stop entirely. An unreviewed agent changing financial records or processing regulated health data presents a different level of exposure from a drafting assistant using public material. Concentration analysis helps find that difference, but human review still determines its meaning.

Targeted governance must also account for privileged users. Engineers, administrators, researchers, executives, legal teams, and financial staff often handle more consequential information than their peers. Conversation volume and access sensitivity should be evaluated together.

A user with 150 low-risk conversations about public marketing language might present less exposure than someone who uploaded one confidential acquisition document. Volume is useful because it identifies embedded behavior. Content and permission context determine potential impact.

The skeptical conclusion is straightforward: Akamai shadow AI telemetry improves prioritization, but it does not provide a complete risk score. Organizations still need local evidence, transparent rules, and careful review.

What Security Teams Should Watch Next

The next phase of shadow AI governance will be measured by managed identity adoption, agent permissions, and validated reductions in sensitive exposure.

The first signal is the share of work-related AI activity moving from personal identities to corporate-managed accounts. This is more meaningful than counting purchased licenses. A company can own thousands of enterprise seats while employees continue using familiar personal accounts.

Security leaders should measure account migration by team and activity level. Progress among casual users is useful, but movement among the most intensive users matters most. A falling personal-account share within that group would support Akamai’s concentration thesis and show that targeted intervention works.

The metric needs careful interpretation. A managed login does not prove safe behavior. It does provide a stronger foundation for access control, retention settings, auditability, and incident response.

The second signal is the growth of agents and extensions with business-system access. Organizations should inventory what those tools can read, change, and transmit. They should also identify which identities supplied the credentials.

Permissions matter more than the number of agents. Ten agents limited to public information may create less exposure than one system holding write access to production data. Reviews should prioritize sensitive resources, persistent credentials, external data transfer, and actions that lack human confirmation.

Any reduction in excessive permissions would strengthen the case for focused governance. Rapid growth in undiscovered agents would weaken claims that current AI policies provide meaningful coverage.

The third signal is whether organizations can show fewer sensitive-data events without suppressing useful adoption. This is the hardest measure because it requires security and productivity teams to evaluate outcomes together.

A successful program should reduce restricted uploads, unmanaged credentials, and unapproved integrations. It should also keep approved usage accessible enough that employees do not shift to invisible channels.

Metrics based only on blocked requests invite the wrong incentives. More blocks can indicate stronger enforcement, growing unsafe demand, or poor approved alternatives. Teams need to compare prevention events with account migration, approved workflow adoption, user feedback, and confirmed incidents.

The Google News framing will remain useful only if organizations test it against their own environments. The precise 5% threshold can change, but concentration should appear in internal telemetry if the underlying pattern holds.

Security teams can begin with several practical questions. Which employees use AI most often? Which of them rely on personal identities? Who uploads files, installs extensions, or connects agents to internal systems? Which approved tools fail to meet their needs?

Those questions create a better starting point than asking whether all AI should be allowed or prohibited. They connect governance to actual work and expose where convenience is bypassing control.

Companies should also establish an escalation path that does not begin with discipline. When security finds an advanced unofficial workflow, the first review should identify its business value, data inputs, permissions, and alternatives. This creates an opportunity to preserve useful practices while removing unnecessary exposure.

Where the risk is immediate, such as an agent with broad production access, containment should come first. Where exposure is lower, migration and coaching can deliver better long-term compliance than a blanket ban.

Leaders should ask one final question before declaring the problem controlled: can the organization describe its highest-intensity AI workflows without relying on a survey? If the answer is no, the policy is operating ahead of the evidence.

Google News brought attention to an important reversal. Shadow AI is widespread, but its most serious exposure is not necessarily spread evenly. The people using AI most deeply are where productivity, data, identity, and autonomous access converge.

That makes the next action clear. Find the concentrated workflows, move them under managed identity, review their permissions, and measure whether sensitive exposure falls. Broad rules can establish boundaries, but only evidence from real usage shows where protection belongs.