By Autonomous AI agents are operating across corporate networks at speeds and scales that traditional security controls cannot match. Browser extensions are silently exfiltrating sensitive and regulated data. Model context protocol servers are blurring the boundary between data ingestion and code execution, opening new prompt injection paths that require no direct system access. And the rate at which new vulnerabilities are being discovered has now outpaced the rate at which most organizations can patch them.
In this interview on TFiR, Steve Winterfeld, Advisory CISO at Akamai, breaks down the most critical findings from Akamai’s latest State of the Internet report, covering the agentic AI threat landscape, MCP governance gaps, browser extension risk, Zero Trust evolution, and the patch velocity problem security teams face today.
Guest: Steve Winterfeld, Advisory CISO at Akamai
Show: TFiR
Here is what every security architect and CISO needs to know.
Technical Deep Dive
Q: What is Akamai’s State of the Internet report and what data does it draw from?
Steve Winterfeld, Advisory CISO at Akamai, explains that the State of the Internet report is a research publication focused primarily on cybersecurity, drawing on data from Akamai’s visibility into 20 to 25 percent of global Internet traffic on any given day. The report covers threat trends, cloud best practices, and actionable mitigations across multiple industries and regions. Each edition is grounded in Akamai’s direct experience protecting customers across sectors, making the findings operationally relevant rather than theoretical.
“On any given day, up to 20% to 25% of Internet traffic goes through Akamai, and across different industries and regions, we see what threat trends are emerging.”
Steve Winterfeld, Advisory CISO, Akamai
Q: What are the most significant new threat findings in Akamai’s latest State of the Internet report?
Winterfeld identifies two high-level categories: where guardrails are being placed around AI, and the asymmetric velocity gap between how fast threats emerge and how fast organizations can respond. The report highlights browser extensions as an underprotected AI vector, model context protocol as a new internal attack surface, brand and reputation risk in AI-generated content, and the accelerating patch cycle challenge driven by frontier model deployments. Each area combines a structural vulnerability with a detection and governance gap that most security programs have not yet closed.
“There’s this huge gap in protection if you’re not treating the browser as an AI vector—knowing what’s going out and what kind of data is going through it.”
Steve Winterfeld, Advisory CISO, Akamai
Q: How are browser extensions creating an AI security risk in enterprise environments?
Winterfeld reports that 99 percent of employees run at least one browser extension for AI, and more than 40 percent have installed AI-powered extensions. Critically, 64 percent of those extensions changed permissions within a year, 6 percent of employees are passing sensitive or regulated data through them, and 47 percent are using personal accounts for AI research activities. This combination of behavioral and technical exposure means the browser has become a primary AI data exfiltration vector that most security programs are not monitoring or governing.
“47% of those using their personal accounts to conduct this kind of research. There’s a huge gap in protection if you’re not treating the browser as an AI vector.”
Steve Winterfeld, Advisory CISO, Akamai
Q: What is model context protocol (MCP) and why does it create a security vulnerability?
Model context protocol is an internal function that acts as a structured interface between APIs and AI models, making machine-to-machine communication more efficient. Winterfeld describes it as blurring the line between data and code execution: third-party servers can attack large language model logic through prompt injection without requiring direct system access or approval. The risk compounds because most organizations do not yet have a complete inventory of where MCP is deployed internally, what decisions it is authorized to make, or when its configuration changes.
“It’s kind of blurred the lines between data and code execution, and third-party servers can attack the logic of a large language model through prompt injection without approval.”
Steve Winterfeld, Advisory CISO, Akamai
Q: What specific MCP attack types should security teams know about?
Winterfeld buckets MCP vulnerabilities into two categories. The first is active attack types: tool poisoning, context spoofing, and prompt state manipulation, all documented in the OWASP Top 10 for MCPs, currently in beta. The second is configuration failures: allowing scope creep, granting agents unrestricted access to sensitive tools, leaking session tokens, and operating without a human in the loop for state changes. Neither category requires an attacker to gain traditional system access, making them difficult to catch with conventional security controls.
“Are you allowing scope creep, or are you allowing agents unrivaled access to sensitive tools? Do you not have a human in the loop for status changes? These are the things you really need to think through with MCP.”
Steve Winterfeld, Advisory CISO, Akamai
Q: How should security teams govern browser-based AI usage across the enterprise?
Winterfeld outlines a two-layer approach: documentation and technical enforcement. On the documentation side, teams need clear policies defining what AI tools employees may use, what data categories are prohibited, and whether public AI or private AI instances with retrieval-augmented generation are permitted. On the enforcement side, teams need technical controls to audit and manage extensions, validate permissions, and monitor what data is transiting through browser-based AI channels. Akamai’s monitoring capability for customers is cited as the operational model for what a complete browser security program looks like.
“First you need that documentation side, what have you said people are allowed to do, and then you need that technical enforcement, how are you validating and enforcing that kind of thing.”
Steve Winterfeld, Advisory CISO, Akamai
Q: What is the patch velocity gap and why can’t security teams keep up with AI-driven vulnerability discovery?
Winterfeld explains that frontier AI models have dramatically increased both the speed and complexity of vulnerability discovery, creating a gap where new vulnerabilities are found faster than organizations can patch them. The response requires layered compensating controls: web application firewalls, AI firewalls, runtime protection, and internal segmentation to minimize blast radius when a vulnerability is exploited before a patch is applied. Tools like patch diff AI are cited as examples of using AI offensively within the security operations center to accelerate patch comprehension and prioritization.
“If we’re not able to patch at the same speed vulnerabilities are being found, what mitigations do you have that if you have a vulnerability, it’s still going to be either quickly discovered or mitigated before it can be executed?”
Steve Winterfeld, Advisory CISO, Akamai
Q: What are the most actionable steps security leaders can take now based on these findings?
Winterfeld’s recommendations span five areas. For overall program maturity: maintain Zero Trust, edge protection across AI and classic web interfaces, and a holistic AI workflow view covering employees, internal use, and external-facing systems. For MCP: isolate servers, pin versions, audit code, monitor traffic, and require human-in-the-loop controls. For browsers: control extensions, manage permissions, and track sessions. For brand protection: monitor AI crawlers, citation accuracy, and sentiment. For patching: apply runtime and edge protections as compensating controls, and use AI tools within the SOC to close the velocity gap.
“Success really is around maintaining a mature, fundamentally sound program. Are you using things like Zero Trust? Do you have edge protection in a way that thinks through everything that’s out on the edge?”
Steve Winterfeld, Advisory CISO, Akamai
Q: How does brand protection fit into a CISO’s security mandate in an AI-driven environment?
Winterfeld describes an evolution in the CISO’s scope from malware to fraud to brand, framing brand protection as fundamentally a revenue protection problem. In finance, the asset is trust; in commerce, it is customer loyalty. In the AI context, this extends to monitoring where the company is being cited by AI systems, whether those citations are accurate, and what the sentiment is. He frames this as a cross-functional problem requiring security, marketing, and IT to operate as a coordinated team rather than in silos.
“Within AI, where are we being cited? Is it accurate? What is the sentiment? Is it positive, neutral, or negative? And how are we monitoring that bot traffic?”
Steve Winterfeld, Advisory CISO, Akamai
Q: Will agentic AI force a fundamental redesign of Zero Trust architecture?
Winterfeld is direct: the shift is not a question of if but where. The core Zero Trust principle of trust no one without validation remains intact, but what must be validated has changed fundamentally. Security teams previously validated humans; they must now validate autonomous agents, manage synthetic identities, and determine trust parameters for AI-to-AI interactions. As an example, he notes that when an AI platform makes a purchase on a user’s behalf, the receiving system sees only the AI platform, not the human, making synthetic identity validation a live operational problem today.
“Zero Trust is going to fundamentally stay the same as far as the principle of trust no one without validation. The complexity of what we have to validate and how we validate it is incredibly different.”
Steve Winterfeld, Advisory CISO, Akamai
Q: What did Akamai’s involvement in the Mythos project reveal about frontier model vulnerabilities?
Winterfeld references Akamai’s participation in the Mythos project with Glasswing as a source of lessons learned about how frontier models surface vulnerabilities at scale. The key finding is that discovery rates now exceed remediation capacity, reinforcing the need for compensating controls at the edge and at runtime rather than relying on patch cycles alone. The experience informs Akamai’s broader guidance that organizations must assume vulnerabilities will exist in production and design their protection layers accordingly.
“If we’re discovering hundreds or thousands of new vulnerabilities, we’re not going to be able to keep up with that, and so you kind of need that protection around patching.”
Steve Winterfeld, Advisory CISO, Akamai
Q: How should security leaders think about AI governance and privacy beyond regulatory compliance?
Winterfeld highlights a contribution to the State of the Internet report from Akamai’s privacy officer, which takes a deliberate step back from prescriptive compliance frameworks like GDPR or state privacy laws. The focus instead is on building a mental model for how to think about trust in AI systems: what trusted means, how trust is established, and what questions an organization must ask itself to govern AI programs over the long term. This framing is designed to outlast specific regulatory requirements and apply across jurisdictions and AI deployment models.
“Instead of saying follow GDPR and follow this California law, it’s really step back and think about how are we going to approach this in the long run.”
Steve Winterfeld, Advisory CISO, Akamai
Resources & Documentation
- Akamai State of the Internet Report, Akamai’s primary threat intelligence publication covering cybersecurity trends across industries and regions
- OWASP Top 10 for LLM Applications, reference framework for MCP and large language model security vulnerabilities including tool poisoning and prompt injection
***
👇 Click to Read Full Raw Transcript
Swapnil Bhartiya: Today, whenever we talk about technology, the first thing that we talk about is AI and enterprise area. Autonomous AI agents are operating across corporate networks at incredible speed and scale. These non human entities are creating entirely new attack surfaces that bypass traditional defenses. Now they are exposed protocols and vulnerable browser extensions that are suddenly exposing these enterprise systems to new attacks. When it comes to security teams, they’re scrambling to understand and contain this new agentic threat landscape. Akamai releases its State of Internet report and they just came out with their latest report. And today we have with us once again Steve Winterfeld, advisory CISO at Akamai to break it all down and expand and explain what these findings mean for cyber security leaders. Steve, it’s great to have you back on the show.
Steve Winterfeld: Thank you. It’s great to be back here. I always enjoy these.
Swapnil Bhartiya: It’s my pleasure. I will start with basically, I mean, we cover this report on regular basis, but once again, I would like to just inform our viewers what is the core mission behind these State of the Internet reports.
Steve Winterfeld: So really it is a research report that typically focuses primarily on cybersecurity. And so what we’re trying to do is any given day, up to 20 to 25% of the Internet traffic is going across Akamai. And so we see, you know, through different industries in different regions, what threat trends are coming out there, what new cloud best practices are coming out there. And we want to share these in a way that are actionable as well as best practices and mitigation that people can do for those. So really it is based on our and our customers experiences protecting so many different industries.
Swapnil Bhartiya: Thank you. And if I’m not wrong, this new report focuses, as you also rightly mentioned, heavily on AI and the agentic threat landscape. You have been working on this report for a long time. Talk a bit about what were the most surprising or interesting findings that emerged from this data. Where you looked at it, where you saw some patterns, at the same time you saw something new that was not there in the previous reports.
Steve Winterfeld: So I mean, this is such a fast moving topic and I don’t know that we haven’t had a SOTI that hasn’t touched on it somewhat, but we wanted to step back and focus on it. And so really, I think at the highest level there are two kind of categories. One, where are we putting guardrails around this AI dilemma? And two, the asymmetric velocity or gap in where threats are coming, how they’re coming out, the patch challenge and all those kind of things. So going to start off with an area where we focused on which is this new shadow threat or this new edge. And that is really around browsers. Most of us are interacting with AI through a browser. 99% of employees run at least one browser extension for AI. More than 40% have installed AI powered extensions. 64% of those the users have had the extension change permissions within a year. Six percent of those are employees are having conversations, including sensitive data, be it regulated data or proprietary data. And 47% of those using their personal accounts to do this kind of research. And so as we look at all these kind of facts, we just kind of see that there’s this huge gap in protection if you’re not treating the browser as an AI vector, you know, knowing what’s going out, knowing what kind of data is going through it. So that would be the first place we’re, we’re seeing as we help people protect against it, some real threats coming out in there. The next is around a component of the AI infrastructure. So we’ve talked a lot about APIs, that application interface that allows machine to machine learning. We’ve talked in the past about agents or traditional AI is giving you answers. Agents are making decisions. Well, there’s this internal function called a model context protocol. Think about that as kind of a USB between the API and the AI. It’s just allowing this format and structure to make talking much easier. Well, it’s kind of blurred the lines between data and code execution and third party servers can attack a large language model logic through prompt injection without approval. So again, this is a component of do you know where you have mcps? Do you know what decisions they’re being allowed to make? Are you aware when they’re being changed? And this is going to be a huge part in your governance of AI. And so if you aren’t looking at that, that’s a strong area and we talk about that extensively, how you can protect against that within the report itself. Another thing we’ve talked about, and this is interesting, you know we’ve talked in the past about brand protection and it’s, you know, the CISO used to worry about malware, then they worried about fraud, then they’re worried about protecting the brand. And so this is all about protecting revenue. And if you’re in finance it’s about trusting, protecting trust. If you’re in commerce, it’s about protecting loyalty. And so as we think through this, in this zero click economy, what is our reputation, not our brand as much as a reputation. And within AI, you know, where are we being cited Is it accurate? What is the sentiment? Is it positive, neutral or negative? And how are we monitoring that bot traffic? And so this is again, security is a team sport. And as we look at reputation, we’re trying to say, how do I work with marketing, how do I work with it, how do I work with security to make a team, to make sure we understand this. And I talked about this at the beginning, finally, is that patch cycle frontier models have just really increased the speed and complexity and, and we can’t keep up. Ultimately though, I will tell you that the basics still apply today.
Swapnil Bhartiya: We kind of live in a world where MCP or model contact protocol is kind of becoming a critical part of the whole enterprise AI workflow because that exposes a lot of tools, a lot of services through them very easily. But they also can become once again exposure for security. Can you talk about what exactly is MCP exposure and how does it connect to the AI threats that you have tracked in previous reports?
Steve Winterfeld: Yeah, and I mentioned this briefly up top and it’s one of the right ones to drill into because ultimately here, you know, you’re going to get different capabilities that you’re going to bring in. And so one of the things I try to inventory is, you know, where my employees are using AI, where I have AI externally facing customers, but that middle ground of where is my AI software, building materials, where is my inventory, how do I know where I’m using AI internally and where I’m using AI internally, is it using mcp? And so, you know, this, this internal inventory, both where I’m developing it, what tools I’ve bought that have it, and then if I bought a tool in, in marketing that’s using it, is it going to make a decision within marketing or is it going to make a threat vector within that marketing capability that I need to be aware of? And so, you know, understanding where these wrappers around more efficient API interaction with AI models is important. And I bucket into two kind of things. One is what are the vulnerabilities? Tool poisoning. And again, this isn’t something they need to get access, it’s something they introduce data to. Context spoofing, prompt state manipulation. And again, these are all coming out of a classic OWASP mcp. So if you want to go understand that if you go up to OWASP top 10 for MCPS, it’s in beta right now, but it’s still a great resource. The other side of this is how you’re configuring things. You know, are you allowing scope creep or are you allowing agents unrivaled access to sensitive tools? Or are you leaking session tokens? Do you not have a human in the loop for status change? So these are the kind of things that you need to really think through with mcp.
Swapnil Bhartiya: Excellent. Thank you. Now, let’s also talk about, as you earlier mentioned, that we live our whole world inside a browser. We’re also seeing browser based AI attention emerge as a critical attack surface. How should security teams be thinking about this specific vulnerability?
Steve Winterfeld: So this is another one that’s kind of a blend. You know, first of all, what are my rules? What, what have I said employees can go use? What am I allowing them to do? How have I educated them on what not to put in there? What sensitive data? Am I using a public AI? Am I using a public AI with rag that’s pulling my information to have a private AI instance? And so these are things that once you kind of understand these, then I know what the danger of my browser is to how it’s connecting. The next is I want to kind of keep track and govern, you know, what extensions do people have? Are they safe? Are they being changed? Am I auditing them? So all of these are just kind of this whole new threat vector that you need to have as part of your program. You know, first you need that documentation side. What have you said people are allowed to do? And then you need that technical enforcement. How are you validating and enforcing that kind of thing? And so that’s often where you know it. I would think you would go and get a technical control, get something. And this is why we have data on it, because we’re monitoring this for customers that’s managing this for you. So your program is complete on that side.
Swapnil Bhartiya: Excellent. Thank you. Now, in addition to this report, you folks of course do a lot of work in this space. Talk a bit of what else is there which may align with the findings of this report or the improvement that you see in the project that Akamai is internally working on to also help customers secure their posture.
Steve Winterfeld: You know, a couple areas that we touch on. One is Akamai was part of the Mythos project, glasswing and how frontier models are doing. And so we talk a little about our lessons learned there. And you know, if we’re discovering hundreds or thousands or whatever the number is of new vulnerabilities, we’re not going to be able to keep up with that. And so you kind of need that protection around patching. If we’re not able to patch at the same speed, vulnerabilities are being found as we think about how to do that patching. What mitigations do you have that if you have a vulnerability, it’s still going to be either quickly discovered or mitigated before it can be executed? That’s on your classic web application firewalls, it’s on your AI firewalls. It’s on so many different applications. And then internally, what are you doing to segment those, to minimize when it does get through what that impact is? Well, we talk a little bit about some of the lessons learned throughout that. Another one that I found fascinating is our, you know, our, one of our chief technologists was the one that wrote about mcps, but we also had our privacy officer right in and not so much about the specifics of how to execute privacy, but how to think about the challenge of AI, how to think about what is trusted, how is it trusted? What are the right questions to ask yourself to manage this program? And I think that’s also a good kind of an academic thought leadership way to go about it. Instead of saying follow GDPR and follow this California law, it’s really step back and think about how are we going to approach this in the long run.
Swapnil Bhartiya: One of the most exciting things, which I look forward to talk to you whenever we talk about this report, is that how these reports, how these insights can actually help enterprise leaders to not only chalk out the action plan, but also take some actions right now to, to protect their organizations based on these insights, these reports.
Steve Winterfeld: I will say at the beginning, it’s such a fast moving issue and so success really is around maintaining a mature, fundamentally sound program. Are you using things like zero trust? Do you have edge protection in a way that thinks through everything that’s out on the edge? Your AI interface, your classic web interface, your employee interface. Where are you building AI workflows so AI is holistically looked at? Or are you going to build a specific AI program? And again, if you do that program, I still think those three pillars are important employees, internal use and external facing. But there are two different approaches and how are you going to go about that for MCP security again, isolating servers, pinning versions down, auditing code, monitoring traffic, human in the loop. We talk about those very tactical solutions in the report. For browser security, again, it’s controlling extensions, making sure you’re managing permissions, tracking sessions and AI interdictions for things like brand protection. Are you monitoring AI crawlers and thinking through citations in accuracy and brand representation? Patch speed, again, you know it is. It’s at runtime, it’s on the edge it’s while you’re patching, it’s validation. There’s so much there that’s constantly moving. You know, going back to those basics, are you doing discovery again? AI, API, identities. We’re saying identity is the new edge. I think that’s true. Are you prioritizing appropriately? Not all AI systems are the same. Which ones are really going to cause a financial impact? How are you governing these? Is it part of your GRC program? Are you validating and requiring some kind of audit there within AI? You know, use AI as well. Graphic neural networks are ways to use a. On the defensive side, tools like patch different AI, patch diff AI helps with, you know, patch comprehension, timeline. So think about again where you can use AI within your security operations center. And it. That was a lot. But this again is such a dynamic topic.
Swapnil Bhartiya: When we look at these agentic threats, do you also see there will be a fundamental shift in how we approach Zero Trust architecture or it is only going to augment complement what we have built or there’s going to be a major shift there, I think is where the shift is going to happen, not is there going to be a shift. You know, sometime the shift is in architecture, sometimes the shift is in speed. I think with some of the fundamental principles and practices like Zero Trust, I think we’re now being asked to trust these agentic agents. And so that is kind of a shift in what we’re talking about. We used to talk about trusting the humans. Now I have to understand and figure out how I want to trust these autonomous agents, how I want to manage them, how I want to audit them, when I want to trust them, how I want to trust a synthetic customer, you know, is again, if I’m coming out of an AI platform to go to Nordstrom to buy some shoes. Nordstrom doesn’t know it’s Steve. They just see whatever AI platform I was on coming in to buy it. And again, this is. Is trusting a synthetic identity. And so I think Zero trust is going to fundamentally stay the same as far as the principle of trust no one without validation. I think the complexity of what we have to validate and how we validate it is incredibly different.
Steve Winterfeld: Thanks everybody.
