By Enterprise security teams have hardened the network perimeter, the endpoint, and the API layer. The browser is the gap. AI interactions happening inside the browser, through extensions that silently change permissions and pass data through personal accounts, are outside the visibility of almost every enterprise security stack operating today.
In this interview on TFiR, Steve Winterfeld, Advisory CISO at Akamai, breaks down the most critical findings from Akamai’s latest State of the Internet report, which focuses entirely on the AI and agentic threat landscape, covering browser extension risk, Model Context Protocol exposure, agentic AI governance failures, AI reputation risk, and the accelerating patch cycle problem.
Guest: Steve Winterfeld, Advisory CISO at Akamai
Show: TFiR
Here is what every security architect and enterprise CISO needs to know.
Technical Deep Dive
Q: Are AI browser extensions a security risk for enterprise data?
Steve Winterfeld, Advisory CISO at Akamai, says the browser has become the primary AI attack vector that most security teams are not monitoring. Akamai’s State of the Internet report found that 99% of employees run at least one browser extension for AI, more than 40% have installed AI-powered extensions, and 64% of those users have had the extension change permissions within a year. Six percent of employees are conducting conversations that include sensitive or regulated data, and 47% are doing this through personal accounts, creating a data pathway that enterprise DLP and monitoring tools cannot see.
“If you’re not treating the browser as an AI vector, knowing what’s going out, knowing what kind of data is going through it, there’s a huge gap in protection.”
Steve Winterfeld, Advisory CISO, Akamai
Q: What is Model Context Protocol and why is it an enterprise security concern?
Model Context Protocol (MCP) is an internal function that acts as a structured interface between the API and the AI, making machine-to-machine communication easier. Winterfeld describes it as a USB connector between the API and the AI model. The risk is that MCP blurs the boundary between data and code execution, and third-party servers can attack large language model logic through prompt injection without requiring user approval or triggering existing access controls.
“Third party servers can attack a large language model logic through prompt injection without approval. Do you know where you have MCPs, do you know what decisions they’re being allowed to make, are you aware when they’re being changed?”
Steve Winterfeld, Advisory CISO, Akamai
Q: How do agentic AI systems create governance gaps that traditional AI monitoring cannot catch?
Traditional AI systems return answers; agentic AI systems make autonomous decisions. Winterfeld draws this distinction directly when explaining the governance challenge: the question is not just what data the model can access, but what actions the agent is permitted to execute, and whether changes to those permissions are being tracked. MCP governance is a core component of controlling agentic AI behavior at the enterprise level.
“Traditional AI is giving you answers, agents are making decisions. This is going to be a huge part in your governance of AI.”
Steve Winterfeld, Advisory CISO, Akamai
Q: How does AI affect brand reputation risk and what should security teams monitor?
Winterfeld frames this as a shift from brand protection to reputation protection in a zero-click economy. When buyers and customers never reach a company’s own site because AI assistants answer queries directly, the accuracy and sentiment of AI citations become a revenue and trust issue. He says security teams need to monitor bot traffic, track where the company is being cited in AI outputs, and assess whether that sentiment is positive, neutral, or negative, treating it as a cross-functional problem involving marketing, IT, and security.
“Within AI, where are we being cited? Is it accurate, or what is the sentiment? Is it positive, neutral, or negative? Security is a team sport.”
Steve Winterfeld, Advisory CISO, Akamai
Q: Can enterprise security teams keep pace with frontier AI model patch cycles?
Winterfeld states directly that frontier model release velocity has increased the speed and complexity of patch cycles beyond what most enterprise security programs can match. The underlying assessment is that organizations cannot rely on keeping up. His conclusion is that security fundamentals remain the most reliable defense layer, even as the AI-specific threat surface continues to expand faster than patching cycles can address it.
“Frontier models have just really increased the speed and complexity and we can’t keep up. Ultimately though, the basics still apply.”
Steve Winterfeld, Advisory CISO, Akamai
Resources & Documentation
- Akamai State of the Internet Report, Akamai’s annual research report covering threat intelligence, AI attack surfaces, and enterprise security trends
- Akamai, enterprise security and cloud delivery platform, including API security, bot management, and zero trust access
***
👇 Click to Read Full Raw Transcript
Swapnil Bhartiya: If I’m not wrong, this new report focuses as you also rightly mentioned, heavily on AI and the agentic threat landscape. You have been working on this report for a long time. Talk a bit about what were the most surprising or interesting findings that emerged from this data, where you looked at it, where you saw some patterns, at the same time you saw something new that was not there in the previous reports.
Steve Winterfeld: So I mean this is such a fast moving talk and I don’t know that we haven’t had a soti that hasn’t touched on it somewhat, but we wanted to step back and focus on it. And so really I think at the highest level there are two kind of categories. One, where are we putting guardrails around this AI dilemma? And two, the asymmetric velocity or gap in where threats are coming, how they’re coming out, the patch challenge and all those kind of things. So going to start off with an area where we focused on which is this new shadow threat or this new edge and that is really around browsers. Most of us are interacting with AI through a browser. 99% of employees run at least one browser extension for AI. More than 40% have installed AI powered extensions. 64% of those the users have had the extension change permissions within a year. Six percent of those are employees are having conversations including sensitive data, be it regulated data or proprietary data. And 47% of those using their personal accounts to do this kind of research. And so as we look at all these kind of facts, we just kind of see that there’s this huge gap in protection if you’re not treating the browser as an AI vector, you know, knowing what’s going out, knowing what kind of data is going through it. So that would be the first place we’re seeing as we help people protect against it, some real threats coming out in there. The next is around, you know, a component of the AI infrastructure. So we’ve talked a lot about APIs that that application interface that allows machine to machine learning. We’ve talked in the past about agents or traditional AI is giving you answers, agents are making decisions. Well there’s just this internal function called a model context protocol. And think about that as kind of a USB between the API and the AI. It’s just allowing this format and structure to make talking much easier. Well it’s kind of blurred the lines between data and code execution and third party servers can attack a large language model logic through prompt injection without approval. So again this is a component of do you know where you have mcps, do you know what decisions they’re being allowed to make? Are you aware when they’re being changed? And this is going to be a huge part in your governance of AI. And so if you aren’t looking at that, that’s a strong area and we talk about that extensively, how you can protect against that within the report itself. Another thing we’ve talked about, and this is interesting, you know, we’ve talked in the past about brand protection and it’s the CISO used to worry about malware, then they worried about fraud, then they worried about protecting the brand. And so this is all about protecting revenue. And if you’re in finance, it’s about trusting, protecting trust. If you’re in commerce, it’s about protecting loyalty. And so as we think through this, in this zero click economy, what is our reputation? Not our brand as much as our reputation. And within AI, where are we being cited? Is it accurate or what is the sentiment? Is it positive, neutral or negative? And how are we monitoring that bot traffic? And so this is again, security is a team sport. And as we look at reputation, we’re trying to say how do I work with marketing, how do I work with it, how do I work with security to make a team, to make sure we understand this, and I talked about this at the beginning, finally, is that that patch cycle frontier models have just really increased the speed and complexity and we can’t keep up. Ultimately though, I will tell you that the basics still apply.
