By Every application in your stack is now part of the AI ecosystem, including the ones your team never touched with AI tooling. A RAG pipeline pointed at a legacy ERP changes nothing about that system’s code and everything about its risk profile. Platform and security teams are operating without visibility into workflows they did not approve and code they did not write.
In this interview on TFiR, Danielle Cook, Director of Product Marketing at Akamai, covers why organizations can no longer draw a line between AI and non-AI applications, what shadow AI means for governance, and where platform teams are losing ground on monitoring.
Guest: Danielle Cook, Director of Product Marketing at Akamai
Show: TFiR
Here is what every platform engineer and security team needs to know.
Technical Deep Dive
Q: Is there still a meaningful difference between AI applications and non-AI applications?
Danielle Cook, Director of Product Marketing at Akamai, argues the distinction has disappeared entirely. Applications are either connecting to AI through APIs, feeding data into models, or supporting something that does. The category of “non-AI application” no longer holds as a practical boundary for governance or security teams.
“You don’t have to build AI to become part of this ecosystem.”
Danielle Cook, Director of Product Marketing, Akamai
Q: How does a legacy system end up inside an AI workflow without any code change?
Cook uses the example of a legacy ERP system: the moment a RAG pipeline is pointed at it, that system becomes part of an AI workflow. Nothing about the application itself changes. Its data is now feeding an AI process, which alters its risk and compliance posture whether the owning team is aware of it or not.
“Even if you’re thinking of a legacy ERP system, that’s becoming part of an AI workflow somewhere, as soon as somebody puts a RAG pipeline pointed at it.”
Danielle Cook, Director of Product Marketing, Akamai
Q: How much visibility do organizations actually have into AI touching their code or systems?
Cook says visibility depends heavily on organizational maturity. Regulated industries can lock things down more effectively, but most organizations should assume AI is being used across their codebases and workflows whether it is officially approved or not. The monitoring gap is real and widening as developer-generated code outpaces review capacity.
“If you are having any code contributed, any workflows, you have to assume people are using AI.”
Danielle Cook, Director of Product Marketing, Akamai
Q: What is shadow AI and why is it becoming a platform engineering problem?
Shadow AI refers to developers using AI tooling, models, or workflows without organizational approval or visibility. Cook expects the term to become increasingly common as adoption outpaces policy. Platform teams are already struggling to monitor code volume generated by AI-assisted development, and that gap will grow without deliberate governance investment.
“We’re going to hear shadow AI more and more. People are just using it, whether it’s approved or not.”
Danielle Cook, Director of Product Marketing, Akamai
Q: What should organizations focus on instead of asking which applications are AI applications?
Cook reframes the question: rather than trying to categorize applications as AI or non-AI, organizations should ask how each application is participating in the broader AI ecosystem. That framing shifts governance from a classification exercise to a flow and dependency mapping exercise, which is more accurate and more actionable for security and platform teams.
“Instead of asking which of my applications is an AI application, we need to start focusing on how are my applications participating in the whole AI ecosystem.”
Danielle Cook, Director of Product Marketing, Akamai
Resources & Documentation
- Akamai, cloud and security platform covering API security, application protection, and AI traffic visibility
***
👇 Click to Read Full Raw Transcript
Swapnil Bhartiya: A few years ago, you could draw a clean line between AI applications and everything else. Today, every line of code goes through AI in some form. So is that distinction still holds true? Is it still meaningful? And what about those companies that don’t think of themselves as AI companies? What does it mean technically for those companies?
Danielle Cook: So I don’t think you can really opt out of the AI ecosystem anymore. You’re in it. So you know, where we used to be able to say, you know, there are two buckets of applications, there’s an AI bucket and a non AI like that line has disappeared. So all applications contain AI. They’re either connecting to AI through APIs, they’re feeding data into AI to help train models, or they’re supporting something that does. So even if you’re thinking of a legacy ERP system, for example, that’s becoming part of an AI workflow somewhere, as soon as somebody puts a rag pipeline pointed at it, nothing about that application changed. But it is in the AI ecosystem. I think we need to start thinking about, instead of asking which of my applications is an AI application, we need to start focusing on how are my applications participating in the whole AI ecosystem. Because you don’t have to build AI to become part of this ecosystem.
Swapnil Bhartiya: How much visibility do organizations actually have into whether their code is touching AI at all?
Danielle Cook: It depends on the maturity of the organization. Of course, to your point, regulated industries, they’re able to lock things down. But if you are having, you know, any, any code contributed, any workflows, you have to assume people are using AI. I think we’re going to hear shadow AI more and more and more people are just using it, whether it’s approved or not. So it’s, it’s going to be increasingly important to get that visibility and understand where, where your entire team is. And you know, I know platform teams are struggling with like, how do we monitor this? Developers are generating so much code and how do you check it? It’s a real struggle across the.
