It's no secret that artificial intelligence is transforming cybersecurity by accelerating the speed and rate of attacks, expanding enterprise attack surfaces and giving autonomous systems access to sensitive resources, whether or not they need it.
According to Akamai's latest State of the Internet report, "Speed, Scale, and Nonhuman Identity: The Agentic Threat Landscape," organizations must reassess the readiness of defenses that were built around human response times and conventional security boundaries.
AI-powered attacks can exploit vulnerabilities more quickly than security teams can patch them. Meanwhile, AI agents, browser extensions and interconnected applications can all introduce new opportunities for data theft, unauthorized access and manipulation.
To further explore these topics, please register here for our Nov. 19 webinar.
Why legacy cybersecurity tools and methods are inadequate in the age of AI
Akamai's participation in Anthropic's Project Glasswing has demonstrated how frontier AI models like Claude Mythos Preview can accelerate vulnerability discovery and exploit chaining, often reducing weeks of research and testing to a matter of hours.
"Defense can no longer depend on reactive patching alone," notes the report. "It requires real-time, adaptive enforcement at every layer."
The report also identifies APIs as a rapidly expanding attack surface. It says that average daily API attacks per organization increased 113% between 2024 and 2025, while 87% of surveyed organizations experienced API-related security incidents in 2025.
Meanwhile, employee AI adoption has created additional exposure. More than 40% of enterprise users have installed AI-powered browser extensions, and Akamai's analysis found sensitive information in more than 6% of chatbot conversations.
The widespread adoption of the Model Context Protocol (MCP) framework introduces another danger. Malicious MCP servers can manipulate AI agents through hidden instructions, potentially inducing them to access internal databases or exfiltrate credentials.
"The MCP is not in any way a technology that should be avoided," writes Charlie Gero, VP and CTO, Akamai Security Technology Group, in the report. "It's a revolutionary technology that represents the inevitable backbone of the next era of agentic-enabled enterprises. But agency without boundaries is simply vulnerability waiting to be exploited."
How to prepare your defenses for the AI threat environment
As a result of these changes, organizations must supplement reactive security practices with exposure management: continuous monitoring, automated mitigation and risk-based prioritization.
Rather than treating every discovered vulnerability equally, security teams must determine whether an exposed or vulnerable asset is reachable, exploitable and capable of disrupting critical business operations.
To buy time when necessary, runtime protections, API security controls and network segmentation can block exploitation while conventional patching proceeds.
AI-assisted vulnerability analysis can also accelerate defensive investigations. Organizations must inventory AI applications, agents, MCP servers and APIs while monitoring their permissions, dependencies and access to sensitive information.
MCP servers should operate within isolated trust boundaries, with strict authentication, limited privileges and auditing. High-risk autonomous actions should require human approval. Browser-level protections and employee training can reduce shadow AI risks without prohibiting legitimate productivity tools.
The four strategic pillars of agentic AI security
Akamai identifies four priorities for securing the emerging agentic enterprise.
- Shift to adaptive edge governance. Deploy runtime defenses, API filters and isolation mechanisms capable of blocking emerging threats before patches become available.
- Lock down the browser edge. Monitor AI extensions, enforce appropriate permissions and prevent sensitive information from flowing into unauthorized AI services.
- Protect brand authority in a zero-click economy. Monitor how AI crawlers access and represent corporate information, addressing inaccurate citations, misleading responses and reputational manipulation.
- Match autonomy to verifiability. Grant AI agents authority according to how reliably their actions can be checked and how reversible potential mistakes are. Require human oversight for consequential decisions.
AI is changing the speed and scale of cyberattacks, but it does not eliminate the value of established security principles. Organizations that combine zero trust, continuous visibility, adaptive runtime protection and human accountability can respond more effectively to AI-driven threats.
"The rise of the agentic web isn't just an infrastructure upgrade — it is a fundamental shift in how business value and operational logic are created," says the report. "Security leadership must evolve alongside it."
