LayerX Security traces enterprise AI risk to a small group of power users

A new report from LayerX Security, covered by The Hacker News, points to an uncomfortable question for companies that have already let generative AI into daily work: do they actually know where their real exposure is coming from? Based on the summary of the State of AI Usage Report 2026, the answer is often weaker than security teams would like.

The central claim is not that every employee represents the same AI risk. It is the opposite. LayerX describes a pattern in which enterprise AI exposure is not evenly distributed across users or platforms. A large share of the risk is concentrated around a small group of intensive users, the AI power users who rely on these tools more often, across more workflows, and in more sensitive business contexts.

That changes how AI security should be framed. If an organization manages AI only through broad bans, allowlists, or occasional employee surveys, it misses the operational picture. Risk is not an abstract company-wide average. It appears in specific workflows, inside browsers, in pasted data, uploaded documents, and the habit of treating an AI tool like a fast external collaborator.

Visibility therefore becomes the first layer of control. In the context of frameworks such as the NIST AI Risk Management Framework, organizations cannot seriously assess AI risk if they do not know who is using AI, which services are involved, and what content is leaving the controlled environment. The same logic applies to practical security guidance for large language model applications, including the OWASP Top 10 for Large Language Model Applications, where data exposure and unmanaged model integration are treated as concrete operational risks.

For everyday enterprise work, this means AI governance cannot be reduced to a policy document sitting on an intranet. If a small group of power users creates most of the exposure, security teams need to distinguish them from occasional users, understand usage patterns, and apply controls that do not crush productivity but clearly limit the movement of confidential, regulated, or business-critical data.

The report also matters because it challenges the comfortable assumption that AI risk can be understood at the platform level. A company may know that employees use a popular AI tool, but that does not mean it understands the content of the interaction, frequency of use, business context, or compliance impact. In practice, the gap between summarizing public text and sending internal documents into an external tool is a major security boundary.

The useful conclusion is blunt: enterprise AI is not only an adoption story, but a concentration-of-risk story. Companies that want to govern this technology seriously need to stop measuring only the number of users and start looking at behavior patterns, usage intensity, and the points where data leaves monitored systems.