Business

Akamai security sales rise 9% to $622m as it pivots to AI cloud

Akamai’s security revenue grew 9% to $622m in Q3 2026 as it bet billions on AI cloud. What it means for UK users of its WAF, API and bot tools.

Rising bar chart illustration with the headline Akamai security grows as AI cloud bet grows

Akamai’s third-quarter results show its security arm growing steadily, while the company puts most of its capital into AI cloud infrastructure. For UK organisations that depend on its web application firewall, API and bot protection, the numbers mean continuity on security and closer questions on everything else.

What happened

Akamai Technologies published its results for the quarter to 30 September 2026 on 5 November, after the US market closed. Total revenue was $1.122bn, 6% higher than a year earlier. Security revenue reached $622m, a rise of 9%, or 10% in constant currency. Cloud Infrastructure Services (CIS) grew fastest, up 34% to $109m. The legacy “delivery and other cloud applications” line, the content delivery business Akamai was built on, fell 3% to $391m.

Profitability went the other way. Non-GAAP operating margin fell from 31% to 25%, and non-GAAP earnings per share dropped 5% to $1.77. Management linked the squeeze to the infrastructure build-out. Zacks said revenue broadly matched its consensus estimate and earnings beat it. A share price quote on The Motley Fool’s transcript page showed the stock up 6.74%.

The headline on the call was not security. Chief executive Tom Leighton spent most of his prepared remarks on CIS. He confirmed a seven-year, $11.6bn commitment from Anthropic, which takes multi-year CIS deals signed in 2026 past $14bn. On that basis Akamai expects total revenue to grow 17% to 22% in constant currency in 2027 and to pass $7bn in 2028. Supply chain and third-party data centre delays have pushed about $30m of fourth-quarter revenue into next year.

The detail

The security business is now roughly a $2.5bn annual operation, which Leighton described as “very good business for us”. He said three products drove growth: the web application firewall (WAF), API Security and Guardicore Segmentation. Chief financial officer Ed McGowan said that once last year’s one-off licence revenue is stripped out, security has been adding around $12m to $13m of revenue each quarter. He also said Guardicore still has low penetration across the customer base. Guidance for 2026 is still high single-digit security growth in constant currency, and figures for 2027 will come in February.

Akamai is presenting AI as a tailwind for its security sales. Leighton gave four reasons: AI agents acting for users, staff pasting sensitive data into AI tools, attackers using AI to work at greater scale, and bots getting harder to tell apart from humans. He linked each one to a product. Bot & Agent Control is pitched at identifying where automated agents come from and what they intend. API Security is aimed at undocumented “shadow” APIs and AI endpoints. LayerX, acquired recently, is meant to stop employees leaking company data through AI prompts.

The capital spending figures matter more for the long term. Third-quarter capex was $464m, or 41% of revenue. Guidance for the fourth quarter alone is $2.445bn to $2.645bn, including about $1.7bn to pre-buy memory and other hardware for the Anthropic contract. Leighton said security needs relatively little capex and Akamai will keep investing in it. Delivery is being managed more selectively, with less investment and a reluctance to chase low-priced or highly spiky media contracts.

Key figures from Akamai's third-quarter 2026 results: total, security, cloud infrastructure and delivery revenue, and fourth-quarter capex guidance

Why it matters for UK organisations

Akamai does not break out UK revenue. International sales made up about half of the quarter’s total, $563m, up 7%. Even so, any UK organisation that routes its websites or APIs through Akamai’s edge is affected by where the company puts its money.

The first point is reassurance, with limits. Security is not being starved to pay for the AI build-out. UK buyers on multi-year WAF, bot management or API protection contracts should not expect the product line to stall.

The second point is about what they will be sold. Akamai has a clear incentive to bundle compute, security and delivery, and renewal conversations are likely to feature Inference, Agent Sandbox and LayerX. Bundles can be good value, but they concentrate more of an organisation’s internet-facing stack with one provider, and that is a third-party risk question boards are now expected to answer. NCSC supply chain guidance is clear on this, and the direction of the Cyber Security and Resilience Bill points the same way.

The third point is for organisations using Akamai mainly for content delivery. Management has been open that it is now picky about delivery work. That does not mean service will degrade, and McGowan said pricing is holding better than it has for some time. It does mean that customers with large or very bursty media workloads should not assume renewal terms will look like the last ones.

Expert view

In my experience, edge controls are among the most valuable and most misunderstood things an organisation buys. When we test applications protected by a well-tuned WAF and bot management layer, the noise drops sharply and opportunistic attacks rarely land. When we test the same applications with the edge removed or bypassed, through an origin IP left exposed or a forgotten subdomain, the underlying flaws are usually all still there. Akamai’s description of its WAF as patching exposure points automatically is a fair description of virtual patching. But virtual patching buys time. It is not a fix.

The agentic AI pitch is the part I would watch most closely. Telling a legitimate customer’s AI assistant apart from a scraping or credential-stuffing bot is genuinely hard, and vendors that solve it well will earn their money. However, the claims in an earnings call are marketing claims. UK buyers should ask for evidence from their own traffic, not analyst quadrant positions.

What to do now

  1. Check that the edge cannot be bypassed. Confirm origin servers accept traffic only from your CDN or WAF provider, and hunt for unprotected subdomains and legacy hostnames. This maps to the Cyber Essentials firewall and secure configuration controls.
  2. Treat WAF rules as a stopgap. Keep patching vulnerable applications within Cyber Essentials’ 14-day window for critical and high-risk updates, even where a virtual patch is in place.
  3. Build an API inventory. Whether or not you buy API Security, know which APIs and AI endpoints you expose, who owns them and how they authenticate.
  4. Write an AI agent policy for your edge. Decide which automated agents you will allow, rate-limit or block, and test bot management against real traffic before you rely on it.
  5. Revisit supplier risk at renewal. Ask Akamai, or any edge provider, about roadmap, support commitments and exit options. Record your concentration risk if you consolidate security, delivery and compute with one vendor.
  6. Control data flowing into AI tools. Whatever product you use, set clear rules on what staff may paste into AI services, and monitor for it.

Bottom line

Akamai’s security business is healthy, growing at high single digits and still getting investment while the company makes a very large bet on AI compute. For UK customers that is broadly good news. The practical response is not to change vendor but to keep the basics tight: no bypassable origins, real patching behind the WAF, a known API estate and a clear view of how much of the front door now depends on one supplier.

Sources

Related Posts