Dancing With Artificial Intelligence (AI)

As published in Your Business With James Caan Autumn 2026

AI is reshaping business rhythms. When to lead, when to follow, and staying in step without losing control is everything.

AI: Your Most Productive Employee or Biggest Unmanaged Risk?

In 2025, criminals used a well-known AI coding agent to help steal and extort data from at least 17 organisations, including healthcare and emergency-service bodies. The agent automated reconnaissance, credential theft, network penetration, data-selection decisions and even ransom demands.

Later that year, a state-sponsored group used AI agents to conduct up to 90% of the tactical work in a cyber-espionage campaign targeting around 30 organisations.

These incidents demonstrate AI is moving from just answering questions to taking autonomous actions.

IBM’s 2025 research found attackers used AI in 16% of studied breaches. Thirteen per cent of organisations reported breaches involving AI models or applications, and 97% lacked proper AI access controls.

However, extensive use of AI and security automation reduced average breach costs by $1.9 million and shortened breach lifecycles by 80 days.

This is the AI dilemma for every SME.

AI can increase productivity, improve customer service and help smaller teams compete with larger organisations.

It can also expose confidential information, produce convincing errors and enable poorly controlled agents to act faster than management can intervene.

Do not confuse speed with progress

AI can summarise meetings, analyse spreadsheets, draft proposals, research markets, produce policies and help employees find information.

Agentic AI goes further; instead of suggesting an action, it can complete tasks, connect to business systems, send messages and update records.

An agent could monitor enquiries, gather customer information, draft responses and create sales tasks. Another could analyse invoices, identify anomalies and prepare cash-flow summaries. However, autonomy changes the risk.

An assistant may produce a poor answer; an agent may act on it.

AI can invent facts, misunderstand context or follow malicious instructions hidden within documents, emails or websites. If connected to customer records, finance systems or company email, one mistake could cause a data breach, fraudulent payment or reputational crisis.

The answer is not to ban AI.

Employees may use it anyway, creating “shadow AI” through personal accounts and unapproved tools; IBM found that 63% of breached organisations had no AI governance policy or were still developing one.

Controlled encouragement is safer.

Start with what you already own

Before buying another platform, examine the AI capabilities within your existing business software. Microsoft 365 Copilot supports Outlook, Teams, Word and Excel, while agents can retrieve information, summarise data and perform approved actions within a managed Microsoft 365 environment.

Google Workspace includes Gemini across Gmail, Docs, Sheets, Drive and Meet. Organisations can also build repeatable assistants and automate workflows with enterprise protections.

Mainstream business platforms may provide stronger identity management, access controls, logging and contractual safeguards than free consumer tools. They offer SMEs a manageable starting point.

Seven controls every SME can implement

1.      Publish a pragmatic AI policy. Define approved tools, prohibited information and circumstances requiring human review.

2.      Create an AI register. Record each approved tool, owner, purpose, users, data access and review date.

3.      Classify information. Prevent personal data, customer secrets, passwords, financial details and intellectual property entering unapproved services.

4.      Use company accounts. Require managed identities, multi-factor authentication and central administration. Prohibit unmanaged personal accounts.

5.      Keep humans responsible. Require named approval for payments, contracts, recruitment decisions, customer communications and security changes.

6.      Limit every agent. Grant only necessary information and permissions. Begin with read-only access and require approval before messages, payments, deletions or system changes.

7.      Test and monitor. Trial AI on low-risk activities, verify outputs, review logs and establish a process for reporting unexpected behaviour or data exposure.

The winners will not be businesses that adopt AI fastest or avoid it longest. They will combine curiosity with control.

AI should challenge, create and accelerate, but never operate without boundaries, ownership or the ability to stop it.

How UKDataSecure can help

UKDataSecure helps SMEs turn AI from an unmanaged risk into a controlled business advantage.

We assess readiness, establish governance, secure AI deployments, prevent data leakage, manage agentic AI risks and implement controls that unlock productivity while maintaining compliance, security and executive confidence.

Our support includes:

·         AI readiness and risk assessments

·         AI governance, policies and registers

·         Secure AI deployment

·         Data protection and compliance assurance

·         Agentic AI control and monitoring

·         Staff awareness and training

·         Ongoing vCISO and AI governance support

To find out more:

Call: 07824 445375

Visit: www.ukdatasecure.com 

Email: info@ukdatasecure.com

Chat: bookachat