- Home
- AI consultancy
- Secure AI
AI security for small businesses
Your staff are already using AI, and your suppliers are adding it to the tools you rely on. We help you use it safely: clear policies, proper risk assessments and security testing for the AI systems you run. We work with businesses anywhere in the UK.
What we do
From a one-page policy to testing the agents that act on your systems.
AI acceptable use policy
A short, plain-English policy for your staff: which tools, what data, and how to check the output.
AI risk assessment
The AI tools you use or plan to use, the risks each one brings, and what to do about them.
DPIA support
Help working through a data protection impact assessment for AI that handles personal data.
Copilot oversharing check
Permissions reviewed before Microsoft 365 Copilot is switched on, so it can’t surface files it shouldn’t.
Shadow AI review
Find out which AI tools are already in use across the business, and decide which to keep.
Prompt injection testing
We try to trick your AI agents and chatbots into misbehaving, then help you close the gaps.
An AI acceptable use policy your staff will follow
Most AI policies fail because nobody reads them. Ours fit on a page or two and answer the questions staff actually have: which tools can I use, what can I put into them, what must I never put in, and how do I check the answer before it goes anywhere.
We write it around your tools, your data and your sector, then run a short session so people understand why the rules are there. That’s what turns a document into a habit.
Shadow AI: the tools you don’t know about
In most businesses, AI arrived before anyone decided to use it. Personal ChatGPT accounts, browser extensions, transcription apps that join meetings, and AI features switched on inside software you already pay for.
We find out what’s in use, without turning it into a witch hunt, and help you decide what to keep, what to replace with a business version and what to switch off. Usually the answer is to give people a better, approved tool rather than ban AI outright.
AI risk assessments and DPIAs
An AI risk assessment looks at each tool you use or plan to use: what data it sees, where that data goes, what could go wrong and how likely it is. You get a short report with the risks ranked and a practical fix for each.
Where AI processes personal data in a way that’s likely to be high risk, UK GDPR expects a data protection impact assessment. The ICO explains when a DPIA is needed and sets out how data protection applies to AI in its guidance on AI and data protection. We help with the technical side of the assessment; decisions about your legal position stay with you.
Copilot security risks
Microsoft 365 Copilot works within each user’s existing permissions, as Microsoft explains in its Copilot privacy documentation. That’s sensible, but it means any file shared too widely in the past, such as a salary spreadsheet or an old HR folder, becomes very easy to find.
Before rollout, we review sharing across SharePoint, OneDrive and Teams, tighten what’s too open, and set up sensible labels for sensitive files. Then Copilot only surfaces what each person should see.
Testing AI agents for prompt injection
Prompt injection tops the OWASP Top 10 for large language model applications. Hidden instructions in an email, document or web page can trick an AI tool into leaking data or taking actions it shouldn’t. The risk grows with every system an agent can reach.
We test your chatbots and agents the way an attacker would, report what we find in plain English, and help fix it: tighter permissions, approval steps for risky actions, and checks on what goes in and out. Our approach follows the NCSC’s guidelines for secure AI system development.
What happens when you get in touch
No sales script and no obligation. We’ll tell you honestly whether AI is the right answer for the job.
- We reply within one working daySend a few lines about your business and what you’d like to change.
- A free 30-minute callWe talk through the work, what AI could do and what it shouldn’t.
- A written scope and a fixed quoteBefore any work starts, so you know exactly what you’re getting.
AI security questions
Do we need an AI policy?
If your staff use AI at work, yes. Without one, people make their own rules about what goes into which tools. A short policy, backed by a little training, removes most of the risk.
Is there an AI acceptable use policy template we can use?
Templates are a reasonable starting point, but they rarely match how a business really works. We write a short policy for your tools, your data and your sector, in plain English, so people actually read it.
What is shadow AI?
AI tools staff use without the business knowing: personal ChatGPT accounts, browser extensions, note-taking apps that join meetings. It’s rarely malicious, but it means company and client data ends up in places you don’t control.
What is prompt injection?
An attack where hidden instructions in an email, document or web page trick an AI tool into doing something it shouldn’t, such as revealing data or taking an action. It matters most for AI agents that can read your inbox or act on your systems.
Does Microsoft 365 Copilot have security risks?
The main one is oversharing. Copilot can find anything each user already has access to, so files shared too widely in the past become easy to surface. Checking permissions before rollout deals with most of it.
Do we need a DPIA for AI?
Often, if the AI processes personal data in a way that’s likely to be high risk. The ICO’s guidance explains when one is needed, and we help you work through it for your systems.
Talk to us about AI security
Tell us which AI tools your team uses and what worries you about them. We reply within one working day.