For Business
AI-era security for whoever got handed IT
Built for owner-operators, office managers and the person who became the IT department by accident, at organizations of up to 50 people.
See what's reaching small teams now, set the rules your staff need, and get your plan in writing.
Free. About three minutes. Starts with your industry.
Start here
- Verify payments on a second channelA simple callback rule for any request to move money or change bank details.
- Get the free AI Acceptable Use PolicyDecide which AI tools your team can use and what data stays out of them. Free account required.
- Cover the small-business basicsThe habits that matter most for a small team, in the order to tackle them.
Threats to know now
What's reaching small organizations now, how it gets in, and which controls stop it.
- ThreatHomeBusiness
Voice cloning and deepfake scams
Criminals can copy a voice from a short clip and fake faces on a video call, then use them to ask for money in a hurry. In 2025 the FBI logged 22,364 complaints that mentioned AI, with losses near $893 million, most of it in investment scams; voice-cloned 'distress' calls alone cost victims more than $5 million. The defense is low-tech: pause, hang up, and confirm through a number or channel you already trust.
Read - ThreatHomeBusiness
AI-powered phishing and business email compromise
Criminals now use AI to write fluent, personalized phishing emails and payment requests, in any language and at volume. Business email compromise (BEC), where a scammer poses as a boss, vendor or title company to redirect a payment, drew $3.05 billion in reported losses to the FBI in 2025. Typos are no longer the tell; a request to move money or change bank details is. Confirm every one on a second channel you already trust.
Read - ThreatHomeBusiness
AI chatbot data leaks and shadow AI
Whatever you paste into an AI assistant can be stored, read by reviewers or used to train future models, depending on the app, the plan and your settings. In a 2025 survey of workers in 47 countries, 48% of those who use AI at work said they had uploaded sensitive company or customer information into public AI tools. The fix is mostly unglamorous: business accounts for work, the right settings at home, and a clear rule about what never goes in.
Read - ThreatHomeBusiness
Prompt injection and AI agent hijacking
When an AI assistant reads your email, files or web pages, it can mistake text written by a stranger for instructions from you. That is prompt injection, and when the assistant can also send, buy or delete things, an attacker can steer it. The UK's National Cyber Security Centre (NCSC) says it may never be fully fixed, so the safe move is to limit what your AI can reach and keep yourself in the approval loop.
Read
Industry briefs
Deeper reads for regulated fields.
- Industry briefBusiness
Cybersecurity threats for healthcare practices
Small practices hold the same patient data as hospitals with far fewer people defending it, and attackers pick targets by that profile. In 2025 the FBI received more ransomware complaints tied to healthcare than to any other critical infrastructure sector, and AI now makes convincing impersonation calls and emails cheap to produce. Most of the fix is basics done well: multi-factor authentication (MFA), offline backups, fast patching, a callback rule for money and password requests, and a written rule for which AI tools may touch patient data.
Read - Industry briefBusiness
Cybersecurity threats for financial services
If you prepare taxes, run payroll, keep books or advise clients, you move money and hold the data criminals want, and federal rules may treat you as a financial institution. Business email compromise cost victims $3.05 billion in 2025 according to the FBI, and AI-made voices, videos and ID documents are now part of the playbook. Start with multi-factor authentication (MFA) everywhere, a callback rule for every payment change, and a written security plan that covers how your team uses AI.
Read
Habits that hold up
Routines and one-page rules a five-person team can run without a security department.
- GuideBusiness
Digital hygiene for your business: the 1-50 person baseline
A small business's security baseline fits on one page: passkeys or multi-factor authentication (MFA) on every account, email and banking first; a shared password manager; automatic updates and endpoint protection; and backups you've actually restored from. Add a second-channel check before any payment change, a one-page AI rule, same-day offboarding and a short incident plan. Business email compromise alone drew $3.05 billion in reported losses to the FBI in 2025.
Read - GuideHomeBusiness
Lock down your AI assistants
Each major AI assistant has a training setting, a memory setting, connected apps and a way to delete history, and the defaults favor the vendor. This guide walks through ChatGPT, Claude, Gemini, Microsoft Copilot and Meta AI one at a time, with notes for business accounts. Plan on about five minutes per assistant.
Read - GuideBusiness
Two-channel verification for payments
Money only moves after a second channel confirms it. Keep a list of known-good phone numbers, call back on those numbers before paying or changing bank details, require two people above a set amount, and know who to call in the first hour if money goes out. Among the controls finance teams use against business email compromise, that callback is the one most often rated very effective.
Read - GuideBusiness
A one-page AI use rule for your team
Your team is probably using AI already, so the useful question is which tools, with what data, and who checks the result. This guide helps you write those answers on one page, get everyone to sign it, and review it twice a year. When you need more, our full AI Acceptable Use Policy generator uses the same structure and is free with a free account.
Read
When you're ready to put it in writing
Three tools for the owner, office manager or whoever got handed IT. They're the only thing we sell, and the AI Acceptable Use Policy is free with a free account.
Cyber Audit
Free Quick CheckScore your security in plain English, including how your team uses AI tools and what goes into them.
Policy Library
AI policy freeNine plain-English security policies, customized to your organization. Start with the AI Acceptable Use Policy, which is free with a free account.
Incident Response Planner
Build and rehearse a plan for when it goes wrong, including deepfake payment requests and client data pasted into a chatbot.
Tools we'd use
Products we'd put in front of a small team. No sponsorships, no referral fees, no affiliate links.
Bitwarden
Free tierPassword managers
Storing and filling a unique password and passkey for every account, and sharing the ones you need to with your family or team.
See it in the toolkit1Password
PaidPassword managers
A polished password manager for families and teams who want easy sharing, admin controls and good onboarding.
See it in the toolkitMicrosoft Copilot Chat (work account)
PaidPrivate and business-tier AI
A general AI assistant for staff that's covered by your Microsoft 365 business contract instead of consumer terms.
See it in the toolkitChatGPT Business
PaidPrivate and business-tier AI
A standalone AI workspace for a small team that wants a mainstream assistant without consumer data terms.
See it in the toolkitBackblaze Computer Backup
PaidBackup
Automatic, continuous cloud backup of a whole Mac or Windows computer, including drives plugged into it.
See it in the toolkitMicrosoft 365 Business Premium
PaidDevice management
One subscription that adds device management, endpoint protection and stronger email security to Microsoft 365, for businesses of up to 300 people.
See it in the toolkit
Keep control of your data
Who learns from your company's data, how to get it back out, and how to avoid lock-in.
- ExplainerHomeBusiness
Digital sovereignty, in plain English
For governments, digital sovereignty means control over their own technology, data and online rules. For you, it means staying in charge of your own data, identity and choices: knowing who can read or train on your information, being able to leave a service with your data, holding the keys to your own accounts, and deciding what stays on your own devices.
Read - ExplainerHomeBusiness
Who owns your AI conversations?
In practice, the company that runs the assistant holds your conversations, and its terms decide who can read them, whether they train future models and how long they're kept. Some consumer plans, including ChatGPT's, use your chats for training unless you switch it off, while the major business plans say they don't by default. You can usually export or delete your chats, but deleting doesn't undo training that already happened, and legal holds can override deletion.
Read
New to the jargon?
Every AI and security term on this site, decoded in a sentence or two.