Minimum viable security

An SME will not stand up a security operations centre. It can close the five holes that let the first AI incidents in: shared accounts, secrets in chat, too much data in the prompt, vendors with no contract, and nobody who can switch this off on a Friday.

Minimum viable security is not a badge. It is a list the flow owner can show. If it cannot be shown, it is not done.

This sits next to GDPR: there we talk legal basis; here we talk about the token and the spreadsheet not leaking.

Identities and accounts

• No shared “ai@company” user with the password in the WhatsApp group. One account per person, or a company connector with SSO if you already have it.
• When someone leaves, access goes the same day. The copilot is not an exception “because it belongs to everyone”.
• Leadership does not paste passwords into the chat “so the model can configure email”. That is an incident, not a productivity hack.

Secrets and keys

API tokens do not live in a thread, an onboarding PDF, or a public repo. They live in a password manager or in server environment variables. If the pilot is “just a sheet and an account”, at least that account has a second factor and the QR is not forwarded by email.

If a vendor gives you a key and tells you to put it in the website frontend, that vendor is out. A key in the browser is a public key, even if they call it secret.

Prompt perimeter

The yes / no / ask poster is a security control, not only a privacy one. It cuts the surface. Special categories, payroll and customer secrets stay out. The internal copilot corpus is closed: it does not “read the whole Drive”.

Review ten real prompts at day 14. You will see the hole the policy missed. That is more useful than a 200-page pentest in a 20-person firm.

Logs, copies, kill switch

Know whether the vendor stores prompts and for how long. Know who in their support can read them. Keep a copy of your corpus outside their UI. And a switch: disconnect the connector, revoke the key, go back to the manual process.

A half-page incident plan: what you switch off, who tells customers if needed, who calls the vendor. You do not need a bank playbook.

Programme fit

Kit Consulting has cybersecurity categories; do not use them as theatre if the real hole is the key in the chat. Sometimes the work is basic (accounts, 2FA, inventory) and then the pilot. Sometimes the pilot waits.

Friday close list (five minutes)

Does the owner still have access and has anyone who left been removed? Is the key where it should be (not in a thread)? Any odd prompt in the short review? Has the kill switch been tested this month? Has the vendor announced a new sub-processor?

Five questions. If one is “I do not know”, that is next week’s job. This is not a SIEM. It is hygiene. Hygiene prevents the boring incident, which is the only one that usually happens.

Write the date of the last “test switch-off”. A kill switch nobody has pressed is a drawing.

Extensions, phones and “the mail copilot”

The perimeter breaks in the browser extension, the phone app and the assistant already sitting in the mail client. Those three go on the account and key list. “It is not the pilot” does not exempt them: they paste the same spreadsheet.

If you cannot inventory them, the first control is to say they are not used for the pilot flow. In writing. Tuesday at 11 is when it is broken; that is why the 30-minute briefing uses desk examples, not architecture.

Backups of the corpus (the PDFs and the FAQ) live outside the vendor, under the same perimeter. If tomorrow you cannot enter their console, you still have the knowledge. That is continuity security, not only leak security. It fits on the same Friday list.

When a salesperson asks for “demo access” to your console, that access is a temporary user and it is revoked when the call ends. The owner’s key is not forwarded. A vendor support incident is a boring classic. It deserves a line on the Friday list.

Frequently asked questions

Do we need a pentest before the pilot?

Almost never. You need 2FA, named accounts, a perimeter and a kill switch. A pentest arrives when there is something to attack besides a spreadsheet.

Is antivirus enough?

It does not cover the token pasted in a thread or the customer Excel in a public model.

Is a local model safer?

It reduces processors and outbound leaks. It does not prevent shared accounts or oversized prompts. A piece, not the whole.

Next: GDPR and data and privacy. We will review the first flow’s perimeter.