Most of what is written about AI security is for the people who build models, where the worries are poisoned training data, stolen weights and adversarial inputs. For a business of 50 to 500 people that uses AI tools, the set of risks is smaller and more concrete. Almost all of them sit on things your IT already looks after: accounts, access, the connections between systems and the people who approve payments.
Six places AI changes your security
1. Accounts the business does not control
The most common AI security gap is a personal account holding work data, on terms the business never agreed and with no way to close it when the person leaves.
The fix is ordinary identity work: approved tools under company sign-in, and a restriction on which outside apps people can connect to their work accounts. For the move itself, ChatGPT Free, Plus, Business and Enterprise has the steps, and what to do when client data has already gone in covers the incident.
2. Access that was always too wide
A connected AI tool finds, by meaning, whatever the signed-in person can open. Once a tool can search everything in one question, the shared folders, open links and leavers' lingering access that were already risks become live ones. What Copilot can already see and what Gemini can already see have the checks.
3. Instructions hidden in content
An AI tool reads emails, documents and web pages, and any of them can contain text written to look like an instruction. This is prompt injection. In December 2025 the UK's National Cyber Security Centre explained that language models do not separate instructions from data, and that prompt injection may never be totally mitigated in the way older attacks were.
Its advice is to reduce the impact rather than hope to prevent it. For a business, that means one design rule: a tool that reads content from outside the business should not also hold the power to send, pay or delete. AI agents sets that out in full, and AI browsers are the sharpest case of it.
4. Connections that become standing access
Every connector between an AI tool and your systems is a standing grant of access, and AI apps often ask for broad permissions when someone clicks "connect". With the model context protocol, an open standard many tools now use to connect to other systems, adding a connection is easier still, including connections built by third parties. Treat each one as software from a supplier: approved before use, given the narrowest access that does the job, logged and reviewed every quarter.
5. Attacks that AI makes better
AI helps attackers too. Phishing emails no longer give themselves away with poor spelling, and a cloned voice or a convincing video of a director asking for an urgent payment is cheap to make. Although detection tools help at the margins, the protection you can rely on is process: whoever appears to be asking, every payment and every change to bank details is confirmed through a second, known channel. Deepfake and voice-clone fraud sets out the process changes.
6. What you can see
When something goes wrong with an AI tool, investigating it depends on logs. Business tiers of the main tools keep logs that personal accounts do not, and Microsoft 365 and Google Workspace both record when someone grants an app access to their account.
What to do first
- Put approved AI tools under company sign-in, and restrict which outside apps people can connect to their work accounts.
- List the AI apps that already have access to your Microsoft 365 or Google Workspace tenant, and remove the ones nobody can account for.
- Check what each group can reach before any tool is connected for them.
- Give connectors and agents the narrowest access that works, and keep send, pay and delete away from anything that reads outside content.
- Make no exceptions: confirm every payment and every change to bank details through a second channel.
- Collect the logs, alert on new app connections and make sure people know how to report something odd without fear of blame.
Where the standards come in
If you hold ISO 27001, nearly all of this maps onto controls you already run, as set out in what ISO 27001 expects once AI is in use. If you build AI into your own products, the NCSC's guidelines for secure AI system development are the place to start.
Where this fits
AI security is the same work as the rest of your IT security, applied to some new tools and one new kind of attack. The controls are set up in Govern, checked in the permissions review described in Guardrails and watched day to day as part of Trackside, alongside 24/7 support for the rest of your systems.