Small-business cybersecurity advice used to be a fairly stable list: strong passwords, two-factor authentication, keep software updated, be suspicious of email attachments. All of that still matters. But the widespread adoption of AI tools inside small businesses over the last two years has quietly opened a second category of risk that a generic cybersecurity checklist doesn't cover, because it didn't exist when most of those checklists were written. This is a look at exactly what's new, why it's genuinely different from the risks that came before it, and a checklist built specifically to close the gaps — not a rehash of advice you've already seen.

New risk 1: employees pasting confidential data into public AI tools

The single most common new incident isn't a hack — it's an employee, trying to be efficient, pasting a client contract, an unreleased financial figure, or a customer's personal information into a free, public AI chatbot to get a quick summary or rewrite. Depending on that tool's terms of service, that data may be retained, may be used to improve the underlying model, and is now sitting outside your company's control in a system you never vetted or approved.

This isn't a hypothetical risk — it's happened at companies of every size, and small businesses are actually more exposed than large ones, because large companies more often have a sanctioned, contractually-protected AI tool employees are pointed toward, while a small business frequently has no policy at all, leaving each employee to independently decide which free tool to trust with sensitive material. The fix isn't banning AI tools — that just pushes the behavior underground — it's providing one sanctioned, vetted tool with an actual data-processing agreement, and being explicit about what categories of information should never be pasted into anything else.

New risk 2: AI browser extensions and connected apps with sweeping permissions

A second new risk category: the explosion of AI-powered browser extensions and "connect your email/calendar/documents" integrations, many of which request far broader permissions than their actual function requires — an extension that summarizes emails asking for full read-and-send access to your inbox, for instance. Employees install these individually, often without any review, because they're free and genuinely useful for the specific task they're installed for.

The risk isn't necessarily that these tools are malicious — most aren't — it's that a small business typically has no inventory of which AI extensions and integrations are connected to which accounts, which means a permission scope nobody reviewed, attached to an account nobody's watching, sits quietly in place indefinitely. If that extension is later acquired, compromised, or simply changes its data practices in a terms-of-service update nobody reads, the business has no way of knowing its exposure changed.

New risk 3: AI-enhanced social engineering that sounds and looks real

The scam itself isn't new — a fraudulent request for a wire transfer impersonating an executive is a decades-old fraud pattern. What's new is the production quality. Voice-cloning tools now need only a short public sample of someone's voice — a conference talk, a podcast appearance, a company webinar recording — to generate a convincing few seconds of audio. A real incident pattern now circulating among small and mid-sized businesses: a finance employee receives what sounds exactly like the CEO's voice on a phone call, urgently requesting an out-of-cycle wire transfer to a "new vendor," citing time pressure as the reason to skip the usual approval chain. The audio is fabricated; the urgency and the request to bypass process are the actual attack.

Warning

Any request that combines financial action with pressure to skip your normal approval process is the pattern to distrust by default now, regardless of how convincing the voice or the writing sounds — because AI tools have made both trivially easy to fake convincingly, and "it sounded exactly like them" is no longer meaningful evidence that it was them.

The practical defense isn't voice recognition — it's process. Any wire transfer or payment request above a defined threshold requires verification through a second, independent channel (a callback to a known number, not the number the request came from) regardless of who appears to be asking or how urgent the request sounds. This single rule defeats the vast majority of AI-enhanced impersonation attempts, because the attack depends entirely on skipping that step under pressure.

New risk 4: shadow AI — tools nobody vetted, running on real business data

Between the first two risks sits a broader pattern worth naming on its own: "shadow AI," the accumulation of AI tools individual employees adopt on their own for genuinely useful reasons, none of which ever went through any review, and which collectively touch far more of the business's real data than any one person realizes. A marketing employee's AI writing tool, a sales rep's AI note-taker silently transcribing every customer call, an operations employee's AI spreadsheet assistant with a live connection to the company's real financial data — none individually alarming, collectively an inventory gap nobody has ever mapped.

Vetting an AI vendor before you connect it to real business data

Every new risk above points to the same underlying gap: most small businesses adopt AI vendors the way they'd adopt a free note-taking app, with no vetting process at all, when the right comparison is closer to how they'd vet a payroll provider or a bank. Before connecting any AI tool to real customer, financial, or employee data, four questions are worth answering and keeping on file, not just asking once and forgetting.

Does the vendor's agreement explicitly say whether your data is used to train their models, and can that be turned off? Many business-tier plans include this as a toggle the free tier doesn't offer — worth confirming rather than assuming. Does the vendor name its sub-processors — the other companies that might also touch your data through the vendor's own infrastructure — and can you get a list? A vendor unwilling to answer this is telling you something. What's the actual data retention period, and does the vendor support a real deletion request if you stop using the tool, rather than data sitting indefinitely in a system you've walked away from? And has the vendor been through any independent security review — a SOC 2 report or equivalent — appropriate to the sensitivity of what you're about to hand it?

None of this needs a legal team for a small business — it needs a short, repeatable set of questions asked before adoption rather than after an incident, and a place (even a simple shared document) where the answers for each vendor actually in use are recorded, so "did we ever check this" has an answer besides someone's memory.

The checklist

Access and accounts:

  • Every AI tool used by anyone in the business is listed in one shared inventory, including free tools employees adopted independently
  • Each listed tool has been checked for whether it trains on submitted data, and whether a business or enterprise tier with better data terms is worth the cost
  • AI browser extensions and third-party integrations are reviewed for requested permissions before approval, not after
  • Multi-factor authentication is enabled on every account an AI tool integration touches, not just email

Data handling:

  • Written guidance exists (even one page) naming the categories of information that must never be pasted into a non-sanctioned AI tool — client contracts, unreleased financials, employee personal data, credentials
  • One sanctioned AI tool with an actual data-processing agreement is provided, so the guidance above has a real alternative to point to
  • AI note-takers and call-transcription tools used on customer or client calls have documented consent, and their output is stored somewhere access-controlled, not a personal account

Process and people:

  • Any financial transfer above a defined dollar threshold requires independent-channel verification regardless of how the request arrived or who it appears to be from
  • New employees are told about the voice/video-cloning risk explicitly during onboarding, not left to discover it after an incident
  • A named person (even part-time) owns the AI-tool inventory and reviews it quarterly, the same way a business would review vendor contracts

Recovery:

  • A basic incident response plan exists naming who gets called first if a data leak or fraud attempt involving an AI tool is suspected
  • Backups of critical business data exist independent of any AI tool's own storage, so a compromised or discontinued AI vendor can't take irreplaceable data down with it

Testing this with a tabletop exercise

A checklist that's never been tested is a document, not a defense. Run a short tabletop exercise once a quarter: pick one scenario from the list above — a convincing voice-cloned payment request, or a new employee discovering a free AI tool was fed real client data — and walk through, out loud with the actual people involved, what would happen next. Most businesses discover in this exercise that "who do I call first" has no clear answer, which is exactly the kind of gap worth finding during a fifteen-minute tabletop conversation rather than during a real incident at 4pm on a Friday.

The AI-Powered Cybersecurity and Business Resilience Engine builds out each of these checklist items into a full implementation guide, including a sample data-processing-agreement checklist for evaluating AI vendors. Pair it with the Cybersecurity for Small Businesses resource to build your actual policy document, and use Digital Asset Management to get the tool inventory and access-control piece of this checklist into something durable rather than a list that lives in one person's head.