Industries · Small & Midsize Businesses
Get the AI basics right without a security team.
Decide which AI tools your team may use, keep customer data and passwords out of them, and use business accounts you control.
The landscape
How AI is changing risk in small business
Small teams adopt AI fastest: chat assistants for email and proposals, AI features switched on inside accounting, CRM, and office software, and meeting note-takers. Usually no one has decided which tools are allowed, work happens in personal accounts, and the data settings are whatever the vendor chose. None of this needs a large program to fix — a short list of approved tools, a one-page policy, business accounts, and a look at each tool's data settings cover most of the risk.
What to do first
Pick approved tools
Choose one or two AI tools on business plans and tell everyone which ones to use.
Write a one-page policy
List what must never go into AI — customer personal data, financial details, passwords — and who to ask when unsure.
Check settings and access
Turn on MFA, switch off training on your data where you can, and review connected integrations each quarter.
Free readiness check
AI readiness check for small business
A short, industry-specific check. You get the gaps your answers reveal, why each matters, and what to do next — not a score. Runs in your browser; no signup.
Six questions covering the AI basics every small business should have in place. Answer for how things work today. Your answers stay in your browser; FlashTower records only anonymous usage events.
Readiness summary
0 of 6 answered
Your summary lists each gap your answers reveal, why it matters in small and midsize businesses, what to do next, and the public frameworks it maps to. It is not a score.
Based only on your answers, using fixed rules. Frameworks are listed for orientation; this summary does not determine whether you meet any law or standard and is not legal advice.
FlashTower findings are informational. No security system detects or prevents every threat, and FlashTower does not certify compliance or provide legal advice.
Common exposures
Where AI risk concentrates
Personal accounts for work
Staff use personal AI accounts with consumer data terms. When they leave, the chat history — and any customer details in it — leaves with them.
Customer data and passwords pasted into AI
Customer lists, invoices, and even passwords get pasted into AI tools to save time, with no rule saying not to.
Default data settings
Some AI tools keep inputs or use them to improve models unless an admin changes a setting or upgrades the plan.
Integrations nobody remembers
AI add-ons connected to email, drive, or accounting keep their access long after the person who connected them has moved on.
FlashTower rules
Rules most relevant to small business
These are real rules from the FlashTower Risk Engine. Each fires only when your answers meet its stated condition.
FT-IDN-001 · Identity
No controls on unapproved (shadow) AI tools
Unapproved AI tools are neither blocked nor monitored, or this cannot be confirmed.
Mapped to: NIST CSF 2.0 ID.AM-02 · NIST AI RMF MAP 4.1 · ISO 27001 A.5.15 · SOC 2 TSC CC6.1
HighFT-POL-001 · Policies
No AI acceptable-use policy
The organization has no written AI use policy, or cannot confirm one exists.
Mapped to: NIST AI RMF GOVERN 1.2 · NIST CSF 2.0 GV.PO-01 · ISO 27001 A.5.10 · SOC 2 TSC CC5.3
HighFT-VEN-001 · Vendor Risk
AI vendors are not reviewed before handling regulated data
The organization handles regulated data and does not review AI vendors before adoption.
Mapped to: NIST AI RMF GOVERN 6.1 · NIST CSF 2.0 GV.SC-06 · ISO 27001 A.5.19 · SOC 2 TSC CC9.2
HighFT-DAT-001 · Data Exposure
AI data retention not configured for regulated data
The organization handles regulated data and has not configured AI data-retention settings.
Mapped to: NIST CSF 2.0 PR.DS-01 · ISO 27001 A.8.10 · SOC 2 TSC C1.2
Medium
This page provides general information, not legal advice. FlashTower does not certify compliance with HIPAA, GLBA, NYDFS Part 500, professional-conduct rules, SOC 2, FedRAMP, or any other law or standard; findings and gaps are mapped to frameworks for orientation only. Consult qualified counsel and your compliance advisors about your obligations.
See what AI can access in your small business organization.
Run the free FlashTower Scan. Get your AI risk score and every finding in about 10 minutes — no account or system access required.