Your employees are already using AI. Do you know what they’re sharing with it?
The useful question is not whether people are using AI. It is what information those tools can now see.
Insights
Insights
Practical notes on cyber governance, AI, and the security questions growing organisations are already being asked.
What marketing agencies need to know about AI governance
Agencies adopt tools faster than most companies, and they do it across client work. That is why a generic AI policy fails them.
ChatGPT at work: what should actually be in your AI policy?
An AI policy is useful when someone can tell, from the page, what they are allowed to paste into a tool.
Cyber Essentials for marketing agencies: what it really involves
Cyber Essentials is a defined set of controls. For an agency, the hard part is usually the boundary: who and what is in scope.
Why an annual cyber assessment isn’t enough
An assessment describes a day. The organisation keeps changing after the report is filed.
The hidden security risk in your SaaS applications
The risky SaaS product is often the one a team started using because it solved this afternoon's job.
AI policy vs AI governance: what’s the difference?
A policy is a document. Governance is how you know the document still describes the tools people use.
Do marketing agencies need ISO 27001?
Sometimes a client will require it. More often they require the controls, and the certificate is one way to show them.
What should you do when a client sends a cyber-security questionnaire?
Answer what is true. A questionnaire is a chance to see the gaps, not a form to survive.
Shadow AI: what it is and why businesses need to know about it
Shadow AI is a tool people are using for work that the organisation has not approved and often cannot see.