Notes from the Prinn team on stopping AI data leaks in small businesses, and on building the product.
One page, four rules. Which tools are approved, what never gets pasted in, who to ask, and what happens when something slips through.
The scale of these breaches is not the transferable part. The way each one started is: a forgotten access path, a borrowed credential and data kept too long.
Spear phishing is a phishing message written for one person, using true details about them. The useful question is where the attacker got the details.
Business email compromise is an attacker inserting themselves into a payment conversation you were already having. The invoice looks right because it mostly is.
It gets found by an automated scanner, often within minutes, and tried. A leaked key is an unlocked door someone walks through the same afternoon.
It can be. The test is whether personal information went somewhere it should not have and serious harm is likely. An accidental paste can satisfy both.
In a business of ten people, almost every incident involving staff is someone trying to do their job quickly. Controls built for malice will not stop it.
Almost never by someone breaking through your defences. Nearly always by someone signing in, or doing something reasonable at the wrong moment.
Probably, because a staff member pasting client data into a chat tool looks like an ordinary privacy event rather than an AI exclusion.
Short answer: no. All eight strategies were designed for a threat that arrives. None of them look at what your staff type into a prompt.
Yes, but not in the way most coverage suggests. The cons are the same. The two clues people relied on, bad writing and a familiar voice, no longer hold.
In two of the four markets most small businesses operate in, there is no small-business exemption at all. In the other two it is narrowing.
Short answer: one page, four rules, and a named person to ask. Most AI policies fail because nobody can remember them at the moment they matter.
Short answer: not by default. What happens to what you paste depends on your plan, and where the data goes is a question most small firms have never asked.
Shadow AI is your team using AI tools you have not approved, usually to do their job faster. Here is what it looks like in a small business, and what to do.