AI Security Risks for Small Businesses

Verizon, 2026 DBIR. Verizon's 2026 Data Breach Investigations Report found frequent employee use of AI tools surged from 15% to 45% of employees in a single year, and shadow AI is now the third most common non-malicious data leakage activity. Third parties were involved in 48% of breaches, and most of your AI is a third party.

IBM, 2026 Cost of a Data Breach. IBM's 2026 study put the global average breach at $4.99 million. Roughly one in five organizations reported a breach of an AI model or application, and 92% of those lacked proper AI access controls. Prompt injection incidents averaged $5.89 million in losses.

AI use is spreading faster than anyone governs it, and the breaches that follow are access-control failures, not science fiction.

Here is how we rank the six risks for a typical 30 to 200 person company using mainstream AI tools and perhaps one AI feature in its product. Vendors selling "AI firewalls" will dispute the order. Fine.

Bias and hallucination (OWASP LLM09 Misinformation) are left out on purpose. For most small companies they are governance and quality questions, handled through human review, unless AI is making decisions about people.

It leaks the boring way. A support agent pastes a ticket with a customer's health details into a free chatbot. A developer pastes a stack trace that contains an API key. Consumer tiers may retain prompts or train on them, and a personal account sits outside any contract you signed.

In Canada, the federal, provincial and territorial privacy commissioners' principles for responsible generative AI expect organizations to limit personal information going into these tools, and Quebec's Law 25 requires a privacy impact assessment for information system projects involving personal information. In the US, putting protected health information into an AI service without a business associate agreement creates a HIPAA problem, per HHS guidance on cloud services.

What stops it, in order: a written list of approved AI tools on business or enterprise tiers with training disabled; a one-page data classification that says plainly what may never go into a prompt; SSO on every approved tool so access dies with offboarding. Our data security and privacy work usually starts here because it is cheap.

Shadow AI is any AI tool, browser extension, meeting bot or AI feature in use without anyone in charge of security knowing about it. See What Is Shadow AI. Finding it takes about a week: pull OAuth grants from your Google Workspace or Microsoft 365 admin console, review browser extensions, check expense reports for AI subscriptions, and ask each team lead what AI their people use daily. The list is always longer than leadership expects.

Prompt injection is when instructions hidden in content the AI reads, such as an email, web page or shared document, override what the user or developer intended. OWASP's LLM Top 10 for 2025 lists it first and states that it is unclear whether fool-proof prevention exists. This stopped being theoretical in June 2025, when Microsoft patched CVE-2025-32711, dubbed "EchoLeak," an AI command injection flaw in Microsoft 365 Copilot that allowed an unauthorized attacker to disclose information over a network.

Excessive agency turns injection from embarrassing into expensive. An assistant that only reads is a leak risk. An agent that can send email, issue refunds or delete records becomes the attacker's tool. The fix is architectural: narrow permissions, separate credentials per agent, and human approval for anything irreversible. Our guide on how to secure AI agents goes control by control.

Most small businesses are not running autonomous agents yet. That is precisely the time to set the rule.

Then risks 4 to 6 move up the table. Your engineers are choosing models, pulling packages and exposing an AI endpoint to the internet. IBM found the most common causes of AI breaches were compromised APIs, applications or plug-ins (27%) and cloud misconfigurations affecting AI workloads (27%). We cover the pipeline side in Security in the MLOps Pipeline.

Customers will ask which framework you follow. The NIST AI Risk Management Framework gives you four functions, Govern, Map, Measure and Manage, and its Generative AI Profile (NIST AI 600-1) adds generative-specific risks. ISO/IEC 42001 is the certifiable option if enterprise buyers require it; our ISO 42001 readiness offering starts from your actual AI inventory.

A policy and an inventory will not stop an attacker who phishes your admin or a deepfaked CFO on a video call. Those need different controls. And no control fully prevents prompt injection today. Anyone selling certainty on that point is selling.

You also do not need a formal program if your only AI use is features built into software you already vetted, and you have confirmed nobody is using anything else. In that case write a one-paragraph acceptable-use rule and review it quarterly. If you still lack MFA on email and admin accounts, tested backups and an access list, fix those first. Most AI-related incidents we see trace back to one of those gaps.

The AI Governance Playbook packages these steps as templates. If you want someone to own them, our Virtual CISO Crawling tier starts from $2,000 a month for 15 to 20 hours, which is usually enough to run this 90-day plan.

On a business tier with training disabled, SSO and a clear data rule, yes. A personal free account holding customer data, no.

LLM02, Sensitive Information Disclosure. It is the most likely and the cheapest to reduce. Prompt injection (LLM01) comes next once AI tools can read external content.

Usually not at first. An inventory, policy and control map answers most questionnaires. Certify when a buyer requires it.

This post covers risk from AI you adopt or build, the core of our AI governance services. Attackers using AI against you is a separate threat model, covered in the attacker-focused post linked above.