contents
Around a third of UK businesses are now using AI, adopting it, or actively considering it. That’s the finding from the government’s latest Cyber Security Breaches Survey, and on its own it’s good news. AI is already saving businesses real time on real work.
Here’s the finding that should give every business leader pause: of the organisations using or adopting AI, only around a quarter have any security practices in place to manage the risks. A third have no plans to put any in place at all.
In other words, most businesses are adopting AI faster than they’re securing it. That gap is where the problems start.
AI Cuts Both Ways
The same technology making your team more productive is making attackers more productive too. The ICO issued an advisory this year warning about AI-enhanced phishing, deepfake social engineering and automated vulnerability scanning.
You can see it in the numbers. Phishing remains the most common attack, experienced by 38% of businesses, and the businesses affected rated it the most disruptive threat they faced. The polished, personalised phishing email that used to take an attacker an afternoon now takes seconds, and deepfake audio is starting to appear in payment fraud aimed at finance teams.
So AI adoption isn’t just a question of what tools your business uses. It changes the threat landscape whether you adopt anything or not.
Shadow AI: The Risk You Haven’t Approved
Even if your business hasn’t formally adopted AI, your people almost certainly have. Staff pasting content into free AI tools to summarise a document, draft an email or tidy up some data is now completely normal behaviour. This is what’s known as shadow AI: unapproved tools being used with company information, outside any oversight.
The risk is simple. Whatever gets pasted into a free public tool leaves your control. That might be client details, financial information, or anything else covered by your data protection obligations. Nobody meant any harm, but the data is gone, and you’d struggle to say where.
Banning AI outright doesn’t fix this. It just pushes the behaviour further out of sight. The answer is giving your team an approved, governed way to use AI, so the productivity benefit stays and the data risk doesn’t.
The Microsoft Route to Safe Adoption
This is where being in the Microsoft ecosystem genuinely pays off. If your business runs on Microsoft 365, you already have the foundations for secure AI adoption:
- Microsoft Copilot works inside your existing security boundary. Your prompts and data stay within your tenant and aren’t used to train public models, which is the fundamental difference between Copilot and pasting company data into a free tool.
- Microsoft Purview lets you classify and protect sensitive information, so AI tools can only reach what they should.
- Entra ID and Conditional Access control who can access what, from which devices.
- Defender protects the identities and endpoints that AI-powered attacks target.
The catch, as ever, is configuration. Copilot respects your existing permissions, which means if your file permissions are a mess, Copilot will cheerfully surface documents people were never meant to find. Getting the foundations right before switching AI on is the single most important step, and it’s the one most often skipped.
Five Questions to Ask Before Going Further with AI
- Do we know which AI tools our people are already using, approved or not?
- Do we have a simple, written AI usage policy that staff have actually seen?
- Are our file permissions and data classification in good enough shape for an AI tool to respect them?
- Have we trained our team on AI-enhanced phishing and deepfake fraud, not just the classic red flags?
- Is someone accountable for AI governance, or is it nobody’s job?
If you can’t answer yes to most of those, you’re in the majority. That’s exactly what the survey found. But it’s a fixable position, and fixing it is far cheaper than the alternative.
How We Help
Our AI Adoption service is built for exactly this gap. We help you identify where AI delivers real value for your business, get your data, permissions and security ready first, and roll out tools like Copilot in a controlled way, supported by awareness training that covers the new generation of AI-driven threats.
As a Microsoft Solutions Partner across Security, Modern Work, Infrastructure and Data & AI, we can take you from “our people are probably using AI somewhere” to a governed, secure adoption that your board, your insurers and your clients can all get behind.
If you’re not sure where your business sits on that journey, that’s a conversation worth having sooner rather than later.
Sources: Cyber Security Breaches Survey 2025/2026, DSIT and the Home Office, April 2026; ICO advisory on AI-powered cyber threats, May 2026.
Contact our team
Consider this the shameless plug: if the numbers above made you wonder where your own business stands, that’s exactly the conversation we’re here for.
