AI security advice for small businesses that don't have a security team

"Businesses, and in particular SMBs or SMEs, should not feel like they need to be experts themselves to navigate this," says Julian Tan, Group Director of Corporate Strategy at BT. Asked how small businesses should approach AI security, his answer wasn't a checklist. It was a reframe: the job isn't becoming the expert. It's knowing who to go to.

Most small businesses have no one to ask

If you run a small business, there's a good chance nobody on your team has "security" anywhere in their job title. Tan sees this gap clearly from BT's vantage point, even though BT has resources most small businesses will never have.

"SMBs are very exposed," he says, "they don't necessarily have the access or the resources to go after these." His answer isn't to somehow build that capability internally. "I think this is where partnerships are really, really important — knowing where to go and who you can go to so that you're able to employ these tools in a safe and effective way, and also protect yourself against potential threats that, now with AI, have become quite widespread."

Even a company with BT's resources doesn't treat this as solved. Tan describes cyber security internally as "a top priority [that] will only become more important as the space continues to develop, as more bad actors come up with new approaches and the broader geopolitical landscape continues to shift." If an organisation with that scale of resource treats it as ongoing, a small business shouldn't expect to solve it alone either.

What this actually means: don't try to become the expert

This framing removes a specific kind of pressure a lot of small business owners put on themselves. You're not failing at security because you haven't read up on AI threat models or don't understand data governance. "There are partners out there for businesses to partner with," as Tan puts it, "to make sure they're able to get the best and the most out of these opportunities whilst also mitigating any potential risks that come with them." The actual skill needed is knowing which partner or resource to go to, and using it.

Where to actually start

This is where the general advice becomes specific. AI for Growth's own AI Security Health Check exists for exactly this gap: a free tool built specifically so a small business without dedicated security expertise can get a straightforward read on where its AI use is exposed, without needing to hire anyone or commission a paid audit first. It's the practical first move that puts "know who to go to" into action rather than leaving it abstract.

This complements rather than replaces the licensing point covered elsewhere on this site. Using paid, company-provisioned AI accounts rather than free personal ones is the single biggest fix within your own control. This advice sits one level up from that: for everything beyond what a licensing policy covers, don't try to become the expert. Find the partner.

What to try this month

Run the free AI Security Health Check to get a baseline read on where your business currently stands, then treat "who would I actually call if something went wrong" as a real question worth having an answer to, before you need it, not after.

To run the free health check and connect with a wider community of UK small business owners working through the same security questions, join the AI for Growth community.