Every week there’s something new. A new AI tool. A new platform. A new way to work faster, cheaper, better. And the pressure is real.
Your competitors are adopting it. Your team wants to try it. Vendors are promising efficiency gains.
So the question becomes… should we use it?
Not “is it exciting?”
Not “is everyone else doing it?”
But, “Is it the right decision for our business and our clients?”
Because every new tool you introduce doesn’t just create opportunity, it also creates risk.
Risks around client data, access controls, third-party exposure and human behaviours.
And if you’re not careful, that risk builds quietly… until it doesn’t.
Good cybersecurity isn’t about saying “no” to everything. It’s about making better decisions. That’s where a simple risk framework helps.
Introducing my Seven-Step Risk Framework. In order. Every time.
Step One: Is it legal?
Are we allowed to use it? Does it meet regulatory expectations? If not, the decision is already made.
Step Two: Is it safe?
What could go wrong? How likely are they to? What’s the impact?
Break cyber into manageable risks, not one big, overwhelming problem. Perform a structured risk assessment and keep this information in a risk register.
Step Three: What can we use it for?
Define your boundaries, test, and make a decision about whether to use it - or not. Add it to your tech-approved products list, restrict usage if needed, or decline its use and add it to your products blacklist.
Step Four: How do we use it safely?
Approval isn’t control. Set clear guardrails, simple processes, procedures, and policies your team can actually follow. You might need to train your products to stay within your parameters.
Step Five: Has the team been trained?
This is where most failures happen. The way your team uses these tools will be the difference between great tools and lethal weapons. Training must be ongoing, practical, and focused on behaviour, not just knowledge.
Step Six: How do you know?
Trust isn’t enough. Monitor, review, and test.
Because after any incident, you won’t be judged on intentions, you’ll be judged on evidence. What proof or reports will you have to demonstrate the steps above?
Step Seven: How can we fix it when it goes wrong?
Because at some point… something will.
How fast can you respond? How well can you recover? How clearly can you communicate?
This is your incident response and business continuity capability. And this is where reputations are either protected… or lost.
Cyber doesn’t have to be complex. But it does have to be consistent. Because your reputation isn’t just lost in the breach itself. It’s lost in the months and years leading up to it, through the decisions you made… or didn’t make.
Seven simple steps make for better decisions, and stronger outcomes.
This is obviously just the short version. If you want the full version, with full risk registers for cyber risks, AI, and outsourced staff, reach out to me, and we can chat about how I can help.
Until next time, stay safe, look after your clients and their confidential information.
