5 cyber risks founders take every time they use AI tools

A business insurance renewal turned into a wake-up call about AI risk. The writer found that a standard consultancy policy covered digital marketing advice, but not AI advisory or cybersecurity. A new contract with more AI training made the gap feel even more real. And that’s the point: plenty of founders may already be exposed and not know it.

The first risk is simple. Paste in an email, meeting note or document, and that information leaves the business. Some tools keep conversations and use them to train models by default. The fix starts with privacy settings, but the bigger habit change is knowing what never belongs in a prompt: client details, passwords, bank information.

Then come connectors. Once an AI tool is linked to email, files or a calendar, it stops being just a chat box. It can read, draft and sometimes send. That convenience also creates a back door into the working system, with third-party links sitting between the model and sensitive data.

Scams are getting sharper too. The advice here is old-school but useful: hover over links, strip out personal details before pasting suspicious emails into AI, and trust the feeling that something is off. The source also flags voice scams, fake images and videos, which makes caution less like paranoia and more like basic hygiene.

AI can also sound right while being wrong. Large language models are confident, even when they’re bluffing. That is easy to spot in your own field and much harder outside it, so checking references and doing your own research matter more than the polish of the output. The final trap is insurance: generic policies may not say much about AI, and in the UK AI consultancy often sits under IT consultancy while cyber cover is usually not standard. The practical advice is blunt. Write an AI policy, set rules, keep a human in the loop, switch off training where you can, and call the insurer rather than trusting the checkbox form.