The AI question most businesses are asking isn't quite the right one

Most leadership teams I speak to are curious about AI right now – and it comes up a lot in the Cyber Resilience sessions we run. Tools like Microsoft Copilot are much more visible than they were a year ago, and it’s not hard to see where they might save time or take the friction out of day-to-day work.

But there’s a gap.

The questions I hear most often are: Should we be using AI? Should we be looking at Copilot? Are we already behind?

These are all reasonable questions to be asking, but there are a few that probably need answering first.

What AI tools are people already using – and are any of them approved? What company data is going into them? Who can access what inside Microsoft 365, and have you actually checked your sharing and permissions before switching anything new on? Do your staff know what’s safe to put into an AI tool, and what definitely isn’t?

The issue isn’t that people experiment. That’s going to happen regardless, and a lot of it is useful. The problem is when it happens quietly with no guidance, no review of data access and nobody really owning the risk. That’s where things can get messy.

Getting this right doesn’t require a 40-page policy before anyone is allowed to touch anything. It does require some basics: a few clear rules, a small number of sensible use cases to start with, a proper look at permissions and data sharing, some practical training, and someone (or a small group) who’s actually responsible for deciding what’s acceptable.

The organisations handling this well aren’t blocking AI. They’re just pausing long enough at the beginning to avoid creating a bigger problem later.

That’s especially true with Copilot. It can be useful, but it works with whatever access and data you already have. If those foundations are in a mess, AI will expose that pretty quickly.

AI readiness isn’t really about rushing to turn something on. It’s about being able to answer honestly: Is our team clear on how to use it well? Is our data in reasonable shape? Are our permissions set up sensibly? Do we understand the risk we’re accepting?

There’s a lot here worth getting right. But it tends to work best when the unglamorous groundwork has been done first.