Small Business Cybersecurity Lags Your Team’s AI Habit
Six in 10 owners now report staff reaching for public chatbots and writing assistants on the job, according to research Nationwide published Tuesday covering small and mid-market companies. Written rules governing that habit exist at just 36% of them.
Read that as a marketing problem and not only a security one. Your team is already putting customer names, pricing and campaign drafts into tools you have not vetted, and the first person to find out is usually a customer.
The Gap the Survey Measured
Edelman Intelligence fielded the study for Nationwide across roughly two weeks in July 2026, with each interview running about 20 minutes online. The numbers describe a fast adoption curve sitting on top of a very slow governance curve.
| Measure | Share of owners |
|---|---|
| Report staff reaching for public AI tools | About 60% |
| Have a written AI use policy | 36% |
| Provide responsible-use training | 37% |
| Believe staff use unauthorized AI tools | 35% |
| Have rules on what data may be entered | 27% |
| Verify AI output before acting on it | 25% |
| Keep a current plan for handling an incident | 35% |
| Want more resources on AI-enabled attacks | 82% |
The two lines worth staring at are the last ones in the middle. Barely a quarter of these companies have said out loud what data may go into an AI tool, and barely a quarter check the output before it drives a decision.
Why Brand Trust Is the Thing Actually at Risk
Security teams frame this as data leakage. Marketers should frame it as a credibility cost, because that is what a customer experiences.
An unverified statistic in a pitch deck, a competitor’s client name pasted into a shared prompt, a product claim invented by a model and published on your site: none of these trigger a breach notification, and all of them damage the thing you have spent years building. Our earlier reporting on AI guardrails found most professionals believe an AI-generated error already reached a client.
So the verification step is not bureaucracy. It is quality control on everything that carries your name.
The Fraud Side Is Already Here
Fraud built on generative tools reached 31% of these companies over the last 12 months, by the owners’ own count. Independent insurance agents see the same curve from the other side, with 52% reporting a rise in related claims.
Owners expect worse ahead. At least 90% think the technology hands criminals cheap scale, and 88% saw attacks grow more sophisticated across the last year. Bobbie Goldie, who leads commercial cyber at Nationwide, argues the fix starts with visibility: find out which tools your people reach for, then decide what information is permitted to leave the building.
Only 35% have a current incident response plan, which means most of these companies would improvise during the worst hour of their year. Anyone who followed the fallout covered in our piece on vendor risk management has seen how fast improvisation gets expensive.
A One-Week Fix That Costs Nothing
On Monday, ask your team which AI tools they actually use. Do not frame it as an audit, because you want honest answers rather than defensive ones. Write the list down.
On Tuesday, draft one page. Approved tools, a short list of data that never gets pasted anywhere, and a rule that anything customer-facing gets a human check before it ships. One page is enough, and one page beats the polished policy you never finish.
On Wednesday, run a 20-minute session walking through it. Adoption improves sharply when leaders use the tools visibly themselves, a pattern we covered in our reporting on AI in the workplace.
On Thursday, write the incident plan: who gets called, in what order, and which systems get locked first. The Small Business Administration publishes a free cybersecurity guide for small businesses you can work straight from. On Friday, put a recurring quarterly reminder on the calendar to revisit all of it.
Where This Goes Next for Small Teams
Expect customers to start asking. Enterprise buyers already send AI-use questionnaires to vendors, and that practice moves down market quickly once one large client starts.
Expect insurers to ask too. When more than half of agents report rising claims tied to AI-enabled fraud, underwriting questions follow, and having a written policy and a response plan becomes a pricing advantage rather than paperwork.
Questions on Small Business Cybersecurity and AI
Do I need to ban public AI tools?
Banning them usually pushes usage underground. Naming approved tools and prohibited data types works better.
What data should never go into a public AI tool?
Customer personal information, credentials, unreleased financials and anything covered by a client confidentiality agreement.
How long should an AI use policy be?
One page. Longer policies get skimmed, and a skimmed policy changes nothing.
Does cyber insurance cover AI-enabled fraud?
Coverage varies by policy and carrier. Ask your agent specifically how your policy treats social engineering and fraudulent instruction.
