How to buy AI security as a small business

Security used to be a page in your AI vendor’s documentation. It is now a market. There are models trained specifically to find vulnerabilities, gateways that inspect prompts on the way past, an alliance with more than 100 logos on the slide, and a certificate you can put in your footer. Vendors have worked out that the phrase closes deals, and some of that pitch is now aimed at businesses with four employees and no security team.

The awkward part is that the pitches are not wrong about the risk. They are usually wrong about the buyer. Almost everything sold under the label solves a problem created by scale, and the thing that will actually hurt a two-person business is a setting nobody changed. This guide is for a solo operator or small-team owner who uses AI tools every day and has started getting the emails. It is not for anyone running a security operations centre, and it is not a guide to securing a product you are building on model APIs. The job here is to tell four different products apart, price one of them honestly, and leave with a shorter list than you arrived with.

Four different products are wearing the same label

The first thing sold as AI security is AI doing security work. Microsoft introduced MAI-Cyber-1-Flash on 13 August 2026, a model built to find vulnerabilities in complex codebases, running inside a multi-agent system called MDASH, and claims 96% on the CyberGym benchmark on that benchmark’s any-crash score along with a 50% cost saving against its previous configuration [2]. The announcement describes role-based controls, tenant isolation and encryption [2]. Read the shape of that offer rather than the score. It assumes you have a codebase, a vulnerability backlog, and somebody whose week is spent on both.

The second is securing your own use of AI, which is the category that actually contains your risk. The OWASP Gen AI Security Project’s Top 10 for LLM Applications puts Prompt Injection at LLM01 and Excessive Agency at LLM06, alongside Sensitive Information Disclosure and Improper Output Handling [4]. Those are not exotic. They describe an assistant reading a web page that contains instructions, and an assistant holding a permission it did not need.

The third is open shared tooling. NVIDIA announced the Open Secure AI Alliance on 27 July 2026 with more than 100 inaugural partners, including Microsoft, Amazon, Cisco, CrowdStrike, GitHub, Hugging Face, IBM, Intel, Red Hat and Salesforce, to develop and share open technologies, techniques and tools for safeguarding software and agents [3]. Its output is open models, agent harnesses and guardrails, identity frameworks such as SPIFFE and SPIRE, and safe model formats [3]. That is infrastructure for people who build things, and it arrives inside the tools you buy rather than as something you install.

The fourth is assurance paperwork. ISO/IEC 42001:2023, titled “Information technology — Artificial intelligence — Management system”, was published in December 2023 and specifies requirements for running an AI management system; the standard itself costs CHF 225 to read [8]. A vendor’s badge against it says the vendor has a governance process. It is worth something when you are the customer. It is a project, not a purchase, when you are the one being certified.

Nothing on that list is fake. Three of the four are simply built for organisations with more surface area than you have.

The price tag tells you who the product is for

When you cannot tell whether a security product is aimed at you, read the pricing page before the feature list. Microsoft Security Copilot is billed at $4 per provisioned Security Compute Unit per hour, with a minimum of 1 provisioned SCU, and overage capacity at $6 per SCU per hour, billed monthly [1].

Work that through. One SCU held continuously through a 730-hour month is $2,920 before any overage, and the unit is compute you provision rather than a seat you assign [1]. That is not a hostile price. It is a coherent price for a team running investigations most days, where the alternative is analyst hours. It is also a clear statement about who the product expects on the other side of the invoice. If a product’s smallest possible configuration costs more per month than your entire software stack costs per year, the answer is not to negotiate. The answer is that you are not the buyer, and a vendor who tells you otherwise is selling you the wrong thing.

Your exposure is the permission you granted, not the model you chose

The failure that actually reaches a small business is not a novel attack on a model. It is an assistant with a connector, reading something an attacker wrote, and acting on it with your credentials.

The vendors are unusually direct about this. OpenAI, writing about prompt injection on 7 November 2025, describes it as third parties embedding malicious instructions in content the system encounters, and says plainly that it “remains a frontier, challenging research problem, and just like traditional scams on the web, we expect our work to be ongoing” [5]. Its advice to users is to limit an agent’s access to only the sensitive data or credentials it needs, to give explicit instructions rather than broad ones because that makes an attacker’s job harder, and to actually read the confirmation prompts instead of clicking through them [5].

Anthropic published numbers for the same problem in the browser. Across 123 test cases representing 29 attack scenarios, autonomous browsing showed a 23.6% attack success rate when deliberately targeted, which its mitigations reduced to 11.2%; browser-specific attacks such as hidden form fields and injections through invisible page elements went from 35.7% to 0% [6]. The second figure is the good news. The first is the one to plan around, because 11.2% is not zero and the mitigations that produced it are the vendor’s, not yours.

That is why the permission is the control. A prompt injection can only do what the session it hijacks is allowed to do. An assistant that can read one shared folder and post nothing is a nuisance when it is fooled. An assistant holding an email account, a payment tool and a live shell is an incident.

Most of your coverage is already in the settings you skipped

Start with what the tools already ship. Claude in Chrome lets you grant or revoke access to specific sites at any time in Settings, asks before high-risk actions such as publishing, purchasing or sharing personal data, and blocks whole categories including financial services outright [6]. OpenAI’s guidance points the same way, toward narrow access and explicit tasks [5]. Neither of those is an upsell. Both are a Tuesday afternoon.

Then do the boring layer underneath, which is where most of the actual attacks live. The UK’s National Cyber Security Centre describes Cyber Essentials as the minimum standard of cyber security recommended by government for organisations of all sizes, built on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection [7]. It notes that most cyber-attacks are basic in nature, “the digital equivalent of a thief trying your front door to see if it’s locked” [7]. None of those five controls mentions AI, and all five bound what an AI tool of yours can be used to reach.

The order matters more than the effort. Doing the five controls and the permission review costs you an afternoon and covers the cases that plausibly happen to a business your size. Buying a product first covers a case that has not happened to you yet, and leaves the front door untried.

Reading the claim before you read the demo

Three habits keep vendor material honest, and all three work on a page rather than in a meeting.

Ask which score you are being shown. Microsoft’s own announcement gives three numbers for the same system on the same benchmark: 96% on any-crash, 90.4% on target and any-of, and 86.3% on final submission [2]. All three are presumably accurate. They measure different things, and the gap between the headline and the strictest reading is close to 10 points. When a number appears without its scoring method, that is the finding.

Ask what the certificate certifies. ISO/IEC 42001 specifies a management system for organisations that develop, provide or use AI [8]. A vendor holding it has documented how it governs AI, which is a real signal about the company. It is not a test result about whether a specific feature resists a specific attack, and a sales deck will happily let you read it as one.

Ask what has actually shipped. More than 100 organisations joining an alliance tells you where the industry expects to need shared defensive tooling [3]. Membership is a logo until the tools land in something you use. Track the output, not the announcement, and note that the two vendor moves described here arrived within about three weeks of each other in mid-2026 [2][3]. Products that appear that fast after a market turns were mostly built before it turned. The news decided the launch date, not the roadmap, which is a reason to judge them on the same evidence you would have wanted a year earlier.

What still goes wrong

The permission discipline in this guide has a cost, and it is paid in the exact moment you are busiest. Narrow scopes mean an agent stops and asks. Confirmation prompts mean a task takes 4 clicks instead of 1. The realistic failure is not that you disagree with any of this. It is that on a bad Thursday you grant broad access to finish something, and never take it back. Put a recurring 20 minutes in the calendar to revoke, because nobody does it from memory.

The advice also has an expiry date. Every figure here was read from the vendor’s or standards body’s own page on 4 September 2026, and prices, benchmark claims and default settings all move. The 11.2% residual attack success rate Anthropic published is a snapshot of one vendor’s mitigations at one moment [6], and OpenAI has already said out loud that this class of problem is ongoing rather than solved [5]. Treat any number in this category as something to re-check, not a standing fact.

And there is a point where the honest answer changes. If you take custody of client data under a contract that specifies controls, if you have staff who can grant access without asking you, or if you are building a product on model APIs where the injected instruction reaches someone else’s customer, you have moved past what settings and an afternoon can cover. At that point the category stops being an upsell and starts being procurement, and the right move is to price a product properly rather than to keep economising with a checklist written for a smaller business.