Kansas City businesses can adopt AI without creating their next security problem, as long as guardrails and a solid security foundation come first. That was the message from MDL Technology’s Justin Ruby when he spoke to the North Kansas City Business Council about AI and cybersecurity, two forces changing business at the same time. His main point: the opportunity and the risk are arriving at the same time.
AI is Already in Your Business
AI has moved from experimentation into everyday work. Employees use generative AI for writing, research, analysis, sales follow-ups, and customer responses, often before leadership has set any rules. Verizon’s 2026 Data Breach Investigations Report found that 45% of employees are now regular AI users on corporate devices.
Justin opened with a quick show of hands:
- Does someone in your company use ChatGPT, Copilot, or another AI tool?
- Do you know which AI tools your employees are using?
- Do you have a written policy on what company information can go into AI?
- If a key system were encrypted tomorrow, do you know how quickly you could recover?
The goal wasn’t a perfect score. It was an honest look at where most companies are today.
Start with Business Outcomes, Not the Technology
The wrong reason to adopt AI is “everyone else is.” The right reason is leverage: finding the places where AI makes your people more effective.
- Sales: research accounts, summarize calls, draft follow-ups, and speed up proposals.
- Operations: automate repetitive work, summarize information, and improve internal workflows.
- Customer experience: faster responses, better access to knowledge, and more consistent communication.
- Leadership: turn data into insights, prepare for decisions, and free up time for higher-value work.
Key Takeaway: AI should create leverage for your team, not a new unmanaged risk.
The Problem: Shadow AI
Shadow AI is what happens when employees adopt useful AI tools before the company has guardrails in place. That’s understandable, but it creates real exposure:
- Sensitive information can be pasted into consumer AI tools.
- Employees may not know what data is appropriate to share.
- Unapproved tools can create data, privacy, and vendor risks.
- AI-generated content can be inaccurate or misleading.
- A policy without training and technical controls is easy to ignore.
The answer isn’t banning AI. It’s setting reasonable guardrails and giving employees approved tools and training that make the right behavior easy. For more on what employees are already using, read our post on shadow AI.
Pro Tip: Justin’s simple rule for employees: if you wouldn’t email it to a stranger, don’t paste it into an unapproved AI tool.
AI has Changed the Cybersecurity Equation
Attackers have access to the same technology. AI helps them write polished, personalized phishing messages. Manipulated voice and video raise the risk of impersonation, which makes verifying sensitive requests, like a wire transfer or a change to payment details, more important than ever. Automation helps attackers scale their reconnaissance and attacks.
The FBI has long warned about business email compromise and social engineering. Verizon’s 2026 Data Breach Investigations Report adds two findings that matter for smaller organizations: exploited software vulnerabilities are now the most common way attackers get in, and small and mid-sized businesses make up the large majority of ransomware victims. The lesson is that security is no longer only an IT function. It’s a business process that involves people, process, and technology.
Need expert help preparing your business for AI? Contact MDL Technology to talk through your AI readiness.
What a Modern Security Foundation Looks Like
Security isn’t one product. It’s five areas working together:
- Identity: MFA, least-privilege access, and strong authentication.
- Data: classification, backups, and access controls.
- People: training, verification, and reporting.
- Endpoints: patching, protection, and monitoring.
- Recovery: tested backups, an incident plan, and business continuity.
Key Takeaway: If any one of these areas is weak, the business is exposed. Recovery matters just as much as prevention.
Are You AI Ready? A Five-Question Self-Assessment
Justin encouraged every business owner to take these questions back to the office:
- Do we have an AI policy?
- Do we know what AI tools employees use?
- Do we know what data can be entered into AI?
- Are our identities and critical systems protected with strong controls?
- Have we tested our recovery process, not just our backups?
A “no” isn’t a failure. It tells you where to start. Frameworks like NIST’s AI Risk Management Framework and its companion Generative AI Profile give organizations a practical place to begin managing AI risk.
The AI and Security Roadmap
For small and mid-sized businesses, the order matters:
- Assess: understand your current technology, security posture, and AI use.
- Secure: protect identities, endpoints, data, infrastructure, and recovery.
- Govern: set AI policies, approved tools, data rules, and accountability.
- Enable: train people and deploy approved AI capabilities.
- Optimize: automate workflows, measure outcomes, and keep improving.
You don’t want to automate a broken process or put sensitive information into AI before you know how that information should be protected. Our guide to building a 12-month AI roadmap goes deeper on planning.
What Your IT Partner Should Be Asking
The IT conversation should move from tickets to business outcomes. A strategic technology partner should be asking:
- What is the business trying to accomplish over the next 12 to 24 months?
- What technology risks could prevent those goals?
- Where can automation or AI create measurable gains?
- How would the business operate if a critical system went down?
- What should change now, and what can wait?
A good technology partner brings ideas before you have a problem. That’s the difference between an IT vendor and a technology partner.
Three Things to Do This Month
- Inventory AI use. Talk to your people, list the tools they use, and identify sensitive use cases.
- Secure the basics. MFA, patching, backups, access controls, training, and a tested recovery plan.
- Build a roadmap. Prioritize technology, security, and AI investments around your business goals.
The businesses that get the most from AI will be the ones that use it safely, strategically, and intentionally.
How MDL Helps Kansas City Businesses Get AI Ready
MDL Technology has provided managed IT and cybersecurity to Kansas City businesses since 2003. We help businesses connect technology strategy, cybersecurity, and AI readiness, so owners don’t have to become cybersecurity experts or AI engineers to make good decisions.
If you’re not sure where your business stands, start with an AI Readiness Assessment, or learn about AI Armor, MDL’s secure, managed environment for AI chat, workflows, and agents. Contact us to schedule a consultation.
