This excerpt from the Orange Hat Tech Summit asks a direct question. How does a smaller, non-
technical business prepare for a cyber incident, and which policies should already be in place?
The panel starts with planning. An incident is possible, and saying otherwise does not reduce the risk.
The first control they name is training. Staff need a practical way to spot malicious email, stop clicking
unknown links, and recognize social engineering. They also point owners to a local trusted advisor. In
this talk, that means a managed service provider who knows the business, not a vendor pushing one
product.
Three base policies are named: business continuity, incident response, and AI governance. Writing
them down is not the finish line. The speakers press on practice. A policy copied from a similar
company and filed away does not help when someone must decide who to call, who the point of
contact is, or where the stakeholder map lives. Those answers should be known before an incident
starts.
AI governance is treated as an operating issue. Employees will use AI tools. The risks named here are
sending intellectual property into a public cloud tool, models that give false answers to customers or
staff, and insider misuse, including attempts to poison a model so it returns bad information.
The close is for owners who expect one internal hire to cover desk-side support and advanced security.
The panel says those are separate disciplines. A provider that has seen the same pattern across many
small businesses can bring a framework for continuity and incident response, then adjust it to the
company.
Key Takeaways
Acknowledge that an incident can happen, and write the plan before you need it.
Train staff to recognize malicious email, unknown links, and social engineering.
Put business continuity, incident response, and AI governance in place, then practice them.
Know who to call, who the point of contact is, and where the stakeholder map lives before an incident starts.
Set rules so staff do not send intellectual property into public AI tools, and watch for false model output and insider misuse.
Do not expect one internal hire to cover both desk-side support and advanced security. Partner with a provider that has those disciplines.