9.5 Questions to Answer for a Secure AI Foundation

How to Audit Your Tools and Build a Smart AI Strategy

Written by Allen Falcon, Co-Founder & CEO, Cumulus Global

Officially or not, your team is likely using artificial intelligence (AI) in their day-to-day work. The big question is whether those tools will help or hurt your business. To be truly effective, AI services need to be productive, secure, and affordable. With the AI hype machine pushing tools as quick fixes while businesses grapple with costs, security often gets overlooked.

Building a secure AI foundation protects sensitive information and intellectual property (both yours and your clients’) while preventing the hidden risks of unapproved software. To help you evaluate your current setup, we broke down these 9.5 essential questions into three practical categories.

See: What Is in Use

1) Which AI tools and agents are in use across the business, including those adopted without approval?

Unsanctioned tools hide data movement beyond your control. Adding extra tools can also duplicate capabilities you already have, leading to redundant services and higher costs.

2) Are employees accessing these tools through corporate accounts or personal credentials?

Personal logins mean you have no record of activity or ability to revoke access if someone leaves. You also lose the ability to manage information sharing and everyday workflows.

3) What company information has already been entered into AI tools, and by whom?

Pasting client records, IP, or financial data into public models can trigger immediate compliance violations under HIPAA, PCI, or state privacy laws. You may also violate industry regulations, contractual commitments, and non-disclosure agreements.

Secure: Where the Exposure Lies

4) What systems and records can each tool access, and is that access limited to what the role requires?

Managing individual and team access to information is no longer optional. With AI agents learning from your data, obscurity does not protect sensitive information from being discovered. Tools without proper permissions invite unnecessary exposure, breaches, and data leaks.

5) Have any integrations or connections been added since each tool was approved?

Checking access at implementation will not protect your organization long-term. As AI tools get used, permissions often expand automatically to enable new agents, workflows, and autonomous tasks. Managing AI security requires monitoring these permission changes over time.

6) Do employees know which categories of information should almost never be shared with an AI tool?

Not all information needs heavy locks, but sensitive data should almost never enter public AI systems. Most information falls somewhere in between. Setting clear permissions and data categories protects your organization before data ever leaves your system.

Steer: Who is Accountable

7) Which AI-generated work may be acted upon without human review?

Whether drafting documents or executing autonomous tasks, strict guardrails for human review will prevent costly and embarrassing errors.

8) What is the process when an employee requests a tool that is not yet approved?

A clear request path encourages safe innovation instead of hidden workarounds.

9) Could you demonstrate to a regulator, client, or insurer which AI tools have processed their data?

Having a clear audit trail is critical for maintaining client trust and meeting compliance standards.

Bonus Question

9.5) If a tool or its vendor were compromised, how quickly can you revoke access?

Almost no security setup is completely perfect, which is why having an immediate kill-switch is so important when an AI tool suffers a breach or malfunction.

We Can Help

With security and readiness assessments, and tools and services to monitor and manage security, our team can help you understand your current AI security posture, plan your environment, and deploy productive, secure, and affordable solutions.

Please contact us or meet with a Cloud Advisor to discuss your needs, priorities, and next steps.