A Practical Cyber Readiness Playbook for the AI Era

Business leaders often ask a version of the same question: “Are we safe?” The honest answer is that no organization is completely safe. Technology has evolved faster than the security controls built to contain it, and AI now lets attackers produce convincing websites, cloned voices, and scam messages in minutes. 

The good news is that the fundamentals still work. The harder truth is that prevention alone is no longer enough. Cyber readiness comes down to three things: strengthening the basics, setting clear rules for AI, and building a business that can recover when something gets through. 

Walking into an organization for the first time, three questions reveal most of what matters. 

Is multi-factor authentication enforced everywhere? MFA is one of the strongest controls an organization can deploy, and it can prevent ransomware over 60% of the time. It must cover every user, including privileged accounts. It should be paired with strong password policies. Length and complexity matter more than frequent rotation, because longer passwords are harder to compromise. 

Is zero trust in place? The principle is to trust no device or user by default, regardless of location. It can be hard to implement, but without it, an attacker who gains access to an account that a server trusts has effectively won. Least-privilege access limits how far a compromised account can go. 

Is anyone watching? Continuous monitoring and incident detection give a security team the alerts it needs to triage and respond. A control that can’t be observed is one that can’t be relied on. 

The most common gaps aren’t exotic. 

The first is vulnerability management. Legacy systems carry risk because manufacturers stop issuing patches. Scanners will flag plenty of findings, and not every one is urgent, so each should be evaluated by severity and the risk it poses to the organization’s systems. What can’t happen is a finding going into a ticket and sitting there for three months. Someone has to put eyes on it. 

The second is an incident response plan that exists only on paper. Too often it sits in a wiki or file share that nobody opens. An untested plan doesn’t tell a team who to call, who to escalate to, or which stakeholders to loop in. Testing it builds those lines of communication before they’re needed, and a data breach will require a lot of people. 

Social engineering works by getting someone to act before they think. AI makes that easier. The telltale signs once relied on, like awkward phrasing, are disappearing, and the sites attackers send people to now look legitimate. In one message that appeared to come from Microsoft, the only giveaway was a zero in place of the letter “o.” At a glance, nobody would notice. 

In another case, about 50 users at a professional services firm had their accounts harvested with nothing more than pictures of cats. People click on what feels familiar or appealing, and attackers know it. 

The defense is a culture of skepticism and escalation. Employees who aren’t sure about a message should report it so the security team can validate it and purge it if it’s malicious. If the source is unknown, it shouldn’t be trusted. That’s zero trust applied to human behavior. 

Employees are likely already using AI tools. The question is whether they’re doing so under rules the organization has set. 

It starts with data classification. The policy should be updated to reflect what can go into AI tools, and an acceptable-use policy should be built on top of it. Public information is fine. Proprietary and confidential data is not, including client financial information, Social Security numbers, bank account numbers, and other personal or health information. Entering it can also violate client contracts. 

Next comes an inventory of the systems AI touches. Few IT leaders can say with confidence how many there are. Through shadow IT, AI can end up everywhere without anyone deciding it should. 

There’s also a difference between free and enterprise tools. Free tools come with no meaningful restrictions or security controls, and inputs may be used to train the models. Enterprise agreements are different, though the cost can be high. 

Finally, building in-house is worth considering. A homegrown solution means knowing the workflows, where the data goes, and how it’s used. At Sensiba, AI supports the review work in the firm’s audit platform, but a human stays in the loop to validate the output. 

One company’s experience shows what’s at stake. Someone had sent a résumé to the HR portal, HR opened it, and everything broke loose. Ransomware locked the on-premises backup servers, and there were no cloud backups or any secondary location. The company was down for over a month and had to move everything to the cloud just to get running again. The financial and reputational damage is hard to overstate. 

The lesson is that incident response and disaster recovery are critical. Containing an incident quickly and limiting its blast radius matters most in the moment. And it’s no longer a question of if an organization will be breached, but when. Resilience means restoring operations fast. 

That starts with backups. They should be synced to a secondary location on a schedule the organization defines, more often for back-end systems. Offline copies should be readily available. Immutable backups are the strongest option; no client conversation to date has surfaced immutable offline backups being affected by ransomware. 

Then come the numbers: the recovery point objective (how much data can be lost), the recovery time objective (how long restoration takes), and the maximum tolerable outage. 

How can an executive know the organization is ready? By running tabletop exercises and testing backups, including a full restoration. That is the real measure of readiness. 

If every organization did one thing, it should be this: implement MFA across the entire organization, for every user, including privileged accounts, no exceptions. It’s the most effective step you can take quickly. 

From there, the work builds on itself: a data classification policy, an AI usage policy, tested backups, and a response plan the team has rehearsed. AI raises the stakes, but disciplined fundamentals and a tested plan to recover keep an organization in control. For help assessing where things stand, Sensiba’s GRC team is available.