AI consulting for businesses that want the speed without the data leak.

Which business processes can AI speed up?

AI pays off fastest on work that is high volume, text heavy, and repetitive, where a person still checks the result: drafting, summarizing, sorting, and pulling answers out of documents you already have. It pays off least on rare, high-stakes decisions, and on processes that are broken before AI touches them.

These are the processes where small and mid-sized businesses most often find time, and the risk that comes with each:

How we decide what is worth automating

Every candidate process gets scored on four questions: how often it happens, how long it takes a person, how costly a mistake would be, and how sensitive the data is. A task done 200 times a month with low-risk data goes to the top. A task done twice a year with client health records goes to the bottom, no matter how impressive the demo looked. We also check the tools you already pay for first, because the AI built into Microsoft 365, Google Workspace, or your line-of-business software is often enough.

Is ChatGPT safe for business data?

ChatGPT and similar tools can be safe for business use, but only with a business account, the right settings, and written rules about what data goes in. The risk is rarely the tool itself. It is an employee using a free personal account, under consumer terms your company never agreed to, to summarize a client contract.

Business and enterprise plans from the major AI vendors usually include contract terms on whether your data is used for training, how long it is kept, and who can see it. Read those terms, or have us read them, before you approve a tool. Then make the approved option easier to use than the unapproved one.

Shadow AI: the AI you did not approve

Shadow AI is any AI tool your staff use for work without the company approving it. It is the most common AI risk for small businesses, because it is invisible: no purchase order, no IT ticket, just a browser tab.

It is also widespread. In Microsoft and LinkedIn's 2024 Work Trend Index, a survey of 31,000 people in 31 countries, 78% of AI users said they bring their own AI tools to work. And IBM's 2025 Cost of a Data Breach research found that one in five organizations reported a breach due to shadow AI, and that organizations with high levels of shadow AI saw an average of $670,000 in higher breach costs.

Sources: Microsoft and LinkedIn 2024 Work Trend Index; IBM 2025 Cost of a Data Breach announcement.

The fix is not a ban. It is an inventory of what is in use, one or two approved tools, and a policy that tells people what they can do, not only what they cannot.

Microsoft Copilot readiness: fix permissions first

Microsoft Copilot (formerly Microsoft 365 Copilot) works inside your existing permissions. Microsoft states that Copilot "only surfaces organizational data to which individual users have at least view permissions." That is good design, and it is also the problem: if a folder of HR files was shared with "everyone" years ago, Copilot will happily summarize it for anyone who asks.

Source: Microsoft Learn, Data, privacy, and security for Microsoft Copilot. Microsoft's own deployment guidance starts with remediating oversharing before setting guardrails.

A Copilot readiness review looks for sites, Teams, and OneDrive folders shared too broadly, sensitive data without labels, and accounts that still have access they no longer need. Your MSP makes the fixes. We tell them which ones matter most and check that they are done before licenses go out. The same thinking applies to Google Gemini in Google Workspace.

What should an AI acceptable use policy include?

An AI acceptable use policy should fit on two pages and answer six questions every employee has: which AI tools are approved, what data must never be entered, when a person has to review AI output before it is used, how to label AI-generated work, how to request a new tool, and who to call when something goes wrong.

• Approved tools. Named, with the account type, such as "the company's ChatGPT business workspace" or "Copilot, signed in with your work account," not "AI tools."
• Data that never goes in. Customer personal information, health data, passwords, financial account numbers, and anything under a confidentiality agreement, unless the approved tool is cleared for it.
• Human review. Anything sent to a customer, filed with a regulator, or used to make a decision about a person is checked by a person first.
• New tools. A simple request path with a fast answer, so people do not route around it.
• AI features in existing software. Many tools you already use now ship AI features. The policy covers those, too.
• Incidents. If sensitive data went into the wrong tool, who to tell and how fast.

The Ten-Day AI Plan includes this policy, written for your company and your tools, ready to adopt.

What are the security risks of AI in a small business?

The main risks are data leaking into AI tools, AI output that is wrong but trusted, AI features that can be manipulated through the content they read, and AI agents given more access than they need. The OWASP Top 10 for LLM Applications, the most widely used list of AI application risks, puts prompt injection first and sensitive information disclosure second in its 2025 edition.

• Sensitive information disclosure. Staff paste confidential data into a tool, or an internal AI assistant shows it to the wrong person.
• Prompt injection. Hidden instructions in an email, web page, or document trick an AI assistant into doing something it should not, such as forwarding data.
• Excessive agency. An AI agent that can send email, move money, or change records is given broad access "to save time."
• Supply chain. A browser extension, plugin, or small AI vendor with weak security now holds your data.
• Overreliance. A wrong number in a report, or a made-up clause in a contract summary, goes out because it sounded right.

Source: OWASP Top 10 for LLM Applications 2025. AI also changes existing threats: phishing emails are more convincing, and voice cloning makes "the CEO called and asked for a wire" scams easier. Your incident response plan and payment verification rules should account for that.

AI governance frameworks, sized for a small business

You do not need an AI certification to use AI responsibly. You need a short list of decisions, owners, and rules, built on a recognized framework so it holds up when a customer or auditor asks how you govern AI.

• NIST AI Risk Management Framework (AI RMF 1.0). Released by NIST on January 26, 2023, and organized around four functions: govern, map, measure, and manage. NIST added a Generative AI Profile (NIST-AI-600-1) on July 26, 2024. This is our backbone.
• ISO/IEC 42001:2023. The international standard for an AI management system. Worth borrowing from if a large customer expects it; rarely worth certifying against at 10 to 500 employees.
• OWASP Top 10 for LLM Applications. The checklist for any AI assistant, chatbot, or agent you build or buy.

Source: NIST AI Risk Management Framework. If you already have a security program built on NIST CSF 2.0, AI governance slots into it rather than starting over. See our cybersecurity risk assessment.

Customers and auditors are starting to ask about AI

AI questions are showing up in vendor security questionnaires. The Cloud Security Alliance, which publishes the CAIQ questionnaire many software buyers use, released an AI Controls Matrix in July 2025 with 243 control objectives across 18 security domains, and an AI-CAIQ that maps questions to it for evaluating third-party vendors.

Source: Cloud Security Alliance AI Controls Matrix. If a questionnaire with an AI section is already on your desk, that is exactly what the Ten-Day Answer is for. Our security questionnaire guide covers how to answer honestly when the true answer is "not yet."

AI laws in Washington, Idaho, and beyond

As of October 2026, we are not aware of a broad Washington or Idaho law that regulates how most businesses use AI. That does not mean AI use is unregulated. The laws you already follow still apply to the data you feed into AI tools.

• Washington's AI Task Force. Created by ESSB 5838 in 2024 and run by the Attorney General's Office, it released its final report on July 1, 2026, with 11 policy recommendations across its reports. More legislation may follow.
• Existing privacy and security law. Health data entered into an AI tool is still covered by HIPAA and by Washington's My Health My Data Act. Customer financial data is still covered by the FTC Safeguards Rule. An AI vendor that handles protected health information needs a business associate agreement.
• Colorado. If you use AI to make consequential decisions about Colorado residents, such as hiring, lending, or housing, note that Colorado replaced its 2024 AI Act with SB26-189 in May 2026, with key duties starting January 1, 2027.

Sources: Washington AG, AI Task Force; Colorado General Assembly, SB26-189. We are not lawyers. We flag where AI use touches a legal question so your counsel can answer it.

How much does AI consulting cost?

Independent AI consultants publish hourly rates anywhere from roughly $100 to $1,000 an hour. One widely circulated rate card puts multi-month AI strategy engagements at $25,000 to $75,000, and we found fixed-fee Microsoft Copilot readiness assessments published at around $5,000. CyberCascadia's Ten-Day AI Plan is $3,500, fixed.

Hourly AI consulting makes sense for one narrow question. For anything bigger, a fixed fee protects you from paying for the consultant's learning curve. See what a vCISO costs for how our ongoing pricing works.

Why an advisory-only AI consultant?

Many AI consultants make money from what they recommend: they resell licenses, earn partner commissions, or bill for the build. That does not make them wrong, but it means the person deciding whether you need a new AI tool profits when you buy one. CyberCascadia sells no products, resells nothing, takes no vendor commissions, and never touches your systems. Your MSP, IT team, or software vendor builds what we recommend, and we check that it was done right. If the best answer is "use the AI you already pay for" or "do not automate this," that answer costs us nothing to give.

We also work alongside your MSP, not against it. Most MSPs are glad to have a clear, prioritized AI plan instead of a vague request to "do something with AI." See MSP security oversight for how that relationship works.

AI consulting in Tacoma, Spokane, and North Idaho

CyberCascadia is based in Bonney Lake and works with businesses across Tacoma and Pierce County, Spokane and Eastern Washington, and Coeur d'Alene and North Idaho, with in-person process workshops where they help. The Ten-Day AI Plan also runs fully remote for businesses anywhere in the United States.