Using AI at work, safely: 5 simple ways to save time and what not to share

AI is often treated as one thing, but it helps to separate the terms. Generative AI is what most people mean when they say “AI” today: tools like ChatGPT that create a work product in response to a prompt. Another category is agentive AI, which can take steps and make decisions to complete tasks for you. Some people also discuss artificial superintelligence (ASI), but we will save that for a future post.

Generative AI can be genuinely useful in day-to-day work, but most people have never been given clear guidance on what is safe to share with it. A simple rule is to use it for low-risk work like rough drafts and shaping ideas, and keep it away from anything confidential or identifying. That includes customer or employee details, names tied to real people, addresses, medical information, and technical specifics that reveal how your environment is set up, such as IP addresses, configuration files, usernames, access keys, and passwords.

5 practical, low-risk ways to use AI at work:

1. Drafting Everyday Emails
   • If you can describe what you want to say in a sentence or two, AI tools can turn it into a clean first draft. This can be helpful for follow-ups, scheduling, customer check-ins, and status updates. Be sure to still review it before sending, as AI can get the tone wrong or miss details, but it can remove the friction of starting from a blank page.
2. Summarizing Meetings and Long Notes
   • If you have general notes that don’t include confidential client details, employee information, financial data, etc., AI can turn a messy page of notes into a short recap, a list of decisions, or a set of action items.
   • A good note and rule of thumb: If you would not forward the raw notes to a broad internal list, do not paste them into an AI tool.
3. Organizing Notes and Turning Ideas Into a Plan
   • You may already have the right ideas, just not the time to structure them. If you have a rough list of tasks or thoughts, AI can help turn it into a step-by-step checklist, a short timeline, or a clearer outline for what happens next.
4. Creating Basic FAQs and Internal How-To Blurbs
   • You might need a simple document explaining how to request time off, submit an expense report, name and store files, or handle common customer questions. The key is that AI should create the initial version, and your team should confirm it’s consistent with how your business actually works.
5. Polish Writing You Already Have
   • If you remove confidential information first, you can paste a draft and ask AI to make it clearer, shorter, or more professional. This is useful for client emails, internal announcements, and basic proposals.

Now for the safety side and using AI.

The simplest rule is to treat most AI tools like a public space. Even if a tool claims to be private, your safest default is to avoid pasting anything that could cause damage if it were exposed.

Do not paste:

• Passwords, passcodes, MFA codes, or recovery codes
• Client information, especially anything confidential or identifying
• Financial information (banking details, invoices with sensitive fields, credit card data)
• HR information (employee records, compensation, performance notes, medical details)
• Contracts, legal documents, or anything under NDA
• Internal system details that could help an attacker (network diagrams or information, config files, admin credentials, security procedures)

AI is moving fast enough that many of the old “rules” about how quickly technology evolves are starting to feel outdated. That speed makes AI safety a practical concern, not a theoretical one. AI can also behave in a fractal way: a small piece of information can be reused in countless contexts, and it is not always obvious where it might show up later. Combine that with how quickly these tools can act, and it is worth pausing to think about your AI hygiene.

The goal is not to ban AI or let it run unchecked. It is to narrow its scope so it stays focused on the task you actually want solved, whether that is tightening up an HR policy or supporting medical research. On the user side, the best leverage we have right now is clear education and behavioral controls: practical guardrails that limit what goes in, where it goes, and who can access it.

Cardinal Point can help your team choose the right tools, set straightforward rules everyone can follow, and deliver training that emphasizes safe, day-to-day use.

1. Upgrade the Old Stuff (Yes, It’s Time)

2. Patch the Holes in Your Cybersecurity

• Is multi-factor authentication in place across all critical systems?
• Have our backups been tested recently?
• Do you have a multi-layer threat protection strategy in place for email threats?
• Are endpoints protected, and is Managed Detection and Response in place (MDR)?
• Do you have Identity Threat Detection and Response (ITDR) in place?

3. Fix the Friction in Your Remote Setup

4. Clean House: User Accounts Edition

5. Make Sure Your Tech Supports Your 2026 Goals

Let’s Make 2026 the Year Your Tech Works for You

As the holiday season approaches, many businesses experience a surge in activity, marked by increased transactions, heightened customer interactions, and a greater reliance on digital infrastructure. Unfortunately, it’s also the time when cybercriminals ramp up their efforts, targeting organizations that are distracted, short-staffed, or unprepared. 

At Cardinal Point Technologies, we believe proactive protection is the best defense. Here’s a quick cybersecurity checklist to ensure your business is ready for a secure and successful Q4. 

Audit User Access & Permissions

• Remove access for former employees. 
• Review and limit permissions based on current roles and responsibilities. 
• Reconfirm and/or enable multi-factor authentication (MFA) across accounts. 

Update and Patch All Systems

• Confirm your servers, operating systems, and applications are up to date. 
• Implement an update schedule to automate updates year-round. 
• Don’t overlook firmware updates for network equipment and printers; they’re often overlooked and can be vulnerable. 

Review Backup and Recovery Plans

• Test your data backup and restore processes now. 
• Ensure backups are stored securely both on and off network. 
• Verify your disaster recovery plan is updated and accessible. 

 Educate Your Team

• Human error remains the leading cause of security breaches. 
• Run a short phishing awareness campaign. 
• Remind your team to be cautious with holiday-themed emails, fake invoices, credential harvesting and gift card scams. These can be especially convincing now that attackers use AI to automate the process. 
• Reiterate password best practices, including password complexity and rotation. 

Monitor for Suspicious Activity

• Set up alerts for failed logins or unusual file access. 
• Review firewall and antivirus logs. 
• Work with your IT provider to ensure 24/7 monitoring is in place. 

Secure Remote Work Connections

If your team is working from home or traveling: 

• If possible, use systems and policies to implement a zero-trust strategy to security. 
• Only permit remote access to specific resources for employees who require it. 
• Make use of remote desktop/app software designed to provide secure access to critical resources. 
• Require MFA-enabled VPN usage for all remote access that can’t be achieved via other MFA protected alternatives such as remote desktop/app access. 
• Ensure laptops and mobile devices are encrypted, password protected and if possible, managed by mobile device management software (MDM). 
• Discourage the use of public Wi-Fi for sensitive work without protection. 

In today’s technology-driven world, IT strategy can no longer be viewed as a back-office function. It’s a core enabler of business success. And yet, in too many organizations—especially in the public sector and regulated industries—there’s still a disconnect between what the business wants to achieve and how IT is structured to support it. 

At Cardinal Point Technologies, we believe closing that gap is not just a best practice—it’s a strategic imperative. 

The Misalignment Problem 

The divide often begins with the way goals are framed. Business leaders focus on outcomes: improving citizen experiences, reducing operational inefficiencies, or accelerating mission delivery. Meanwhile, IT teams tend to focus on infrastructure, compliance, and operational uptime. These are both critical, but without a shared language and strategic alignment, they operate in parallel rather than in partnership. 

The result? Underutilized investments, delayed project timelines, and solutions that miss the mark. 

Strategy First, Technology Second 

We help clients realign by starting with strategy, not tech. That means: 

• Understanding business outcomes: What are you trying to solve, deliver, or transform? 

• Translating needs into architecture: How can cloud, data platforms, automation, or AI be intentionally applied to serve those outcomes? 

• Enabling continuous feedback loops: What governance and metrics will ensure IT evolves with business needs? 

Rather than “selling a solution,” we act as strategic advisors, embedding ourselves in your goals and only then architecting the right path forward. 

The Role of Partnership 

True alignment requires more than technical skill—it requires trust, communication, and clarity. When we sit with agency leaders, we’re not talking about tools. We’re talking about mission alignment, risk mitigation, and agility. That’s how transformation takes hold. 

We’ve seen this approach pay off—from streamlining data strategies for state agencies to modernizing federal systems under aggressive compliance timelines. In every case, the turning point came when IT stopped being a silo and started being a strategy partner. 

Moving Forward 

If your IT investments aren’t delivering business value, it’s time to step back and ask: Are we speaking the same language? Do we have shared goals? Are we measuring success together? 

Bridging the gap isn’t a one-time initiative—it’s a mindset shift. At Cardinal Point, we’re proud to help clients navigate that shift every day.