Artificial Superintelligence (ASI): Should Businesses Be Paying Attention?

By Grant Andres, Owner, Cardinal Point Technologies

Over the past couple of years, AI has gone from a buzzword to something businesses use every day. Whether it’s helping write emails, summarize meetings, or automate repetitive tasks, AI is quickly becoming part of the way we work.

Now there’s another term starting to make its way into the conversation: Artificial Superintelligence (ASI).

It sounds like something out of a sci-fi movie, but it’s worth understanding, especially for business owners trying to stay ahead of what’s next.

So, What Is ASI?

In my last two blogs, we talked about Generative AI and Agentive AI, both of which are designed to do specific things really well. They can generate content, analyze data, answer questions, and streamline workflows, but they still rely on humans for direction.

Artificial Superintelligence, or ASI, is the idea of an AI system that could outperform humans across virtually every domain, from problem solving and research to creativity and strategic thinking. The important thing to understand is that it’s still a theoretical concept, and one that’s genuinely in flux. On one side of the debate, you have experts who argue it doesn’t exist yet and who actively work to dispel public fear. On the other side, you have experts who believe the tide is already at our toes and that we’re not prepared for what’s coming. What’s worth noting is that both camps are populated by people who are genuinely deep in the technology; this isn’t a case of informed experts versus uninformed alarmists.

Understanding the motivations on both sides matters, but so does looking clearly at what AI can already do. We have robots that play tennis at a competitive level, navigate unpredictable real-world environments, and make autonomous decisions in the process. On the frontier model side, Anthropic’s Fable 5 (its most advanced model at the time) was briefly pulled from public access in June 2026 after the U.S. government issued an export control order citing national security concerns. The specific worry, as reported at the time, involved a jailbreak method that could unlock certain cybersecurity related capabilities in a narrow set of circumstances (not a wholesale exposure of security flaws across existing software and systems, as it’s sometimes described secondhand). Anthropic itself pushed back on the scope of the concern, but the episode is still a useful data point: it shows regulators are already treating today’s models as capable enough to warrant this level of intervention.

There’s a second, more immediate gap worth naming here too. Even as we debate how close ASI actually is, most individuals and businesses (including many who’d tell you they’re “using AI”) are operating at a fairly rudimentary level: prompt based chats, with someone manually copying the output into a spreadsheet or another system rather than anything resembling real integration. The numbers back this up. As of late 2026, 78% of companies report using AI in some capacity, but only 27% have achieved full, enterprise-wide deployment; the rest are still experimenting or running AI in isolated pockets rather than as part of a connected, company-wide strategy.*

My view is that we’re further along this road than most people assume, but we’ll face real material constraints in energy and compute capacity that will act as a temporary brake on how fast ASI, if and when it fully arrives, actually materializes. And that’s the gap I want to spend the next section on. Because whatever pace ASI ends up arriving at, most businesses aren’t even close to getting full value out of the AI that already exists today, and that gap is what’s going to separate the companies that thrive over the next few years from the ones that get left behind.

Why It Matters

So if most businesses are still stuck at the rudimentary end of AI adoption, and true ASI is still theoretical, why does any of this matter right now?

Because the distance between “using AI” and “using AI well” is closing faster than most people expect, and the businesses that close it first are the ones setting the pace for their industries. Just a few years ago, very few businesses imagined using AI as part of their daily operations. Today, many organizations couldn’t imagine going without it. That shift didn’t take a decade; it took a couple of years.

Whether ASI arrives in ten years, in some more limited form sooner than that, or never quite the way people imagine, the technology we’re seeing today is already moving businesses toward increasingly capable systems. The gap we just talked about (most companies dabbling, few actually integrated) is exactly the gap that determines who’s ready for that next wave and who’s caught flat-footed by it. Businesses that take the time to understand these changes now will be in a far stronger position than those waiting for the technology to force their hand.

And when you need help understanding it all, we’re here for you.

The Real Opportunity

Closing that gap isn’t about chasing ASI, or even chasing AI for its own sake. It’s about what AI, even at today’s level, actually frees people up to do.

One of the biggest misconceptions about AI is that it’s here to replace people. From what we’ve seen firsthand with clients, the real value is in helping people spend less time on repetitive, manual work, and more time on the things that require experience, creativity, and good judgment. That’s where businesses are seeing the biggest wins today: not from some dramatic AI takeover, but from quietly reclaiming hours that used to go into busywork. As AI becomes more capable, we expect that trend to accelerate, which makes it even more valuable to build the habits and integration now rather than later.

Don’t Forget About Security

None of that opportunity is worth much if it isn’t handled responsibly, and this is something we stress with our clients constantly. As AI gets smarter and more embedded in daily operations, using it responsibly becomes just as important as using it at all.

Every business should be thinking through questions like:

• What information can employees safely share with AI?
• How do we verify AI-generated content?
• What policies should we have in place to protect company data?

AI can be an incredible tool, but like any technology, it works best when paired with good processes and strong cybersecurity. For most organizations, that means:

• Building AI literacy across your team.
• Creating clear policies for responsible AI use.
• Identifying repetitive processes that can be automated.
• Reviewing cybersecurity practices to protect sensitive information.
• Working with your Cardinal Point team, who understand both the opportunities and the risks.

The Takeaway on ASI

We may still be years away from Artificial Superintelligence, or it may never develop exactly as people imagine. But the bigger takeaway is the one we opened with: AI is advancing quickly, most businesses are still only scratching the surface of what it can do for them, and that gap is only going to matter more, not less, as things keep moving.

The businesses that stay informed and start closing that gap now will be in a much better position than those who wait until the technology has already changed the way their industry operates. At Cardinal Point Technologies, we’re focused on helping businesses adopt AI in practical, secure, and meaningful ways.

Sources:

*McKinsey Global Surveys on the state of AI

https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai-how-organizations-are-rewiring-to-capture-value?utm_source=chatgpt.com

Agentive AI Is Powerful. It Also Needs Guardrails. 

By Grant Andres, Cardinal Point 

In our last post, we discussed generative AI and how businesses are increasingly using it to create content, summarize information, and save time. This time, I want to talk about the next step in that conversation: agentive AI. 

You are going to hear this term more and more, and for good reason. Agentive AI has the potential to do more than respond to prompts. It can take action, make decisions within a set of rules, and carry out steps toward a goal with less human involvement. 

That is exciting. It is also where business leaders must slow down and ask probing questions. 

From where I sit, the most important conversation around agentive AI is not just what it can do. It’s about using it responsibly, especially when it comes to protecting your business. 

What agentive AI actually means 

Most people are familiar with AI tools that generate something after you ask for it. You type in a question, and it gives you a response. You ask for a summary, and it gives you one. 

Agentive AI goes a step further. 

Instead of simply answering, it can carry out tasks. It can pull information from systems, evaluate options, make choices based on rules, and continue through the process with minimal human input. 

For a business, that could look like an AI tool that: 

• sorts and routes support tickets 
• flags unusual account activity 
• gathers information from multiple systems and builds a report 
• coordinate input from multiple systems using programmatic API calls and synthesizes workable spreadsheets in a predictable format without any human interaction 
• writes software source code using only prompts and deploys working systems to cloud-based infrastructure in Amazon AWS, Microsoft Azure, etc. 
• handless parts of an internal workflow automatically 

That kind of efficiency gets people’s attention quickly, and I understand why. Business owners are constantly looking for ways to help their teams work smarter. 

But when a tool operates within your business, the security conversation changes. 

Why security has to come first 

The moment AI starts doing more than generating ideas, the stakes get higher. 

A system that can take action inside your business should never be treated casually. If it has access to your data, systems, users, or operations, it needs clear boundaries. 

That is true whether you are a small business or a larger organization. 

I think one of the biggest mistakes companies can make right now is jumping into AI tools because they feel pressure to keep up, without really understanding what those tools can access or what they are allowed to do. 

That is where problems start. 

The real risk is not the buzzword. It is the access. 

I do not think businesses should be afraid of agentive AI. I do think they should be cautious about how much trust they hand over too quickly. Start with a small, surgical approach. 

The biggest security risks usually come down to a few simple issues: 

• Too much access: If an AI system can reach across email, files, line-of-business apps, financial tools, and customer data, one bad action can create a serious problem. 
• Bad information in, bad decisions out: AI is only as reliable as the information and instructions it receives. If the data is wrong, incomplete, or manipulated, the actions it takes can be wrong too. Or, even worse, catastrophic. 
• Sensitive data exposure: If an AI tool is connected to systems that store confidential information, businesses need to ensure that data is properly protected. 
• Automation without oversight: Just because something can be automated does not mean it should be left alone. Businesses get into trouble when they assume automation removes the need for supervision. 

What I tell clients to focus on 

When I talk with clients about AI, I am not telling them to avoid it. I am telling them to put the right guardrails in place before they let it touch anything important. 

Here are the security measures I believe matter most. 

1. Start with limited permissions

An AI tool should only have access to the systems and information it truly needs to do its job. 

If it only needs to review support requests, it should not also be able to access finance records or make administrative changes in other systems. 

This is one of the simplest and most effective ways to reduce risk. 

2. Keep humans involved in high-risk decisions

There are some actions that should always require human review. 

Things like changing security settings, approving payments, accessing highly sensitive records, or deleting large amounts of data should not be left entirely to automation. 

AI can assist. It does not need final authority in every situation. Also, before you even start the conversation, make sure your backup and business continuity plan is in place and has been tested to work correctly.  A seemingly small issue can loom large in a hurry if something goes sideways and what you thought was your safety net isn’t there when push comes to shove. 

3. Make sure everything is traceable

If an AI system is doing work inside your business, you need to know what it did, when it did it, and why. 

That means logging, monitoring, and maintaining a clear record of actions. If something goes wrong, you need to be able to trace it quickly and respond.  For all our AI implementations, we create a distinct user with scoped permissions and treat the agent like an employee. Some of them have their own phone and/or eSIM. The additional licensing costs and setup are a small price to pay to afford you the same level of control you would have with an employee. Terminating access should be as easy as terminating an employee. Think to yourself, how would I pull the plug if I had to? The 80/20 rule applies. Pulling the plug should equate to a 20% work effort that minimally yields terminating access to 80% of the AI agent’s role. 

4. Test before you trust

I would not recommend turning an AI agent loose in a live business environment without first testing it in a controlled setting. 

Businesses need time to understand how a system behaves, where it performs well, where it struggles, and what kind of oversight it needs. That is especially true when integrations and automations are involved. 

5. Review the vendor, not just the features

Many companies will adopt agentive AI through third-party tools rather than build it internally. 

That means you have to look beyond the sales pitch. Ask hard questions. 

• What data does this tool access? 
• Where is that data stored? 
• What permissions does it require? 
• What controls exist around risky actions? 
• What audit trail is available? 
• How is customer information protected? 
• Has the vendor had any reported incidents? 

Those are basic business questions now. Not advanced technical ones. 

6. Set policy before adoption scales

A tool starts in one department, people find it useful, and suddenly it spreads faster than leadership can govern. 

That is why clear policies matter early. Your team should know which AI tools are approved, how they can be used, which data should never be entered, and when human review is required. 

That kind of clarity protects the business and gives employees confidence. 

My advice to business leaders right now 

My advice is simple: be curious, but do not be careless. 

There is real value in agentive AI. It can improve workflows, reduce manual effort, and help teams move faster. I believe that. But I also believe the businesses that benefit most will be the ones that adopt it with discipline. 

You do not need to be first. You need to be smart. 

That means asking the right questions, setting limits, and ensuring your security posture keeps pace with the technology. 

Why it matters at Cardinal Point 

At Cardinal Point, we work with businesses that depend on stable systems, protected data, and practical technology decisions. That is why this topic matters so much to me personally. 

I do not want clients adopting AI because it is the trend of the moment. I want them to adopt the right solutions, in the right way, with the right protections in place. 

Agentive AI can absolutely be part of a strong business strategy. But like any powerful tool, it needs structure, oversight, and good judgment. 

Using AI at work, safely: 5 simple ways to save time and what not to share

AI is often treated as one thing, but it helps to separate the terms. Generative AI is what most people mean when they say “AI” today: tools like ChatGPT that create a work product in response to a prompt. Another category is agentive AI, which can take steps and make decisions to complete tasks for you. Some people also discuss artificial superintelligence (ASI), but we will save that for a future post.

Generative AI can be genuinely useful in day-to-day work, but most people have never been given clear guidance on what is safe to share with it. A simple rule is to use it for low-risk work like rough drafts and shaping ideas, and keep it away from anything confidential or identifying. That includes customer or employee details, names tied to real people, addresses, medical information, and technical specifics that reveal how your environment is set up, such as IP addresses, configuration files, usernames, access keys, and passwords.

5 practical, low-risk ways to use AI at work:

1. Drafting Everyday Emails
   • If you can describe what you want to say in a sentence or two, AI tools can turn it into a clean first draft. This can be helpful for follow-ups, scheduling, customer check-ins, and status updates. Be sure to still review it before sending, as AI can get the tone wrong or miss details, but it can remove the friction of starting from a blank page.
2. Summarizing Meetings and Long Notes
   • If you have general notes that don’t include confidential client details, employee information, financial data, etc., AI can turn a messy page of notes into a short recap, a list of decisions, or a set of action items.
   • A good note and rule of thumb: If you would not forward the raw notes to a broad internal list, do not paste them into an AI tool.
3. Organizing Notes and Turning Ideas Into a Plan
   • You may already have the right ideas, just not the time to structure them. If you have a rough list of tasks or thoughts, AI can help turn it into a step-by-step checklist, a short timeline, or a clearer outline for what happens next.
4. Creating Basic FAQs and Internal How-To Blurbs
   • You might need a simple document explaining how to request time off, submit an expense report, name and store files, or handle common customer questions. The key is that AI should create the initial version, and your team should confirm it’s consistent with how your business actually works.
5. Polish Writing You Already Have
   • If you remove confidential information first, you can paste a draft and ask AI to make it clearer, shorter, or more professional. This is useful for client emails, internal announcements, and basic proposals.

Now for the safety side and using AI.

The simplest rule is to treat most AI tools like a public space. Even if a tool claims to be private, your safest default is to avoid pasting anything that could cause damage if it were exposed.

Do not paste:

• Passwords, passcodes, MFA codes, or recovery codes
• Client information, especially anything confidential or identifying
• Financial information (banking details, invoices with sensitive fields, credit card data)
• HR information (employee records, compensation, performance notes, medical details)
• Contracts, legal documents, or anything under NDA
• Internal system details that could help an attacker (network diagrams or information, config files, admin credentials, security procedures)

AI is moving fast enough that many of the old “rules” about how quickly technology evolves are starting to feel outdated. That speed makes AI safety a practical concern, not a theoretical one. AI can also behave in a fractal way: a small piece of information can be reused in countless contexts, and it is not always obvious where it might show up later. Combine that with how quickly these tools can act, and it is worth pausing to think about your AI hygiene.

The goal is not to ban AI or let it run unchecked. It is to narrow its scope so it stays focused on the task you actually want solved, whether that is tightening up an HR policy or supporting medical research. On the user side, the best leverage we have right now is clear education and behavioral controls: practical guardrails that limit what goes in, where it goes, and who can access it.

Cardinal Point can help your team choose the right tools, set straightforward rules everyone can follow, and deliver training that emphasizes safe, day-to-day use.

1. Upgrade the Old Stuff (Yes, It’s Time)

2. Patch the Holes in Your Cybersecurity

• Is multi-factor authentication in place across all critical systems?
• Have our backups been tested recently?
• Do you have a multi-layer threat protection strategy in place for email threats?
• Are endpoints protected, and is Managed Detection and Response in place (MDR)?
• Do you have Identity Threat Detection and Response (ITDR) in place?

3. Fix the Friction in Your Remote Setup

4. Clean House: User Accounts Edition

5. Make Sure Your Tech Supports Your 2026 Goals

Let’s Make 2026 the Year Your Tech Works for You

As the holiday season approaches, many businesses experience a surge in activity, marked by increased transactions, heightened customer interactions, and a greater reliance on digital infrastructure. Unfortunately, it’s also the time when cybercriminals ramp up their efforts, targeting organizations that are distracted, short-staffed, or unprepared. 

At Cardinal Point Technologies, we believe proactive protection is the best defense. Here’s a quick cybersecurity checklist to ensure your business is ready for a secure and successful Q4. 

Audit User Access & Permissions

• Remove access for former employees. 
• Review and limit permissions based on current roles and responsibilities. 
• Reconfirm and/or enable multi-factor authentication (MFA) across accounts. 

Update and Patch All Systems

• Confirm your servers, operating systems, and applications are up to date. 
• Implement an update schedule to automate updates year-round. 
• Don’t overlook firmware updates for network equipment and printers; they’re often overlooked and can be vulnerable. 

Review Backup and Recovery Plans

• Test your data backup and restore processes now. 
• Ensure backups are stored securely both on and off network. 
• Verify your disaster recovery plan is updated and accessible. 

 Educate Your Team

• Human error remains the leading cause of security breaches. 
• Run a short phishing awareness campaign. 
• Remind your team to be cautious with holiday-themed emails, fake invoices, credential harvesting and gift card scams. These can be especially convincing now that attackers use AI to automate the process. 
• Reiterate password best practices, including password complexity and rotation. 

Monitor for Suspicious Activity

• Set up alerts for failed logins or unusual file access. 
• Review firewall and antivirus logs. 
• Work with your IT provider to ensure 24/7 monitoring is in place. 

Secure Remote Work Connections

If your team is working from home or traveling: 

• If possible, use systems and policies to implement a zero-trust strategy to security. 
• Only permit remote access to specific resources for employees who require it. 
• Make use of remote desktop/app software designed to provide secure access to critical resources. 
• Require MFA-enabled VPN usage for all remote access that can’t be achieved via other MFA protected alternatives such as remote desktop/app access. 
• Ensure laptops and mobile devices are encrypted, password protected and if possible, managed by mobile device management software (MDM). 
• Discourage the use of public Wi-Fi for sensitive work without protection. 

In today’s technology-driven world, IT strategy can no longer be viewed as a back-office function. It’s a core enabler of business success. And yet, in too many organizations—especially in the public sector and regulated industries—there’s still a disconnect between what the business wants to achieve and how IT is structured to support it. 

At Cardinal Point Technologies, we believe closing that gap is not just a best practice—it’s a strategic imperative. 

The Misalignment Problem 

The divide often begins with the way goals are framed. Business leaders focus on outcomes: improving citizen experiences, reducing operational inefficiencies, or accelerating mission delivery. Meanwhile, IT teams tend to focus on infrastructure, compliance, and operational uptime. These are both critical, but without a shared language and strategic alignment, they operate in parallel rather than in partnership. 

The result? Underutilized investments, delayed project timelines, and solutions that miss the mark. 

Strategy First, Technology Second 

We help clients realign by starting with strategy, not tech. That means: 

• Understanding business outcomes: What are you trying to solve, deliver, or transform? 

• Translating needs into architecture: How can cloud, data platforms, automation, or AI be intentionally applied to serve those outcomes? 

• Enabling continuous feedback loops: What governance and metrics will ensure IT evolves with business needs? 

Rather than “selling a solution,” we act as strategic advisors, embedding ourselves in your goals and only then architecting the right path forward. 

The Role of Partnership 

True alignment requires more than technical skill—it requires trust, communication, and clarity. When we sit with agency leaders, we’re not talking about tools. We’re talking about mission alignment, risk mitigation, and agility. That’s how transformation takes hold. 

We’ve seen this approach pay off—from streamlining data strategies for state agencies to modernizing federal systems under aggressive compliance timelines. In every case, the turning point came when IT stopped being a silo and started being a strategy partner. 

Moving Forward 

If your IT investments aren’t delivering business value, it’s time to step back and ask: Are we speaking the same language? Do we have shared goals? Are we measuring success together? 

Bridging the gap isn’t a one-time initiative—it’s a mindset shift. At Cardinal Point, we’re proud to help clients navigate that shift every day.