As of 13 August 2026, AI can only partly identify cybersecurity risks in your small business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open a blank document and record your business name, staff count, locations, devices, cloud services, website, suppliers, remote access methods and business-critical processes.
   2. Gather your current asset list, backup information, MFA and access settings, patching records, security policies, supplier information, recent alerts and incident records, removing passwords, private keys and unnecessary personal data.
   3. Paste the business description, data description, controls and redacted evidence into the prompt, keeping each item under its matching heading.
   4. Ask the chatbot to produce the risk register, and copy its separate lists of assumptions, missing evidence, urgent actions and questions for a professional into the same document.
   5. Compare every stated asset and control against your actual device list, cloud administrator screens, backup records and policies, marking unsupported findings as unknown rather than confirmed.
   6. Send the risk register and the evidence gaps to a qualified UK cybersecurity professional, and record which risks, severity ratings and remediation actions they confirm or change.

   Prompt

   Act as a cybersecurity risk analyst for a small UK business. Use only the evidence I provide and clearly label every assumption, uncertainty and missing piece of evidence. Do not invent systems, vulnerabilities, compliance duties, supplier details or technical findings, and do not claim that a control is present unless the evidence shows it.
   
   Assess the information below and produce:
   1. A plain-English risk register with one row per risk.
   2. For each risk: the affected asset or process, evidence, threat, likely consequence, severity, likelihood, confidence, and why you assigned those ratings.
   3. A separate list of information you need before confirming each uncertain risk.
   4. Prioritised actions for the next 24 hours, next 30 days and later, with the owner and evidence needed to confirm completion.
   5. A list of controls that appear present, absent or unknown.
   6. A short set of questions for a UK cybersecurity professional to validate the assessment.
   
   Do not provide exploit instructions, passwords, attack code or advice to bypass security. Do not treat compliance with Cyber Essentials, UK GDPR or any other framework as established unless the supplied evidence supports it. Flag anything that needs a qualified security professional or urgent incident-response help.
   
   Business and systems:
   [describe the business, staff, locations, devices, operating systems, cloud services, websites, software, suppliers and remote access]
   
   Data and important processes:
   [describe personal data, financial data, confidential information, backups and business-critical processes]
   
   Existing controls:
   [paste policies, MFA status, patching process, backups, antivirus or endpoint protection, access reviews, training and supplier checks]
   
   Evidence:
   [paste a redacted asset inventory, security reports, audit findings, alerts, incident records or relevant configuration summaries]
   
   Do not paste passwords, private keys, recovery codes, customer records or other unnecessary personal data.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.