Security means protecting the things that matter: your information, your accounts and your ability to keep working.

It is not a promise that nothing can go wrong. It is a set of sensible precautions, with a plan for what happens if something does.

Three plain questions

  • Who can see it? A customer record should not become public because somebody pasted it into the wrong tool.
  • Who can change it? An invoice needs to remain correct. A quiet change to the bank details matters.
  • Can we access it when needed, and recover it if something goes wrong? Work should not depend on luck, whether a service is unavailable or a file has disappeared.

These are often called confidentiality, integrity and availability. Availability includes timely, reliable access, not just getting a lost file back. The names are less important than the questions.

Start with the basics

Protect your accounts. Use a different strong password for each important account, stored in a reputable password manager. Enable multi-factor authentication where available; passkeys may be another supported option. Never give an assistant your password, recovery codes or a sign-in approval. The NCSC account guide explains the choices.

Keep devices maintained. Apply trusted software and browser updates, and lock the screen when you step away. On a work device, follow your organisation's process rather than changing managed settings yourself. See the NCSC device guidance.

Check recovery. Ask where important work is backed up and who has tested restoring it. Do not test recovery by deleting the only original. The NCSC backup guide is a useful starting point.

Pause at unexpected requests. A convincing message is not proof that its sender is genuine. Check unusual payment or access requests through a known, separate route. Do not use contact details supplied only in the suspicious message. See NCSC advice on spotting attacks.

What changes when an assistant is involved?

A tool may receive what you type, attach or let it retrieve. Giving it access to a folder can be a much bigger decision than pasting an invented paragraph into a chat.

Before using real information, ask: is this tool approved for this material? Which account am I using? What can it read or change? Where could the information go? If you do not know, use an invented example and ask the person responsible.

A secure connection protects information in transit; it does not settle how the receiving service stores or uses it. For that, you also need the provider's terms, account settings and your organisation's rules. Our AI privacy guide explores those questions.

A small exercise with nothing private

Imagine that an assistant will help draft a picnic invitation. The only information it needs is the invented date, location and wording. It does not need your whole mailbox, contact list or bank account.

The useful result is a short plan you understand, not a list of frightening words. A prompt does not enforce security: keep actual tool permissions narrow as well.

Know when to ask for help

If you may have shared a secret, clicked a suspicious link or exposed work information, stop the activity and contact your organisation's IT or security contact promptly. Follow its incident process. Do not hide the mistake, delete evidence or ask an unfamiliar tool to "clean everything up".

You have understood this lesson if you can explain what you are protecting, name one prevention measure and say who would help you recover. You do not have to fix every problem yourself.

Next: what permission actually means. Need the basics first? Start with files and folders. Return to Tony's article.

Sources and boundaries

Checked on 21 October 2026. This introductory lesson draws on the linked NCSC guidance and the Government AI Playbook. The picnic is an invented example. This page is not a security certification or permission to use an unapproved tool with personal or work information.