Your Personal AI Emergency Playbook

Last Sunday, in Your AI Apocalypse Playbook, I wrote about preparing companies for a major AI disruption. A freelance writer asked whether there was a version for individuals and small businesses. It’s a good question. An independent writer, a family business and a neighborhood shop face many of the same risks with fewer people available to help.

The answer starts with the way you manage your technology every day. Before you decide what to do during an attack, you need to know what you have, how it is protected and how to regain control of it.

Build the practice

Security is a practice, not a product. Buying a security tool gives you another tool to maintain. Protecting yourself requires habits: keeping software current, checking access, verifying unusual requests and making sure you can recover when something fails. AI adds urgency because the tools you connect can act on your behalf.

Start with multifactor authentication, or MFA. Enable it on your email, financial accounts, password manager and other important services. Choose phishing-resistant passkeys or security keys where supported. Other forms of MFA still provide useful protection, though a code you type into a fraudulent website can be stolen. Use a reputable password manager to create and store unique passwords wherever passwords are required.

Next, ask your favorite frontier model to help you review your personal technology setup. List your devices, email and cloud services, password manager, AI tools and connected apps. Describe what each can access, your backup arrangements and how you recover accounts. Leave out passwords, recovery codes, private client information and other sensitive data.

Try this: “Help me review the security of this setup. Ask me about missing information. Identify risky permissions, weak recovery arrangements and actions I can take. For each recommendation, tell me which setting to check and how to verify it.”

The model can help you organize the work and explain unfamiliar settings. It cannot see settings you haven’t provided or connected, and importantly, it cannot certify that you are secure. Verify its recommendations against the service’s current instructions. Get qualified human help when a change could lock you out or disrupt your business.

I have an agent set up to give me daily security briefings. A useful briefing should connect new information to the tools you actually use and identify things to check. The work still includes opening the settings, confirming the facts and making the necessary changes. Those briefings are periodic reviews with limits on what the agent can see.

Turn on automatic updates for your operating systems, browsers and apps. Keep protected recovery codes and a short emergency contact sheet accessible without your primary login. Include official recovery addresses, your bank’s fraud number and a technical professional you can call. Back up important files, keep a copy protected from changes in your everyday accounts and test that you can restore it.

Review what your connected tools can do. Remove access they no longer need. Require human approval for moving money, sending messages and publishing content. Know how to stop the actual automated jobs. Establish a callback rule with family and colleagues: verify unusual requests through a separate channel using contact information you already trust. Apply it even when the voice sounds familiar.

These habits give you a starting point for two different emergencies.

When you are directly attacked

Act on the harm you can see. If money is moving without your authorization, contact your bank or payment provider immediately and ask whether the transaction can be stopped or recalled. Recovery is uncertain, and time matters.

Use a trusted device and the service’s official recovery process to regain a compromised account. Give email particular attention because it often controls access to other services. Reset affected passwords, revoke other sessions and check recovery details, connected apps and email forwarding rules. Warn anyone who received fraudulent instructions from your account.

If an AI tool is involved, pause its automation and revoke affected connections. Check scheduled posts, outgoing messages, payment instructions and other pending actions. Confirm they have stopped in the systems that execute them. Closing a chat window may leave those jobs running.

In the United States, report internet-enabled crime to the FBI’s IC3 and scams to the FTC. If customer information may have been exposed, get advice about notification obligations. Your accessible backups and contact sheet should help you keep essential work moving while recovery proceeds.

When your industry is attacked

An attack on your industry, a related industry or a supplier can become your problem while your own systems are working. Customers may want to know whether you use the affected service, whether their information is involved and whether they can still do business with you.

Establish the connection. Check your records and the provider’s official updates. Ask your vendors about dependencies you cannot see. Separate verified facts from unanswered questions.

Then inspect what your business is about to say automatically. Review scheduled social posts, email campaigns, ads and AI-generated customer replies. Pause anything that has become inaccurate or inappropriate. A cheerful promotion of your AI capabilities can land badly while customers are trying to understand an AI-related loss.

Choose one person to approve incident-related communications and maintain one source of approved information. In a small business, that person may be you. Tell everyone answering customers where to find it. Check your chatbot’s answers yourself. If it cannot reliably use approved information, suspend its incident-related replies and direct people to a human or a verified update page.

Explain what you have verified, the effect on customers, what they should do and when you will update them. Say what remains unknown. Avoid assurances that customer information is safe until you have evidence. Explain the steps you have actually taken and the services you can currently provide.

Respond when people need information from you. Verify claims before sharing them on your personal accounts, too.

Do this right now

Set aside time today to make five checks:

1. Confirm that your primary email and other critical accounts have MFA. Choose phishing-resistant options where available.
2. Make a technology inventory and ask an AI model to help identify gaps. Verify the findings.
3. Find your recovery codes and emergency contacts without using your primary account. Restore one backed-up file.
4. Review your AI connections and permissions. Locate the controls that stop jobs, messages and scheduled posts.
5. Agree on a callback rule and decide who approves customer communications during an incident.

Write down anything you cannot complete and fix it. Recheck the list when you add a device, connect an AI tool or change providers. That’s how a security practice becomes part of running your life and your business.

Author’s note: This is not a sponsored post. I am the author of this article and it expresses my own opinions. I am not, nor is my company, receiving compensation for it. This work was created with the assistance of various generative AI models.