You do not need a security degree to use AI safely. You need two habits.
Rule one: don’t share. Every prompt you send to a cloud model leaves your building. Assume it is stored, reviewed, and potentially used for training. Client names, contract terms, monitoring data, negotiating positions — none of it goes into a prompt unless you have explicit permission and a clear reason. When in doubt, keep it out. The convenience of pasting a confidential report into a chat window is never worth the exposure.
Rule two: shrink the attack surface. Every service you expose to the internet is a door. Every open port, every exposed agent, every plugin with broad permissions is a door left unlocked. We saw this with Claw: thousands of instances left exposed, credentials leaked, because convenience won over configuration. Run local services on your private network only — Tailscale, not port forwarding. Give agents read access before write access. Sandboxed environments before full system access. Update everything, always.
Beyond the two rules, a short checklist covers the rest: change default passwords on every device before anything else, rotate API keys on a schedule and whenever a tool or person no longer needs access, unique passwords in a password manager, two-factor authentication everywhere it is offered, encrypted disks on machines holding your archive, and backups you have actually tested restoring from. These are useful starting controls. Further decisions require judgment — knowing that a tool offering to “do everything for you” is usually asking for more access than it needs.
An archive containing client material needs access controls, backups and a recovery plan. Planetary.Blue shares practical material with members and provides paid consulting when needed.
