We moved off ChatGPT, and 5 risks that we didn't account for as a cybersecurity company bubbled up

Last week we pulled the plug on ChatGPT at Cliffside Cybersecurity.

I could give you several reasons why, but the bottom line is that it was no longer meeting our business requirements.

Being a Microsoft partner, we moved to Copilot for the ecosystem integration. Three things landed quickly:

• We weren't comfortable with the copy-and-paste between documents and ChatGPT (several reasons, including security, efficiency, and reliance on manual processes).
• We got sharper at producing documentation using native cloud features in Word and Excel.
• One less vendor to manage.

Whether the move turns out to be a great call or a mediocre one, it's too early to say. But that is not what this article is about... so back to the topic!

Once the decision was made to move platforms, a series of risks I had vaguely anticipated, plus several others I hadn't considered at all, started bubbling up.

And in some ways, I'm glad we did it, because we want to be at the forefront of AI adoption so we can advise from experience, not from theory.

Without further ado, here are 5 risks you should consider in your AI journey:

1. Data portability

Years of refined prompts, custom instructions, project history, and institutional context... sits locked inside the now-defunct platform.

Export options were very thin. Most of our knowledge was literally not exportable. Now multiply it by the size of your organisation. Yeah. We had to make a hard call to leave a good chunk of it behind.

What to do about it: treat your AI platform choice the way you treat ERP choice. Document your standard prompts, your workflows, and your brand style in a platform-agnostic format before you commit. Run prompts asking the model to summarise your knowledge in markdown format. It helped reduce the pain, but it was still painful nevertheless.

2. Maintenance of AI-built solutions

Give your team AI capability and they will solve business problems fast. Really fast. And then one of those people leaves the business...

• Did they leave any documentation behind?
• Does anyone else know how the solution works end to end?
• Who supports it when it breaks at 6pm on a Friday?

What to do about it: every AI-built solution that touches a business process needs the same hygiene as any other piece of IT. A short "how this works" doc. A named owner. A review date. Boring, I know. But the alternative is a business-critical workflow sitting in the head of someone who gave notice last week.

Another option is to have whatever is possible committed to git, so at least you can refer back to the code.

3. Laptops are the new servers... the sanctioned shadow IT.

This one genuinely surprised me. We discovered more than a handful of business-important (not critical, but might as well be) solutions running on individual laptops. Scripts, custom agents, scheduled jobs. All sitting on one machine, backed up by... hope.

It's like shadow IT in reverse. People aren't going outside the sanctioned tools we painstakingly approved... They're using the sanctioned tools to build things nobody other than themselves can see!

What to do about it: we're building a proper playground. A sanctioned environment where people can build, where the work is visible, where it's backed up, and where nothing critical lives on the device someone left in a taxi.

4. The spreadsheets archipelago

Somewhat related to the one above, but a different risk altogether.

Ask any of the major AI platforms to build you a payroll system in Excel. It will do it. Brilliantly... sometimes better than the real thing!

So what happens?

People build solutions in the tools they already know. Which sounds great until you have five people in payroll, each solving their own pain points with five different brilliant spreadsheets.

None of them talk to each other. None of them are version-controlled.

What to do about it: we hold weekly AI meetings to discuss what improvements we can bring to our business processes. Everyone knows what's being done by their teammates. No duplication of effort, no two sources of truth.

And another important point: before anyone builds anything, ask: should this exist as a spreadsheet, or should this be in a real system? If the answer is "real system", individual AI solutions are NOT the way to go.

5. We all sound the same now

This one is a bit of a rant, but I miss the days when emails I received had "their" instead of "they're". Silly mistake. But we knew a human had written it.

Nowadays, the "their" and the "I should of" have been replaced by em dashes, "elevate", and every other tell-tale sign of AI doing the work for you...

Every AI-polished email sounds like it was written by the same mid-level marketing manager.

In my view, that is not an improvement...

It is trust erosion at scale.

I know this one is a hard fight, but I'll try it.

What to do about it: Use AI for the first draft never for the final send.

Your voice is a trust signal. Do not automate it away!

I'm still adding to this list. If you've run into your own version of any of these, I'd genuinely like to hear about it!

And please feel free to share any other risks you've identified in your AI journey, so we can share knowledge.

As a bonus, I leave you all with a risk register template for the risks above.

The risks in structured form

For those who want to take these into their own risk register, here are the same five risks written as formal risk statements using the Cause / Event / Consequence structure from ISO 31000.

AI-01: Data portability. Risk that organisational knowledge is lost during AI platform migration, caused by limited or non-existent export functionality for prompts, custom instructions, project history and institutional context, leading to reduced productivity, duplicated effort rebuilding lost knowledge, and degraded quality of AI-assisted work post-migration.

AI-02: Maintenance of AI-built solutions. Risk that business-critical AI-built solutions become unsupported, caused by staff building solutions without documentation, named ownership or handover processes before leaving the organisation, leading to operational disruption, inability to maintain or repair solutions, and loss of process continuity.

AI-03: Sanctioned shadow IT. Risk that business-important workloads run on unmanaged endpoints, caused by staff using approved AI tools to build scripts, agents and scheduled jobs that sit on individual laptops outside IT visibility, leading to data loss, business disruption if the device is lost or compromised, and absence of backup, access control or audit trail.

AI-04: Spreadsheet archipelago. Risk that multiple parallel AI-built solutions emerge for the same business problem, caused by staff independently using AI to build solutions in familiar tools like Excel without coordination, leading to duplicated effort, inconsistent data, conflicting sources of truth, and single-person dependencies.

AI-05: Voice and trust erosion. Risk that written communications lose authenticity and voice, caused by over-reliance on AI to polish or generate client-facing and internal messages without human review, leading to homogenised communication style, loss of trust signals with clients and staff, and erosion of brand distinctiveness over time.