Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Small teams can use AI safely when they treat it as both a normal cybersecurity issue and a new source of AI-specific risks. Before anyone pastes business information into a chatbot or connects an agent to company systems, inventory the tools, classify the data, verify the provider’s terms, enforce basic account security, test attack paths, and define a response plan. The checklist below turns that sequence into controls a small business can actually operate.
1. Create an inventory before approving AI use
You cannot protect tools you do not know about. Start with a living register that covers approved, inherited and “shadow” AI use, including free trials and browser extensions.
Record each application and model
- Application name, provider, plan or edition, and the business owner responsible for it.
- Model or agent used, its purpose, and the business process it supports.
- Every user, service account, plug-in, API key and integration.
- Systems and data the tool can read, write, delete or send to another service.
- Whether the tool acts autonomously, runs on a schedule or requires a person to approve each action.
- Contract renewal date, administrator, logging capability and a documented shutdown method.
Ask department leads, finance and IT for tools purchased on expense cards, then review identity-provider logs, browser extensions and API traffic for unapproved services. Mark an entry “unapproved” rather than deleting it from the register; that visibility lets you disable it safely and explain the reason.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Map the data flow
For every tool, draw the path from input to storage, processing, output and deletion. Note whether prompts are sent to a provider, retained in a history, copied into a vector database, used by a plug-in or returned to another system. The Australian Cyber Security Centre’s Artificial intelligence for small business guide specifically asks businesses to understand what a provider collects, where it stores information, who owns it and whether it may use it to train models.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Classify information before staff share it
Make the safe choice obvious at the moment of use. A short classification policy is more effective than telling staff to “be careful” after an incident.
Use four practical handling levels
| Level | Examples | Default AI rule | Extra approval |
|---|---|---|---|
| Public | Published webpages, public product descriptions, released job adverts | Permitted in approved tools, provided the prompt contains no hidden confidential context | None |
| Internal | Draft procedures, non-public schedules, internal meeting notes | Use only a business account with documented retention and access controls | Process owner approval for a new provider |
| Confidential | Customer records, employee information, pricing plans, source code, contracts, financial forecasts | Do not submit unless the provider, contract and configuration explicitly permit that use | Data owner and security review |
| Restricted or regulated | Credentials, payment data, health information, government identifiers, encryption keys, information covered by a regulator or contract | Keep out of general-purpose AI services; use a specifically assessed environment or an approved non-AI workflow | Executive, legal or compliance approval as applicable |
Classification should apply to attachments, pasted text, screenshots, audio, source-code repositories and retrieved documents—not just the prompt sentence. Remove names, account numbers, secrets and exact identifiers when a task can be completed with redacted or synthetic data. Never paste passwords, API keys, private certificates or recovery codes into a model.
Answer the provider-data questions
- What information is collected from prompts, files, telemetry and administrators?
- Where is it stored and processed, and which subcontractors can access it?
- How long are prompts, outputs, logs and backups retained?
- Who owns submitted content and generated output under the contract?
- Is customer content used to train or improve a model, and can that use be disabled?
- Can the business export and delete its data, including copies in connected services?
Save the answers and the date checked. Recheck them when the plan, model, integration or intended data changes; a setting that was safe for public text may not be safe for customer records.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems3. Review the vendor and service terms
A security logo or a promising privacy page is not a substitute for understanding the service you are buying. Have the tool owner and, where relevant, legal counsel review the terms for the actual edition and region.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check security and assurance evidence
- Documented authentication, authorization, encryption, vulnerability management and administrator controls.
- Independent assurance reports or certifications, their scope, and the dates covered.
- Third-party hosting, model providers, plug-ins and other supply-chain dependencies.
- Logging, alerting, export of audit records and the provider’s ability to investigate misuse.
Check response and exit terms
- How quickly and through which channel the provider must notify you of a breach.
- Who leads incident response, what evidence you receive and whether support is available during an outage.
- Retention and secure deletion at contract end, including backups and accounts of former employees.
- Service limits, rate limits and changes that could alter model behavior or permissions.
Record an owner for monitoring notices and a review date. If the service cannot answer a material question, treat that uncertainty as a risk: limit the data and permissions rather than assuming the most favorable interpretation.
4. Apply ordinary cybersecurity controls to AI accounts
AI accounts and the devices connected to them need the same baseline protections as email, finance and file storage. The Federal Trade Commission’s Cybersecurity for Small Business guidance recommends controls such as multifactor authentication, restricted access, encryption, backups, monitoring and response planning. It also notes that the latest CSF 2.0 is free, voluntary and flexible.
Identity and access checklist
- Require MFA for every administrator and user. A FIDO2 security key can be one implementation option when it is compatible with your identity provider; enroll a recovery method and test account recovery before requiring it company-wide.
- Use individual accounts, not shared logins. Remove leavers promptly and review dormant accounts.
- Apply least privilege to workspaces, API keys, connectors, repositories and billing administration.
- Change default passwords, rotate secrets and store them in a managed password or secrets system.
- Separate development, testing and production environments so an experiment cannot alter live records.
Device, data and resilience checklist
- Keep operating systems, browsers, extensions, endpoint protection and AI clients updated.
- Encrypt sensitive data in transit and at rest, including local exports and backup media.
- Back up critical records independently of the AI service and test restoration.
- Log sign-ins, administrator changes, data exports, connector changes and high-impact tool calls.
- Set alerts for impossible travel, unfamiliar devices, mass downloads and sudden permission changes.
5. Train people and verify every consequential output
Training should explain what staff may submit, which tools are approved, how to redact information, how to recognize a suspicious instruction and where to report a problem. The Australian guide names Cyber Wardens Level Two – Safe AI for Small Business as an example of an education course; use it only if its current availability and fit meet your needs.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Make human review a defined control
Models can produce plausible but false statements, unsafe code, discriminatory recommendations or fabricated citations. Require a named reviewer to check facts, calculations, source documents, permissions and policy compliance before an output is sent to a customer, used in a hiring or credit decision, published, or used to change production systems. Keep the prompt, output, reviewer and decision for high-impact work so the business can explain what happened.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Teach staff to spot prompt injection
Instructions embedded in a webpage, email, PDF or retrieved document may try to override the user’s request, reveal secrets or trigger an action. Staff should treat external content as untrusted data, never follow instructions to disclose credentials, and stop when an output asks for an unexpected upload, payment or permission.
6. Test AI-specific attack paths
Use the OWASP AI Security Verification Standard as a test catalogue. Its areas include input validation, configuration and lifecycle, identity and access, supply chain, output controls, memory and vector databases, agents, orchestration, adversarial robustness, monitoring and logging.
Run focused tests before production
- Input validation: Submit oversized, malformed and deliberately adversarial inputs. Confirm that file types, lengths, encoding and external URLs are constrained.
- Authorization: Test each role with another user’s records, restricted files and administrative functions. Verify that retrieval filters are enforced server-side, not merely described in a prompt.
- Prompt injection: Place conflicting instructions in a test document and ask the system to summarize it. Confirm that the system does not reveal hidden prompts, secrets or unrelated records.
- Output controls: Check that generated SQL, code, emails and API calls are reviewed, escaped and constrained before execution or delivery.
- Supply chain: Inventory models, plug-ins, packages, data sources and update channels. Assess what happens when a dependency changes or becomes unavailable.
- Monitoring: Verify that you can detect unusual tool calls, failed authorization, data export and repeated injection attempts.
NIST’s Generative AI Profile (NIST AI 600-1) recommends AI red-teaming for abuse that facilitates attacks on other systems, prompt injection and machine-learning attacks such as adversarial prompts, data poisoning, membership inference, model extraction and sponge examples. Treat red-team findings as defects with owners and deadlines, not as a one-time demonstration.
Reassess after changes
Repeat testing after a model upgrade, new connector, altered retrieval index, policy change, major prompt revision or vendor migration. Keep a simple change log linking each change to the tests rerun and any residual risk accepted by management.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
7. Put guardrails around AI agents
An agent that can call tools can turn a misleading instruction into a real-world event. CISA and partner agencies’ May 1, 2026 announcement on careful adoption of agentic AI services emphasizes limiting autonomy and access, layered defenses, strong identity, oversight, threat modeling, monitoring and regular assessments.
Design the smallest useful permission set
- Give the agent read-only access unless a write operation is essential.
- Expose individual functions rather than an unrestricted shell, database or mailbox.
- Restrict records by tenant, project, geography and sensitivity.
- Set transaction limits, time limits, rate limits and destination allowlists.
- Use separate credentials for each agent and rotate or revoke them independently.
Require approval for high-impact actions
Pause for a human checkpoint before sending external messages, approving payments, changing access, deleting records, publishing content, modifying production code or making decisions about people. Show the proposed action, affected records and reason, then record who approved or rejected it.
Monitor the complete action chain
Log the user request, retrieved sources, model version, tool calls, parameters, approvals, results and errors. Alert on loops, unusual destinations, privilege escalation, repeated denials and bulk changes. A transcript of the final answer alone is not enough to reconstruct an agent incident.
Recommended Free Tools
8. Prepare an incident response plan a small team can use
Write the plan before an account is compromised or an agent sends the wrong message. Keep a printed or offline copy in case the affected systems are unavailable.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- Identify: Define what counts as an AI incident, such as leaked confidential data, unauthorized tool use, malicious prompt injection or a provider breach.
- Contain: Disable the account or connector, revoke keys, stop scheduled runs and preserve logs without destroying evidence.
- Assess: Determine which prompts, files, systems and people were affected; involve the provider and relevant technical, legal or privacy contacts.
- Communicate: Decide who informs customers, employees, insurers, regulators or law enforcement when contracts or law require it. Use verified contact details, not addresses supplied in a suspicious message.
- Recover: Restore from clean backups, rotate credentials, rebuild compromised integrations and keep sensitive work on a manual process while controls are fixed.
- Improve: Record the root cause, update permissions and training, and retest the attack path.
Assign these roles by name: incident lead, AI-service contact, identity administrator, business continuity owner and communications decision-maker. One person may hold several roles, but every role needs a backup.
9. A workable rollout for a small team
Do not wait for a perfect governance program. Use a short sequence that produces immediate risk reduction and then adds depth.
- Week 1: Freeze new connections, inventory tools and owners, require MFA and remove shared accounts.
- Week 2: Publish the four-level data rules, block restricted data in general-purpose tools and document each provider’s retention and training settings.
- Week 3: Apply least privilege, review connectors and API keys, enable logs and backups, and train staff with realistic examples.
- Week 4: Test prompt injection, authorization failures and unsafe outputs; add approval gates to agent actions and run an incident exercise.
- Every quarter and after major change: Reconcile the inventory, review access, check vendor notices, sample logs, rerun priority tests and obtain management sign-off on remaining risks.
Use a simple register with columns for tool, owner, data classes, integrations, permissions, provider answers, last test, open risk and next review date. That record gives a small team an auditable way to decide what is safe enough, what needs tighter controls and what should be disconnected.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
