AI Security Services for NZ Businesses
AI security covers the new ways AI exposes your business: staff pasting data into public AI tools, AI assistants reaching files they should not, AI accounts without multi-factor authentication, and phishing written by AI. As at 12 May 2026, OxygenIT is ISO 27001 and ISO 42001 certified, so we treat AI as part of your security, not a separate project.
OxygenIT is ISO 27001 and ISO 42001 certified, as at 12 May 2026. We are based at 7 Horner Street, Papanui, Christchurch 8053, and work with NZ businesses of roughly 20 to 200 staff.
Updated November 2026. Reviewed by Tim Clarkson
Not ready yet? Check whether you are ready first
What the AI security service covers
AI security is the part of cyber security that deals with risks created by artificial intelligence. For a New Zealand business of roughly 20 to 200 staff, those risks are practical. Staff paste client data into public AI tools. AI assistants inside Microsoft 365 surface files through permissions nobody has reviewed. Staff sign in to AI services with accounts that lack multi-factor authentication. And phishing emails written by AI read like a real colleague. An AI security service closes each gap: it reviews the AI tools in use, tightens access to the data they can reach, applies sign-in controls, and trains staff on AI-written phishing. As at 12 May 2026, OxygenIT is ISO 27001 and ISO 42001 certified, the information security and AI management standards. Read more about the OxygenIT team. Remediation by people runs 8.00am to 5.00pm NZ, Monday to Friday, unless you hold the paid after-hours add-on.
This service covers your business AI tools, the data they can reach, how they are configured and the controls we agree with you, not physical security systems such as cameras or alarms.
Who it is for
NZ businesses of roughly 20 to 200 staff whose people already use AI tools at work, whether or not anyone approved them.
What is included
- Scoping AI tools and systems
- Permissions and data handling review
- Control assessment
- Agreed remediation
What you need first
An agreed list of the AI tools and systems in scope. If you do not know what staff use yet, shadow AI discovery builds that list first.
How it starts
A 15-minute call about the AI tools you use and what concerns you. We then scope the tools and systems to review with you.
What are the AI security risks for your business?
For a business of 20 to 200 staff, the AI security risks are practical: data pasted into public AI tools, AI assistants reaching files through unreviewed permissions, AI accounts without multi-factor authentication, and AI-written phishing. The table shows what each one looks like and the control that addresses it.
| AI risk | What it looks like | Control |
|---|---|---|
| Data pasted into public AI tools | Staff paste client details, contracts or financial figures into a free chatbot to save time, and that data leaves your control | An approved AI tool for business data, settings that limit what can be shared, and clear rules in your AI policy |
| AI assistants reaching files through unreviewed permissions | An AI assistant answers a question with a file the person should never have seen, because it was shared too widely long ago | Review and tighten permissions on the files and sites AI assistants can reach |
| AI accounts without multi-factor authentication | Staff sign in to AI services with a password alone, or with personal accounts you cannot see or close | Multi-factor authentication on every account that signs in to an AI service, with business sign-in in place of personal accounts |
| AI-written phishing | An email that reads like a real colleague or supplier, with no spelling mistakes, asking for a payment or a login | Staff training on AI-written phishing, backed by email filtering and multi-factor authentication |
The process at a glance
Step 1 of 2
Review AI tools, permissions and data handling
We start with the AI tools and systems you have agreed are in scope and look at three things: who can use each tool, what data it can reach, and how that data is handled. Permissions get the most attention, because an AI assistant can surface anything the signed-in person can open. If you use Microsoft 365, that includes the sharing and access settings Copilot relies on, which we cover on Microsoft Copilot for NZ SMBs. Finding AI tools nobody approved is separate work, under shadow AI discovery and control. We work in Microsoft 365 tenants every day.
How do you stop data leaking into AI tools?
You stop data leaking into AI tools by giving staff an approved tool for business data, limiting what each tool can reach, and writing down what may and may not be shared. Blocking every AI tool rarely works: staff who find one useful move to a personal account, where you can see nothing.
What we review
- AI tools and systems in scope
- Permissions
- Data handling
Step 2 of 2
Assess controls and prioritise remediation
Next we assess the controls around each AI tool: sign-in and multi-factor authentication, sharing settings, data handling rules, and how well staff spot AI-written phishing. We rank each weakness by what it could expose, and you agree which ones we fix and who owns the rest. Controls only hold if staff know the rules, so agreed rules belong in your AI policy, and the AI policy guide shows what to put in it. For how this fits a wider management system, read what AI governance means. You receive the findings in writing, with every agreed action and its owner.
What this step produces
- Identified weaknesses
- Agreed remediation
- Findings handover
What testing and remediation are included
- Checks that sign-in controls and permission changes work as intended on the AI tools in scope
- Tightening permissions and sign-in settings on the AI tools in scope, as agreed with you
Deliverables and customer responsibilities
Here is what you receive at the end of the work, and what we need from you to get there.
What you receive
- Findings summary
- Prioritised actions
- Ownership record
- Agreed remediation within scope
What we need from you
- Agreed list of AI tools and systems in scope
- Admin access as agreed
- Owners for each remediation action
- Decisions on residual risk
Service limits and support hours
Not included and limits
- Guarantee of complete protection (never offered)
- Physical security systems
- Remediation outside agreed scope
- Testing types not listed in Step 2
- Support outside 8.00am to 5.00pm NZ business days unless the paid after-hours add-on is held
Who responds, and when?
- Business hours
- 8.00am to 5.00pm, Monday to Friday, excluding NZ public holidays
- After hours
- Paid add-on only
- NZ night
- Not staffed
Remediation, investigation and rollout help by people run from 8.00am to 5.00pm NZ, Monday to Friday, unless you hold the paid after-hours add-on.
Our engineers respond 8.00am to 5.00pm NZ, Monday to Friday, excluding NZ public holidays, and after-hours support is a paid add-on. Even with the add-on, the NZ night is not staffed: overnight is unmanned and early morning is uncovered.
Three questions to ask any provider
Start with three questions you can ask any provider, including us. Which AI tools can reach your client data today? Which of the accounts that sign in to them have multi-factor authentication? And who is told, and how fast, when something goes wrong? If the answers are not in writing, you do not yet have AI security.
Frequently asked questions
What does AI security cover for a NZ business?
AI security covers the risks your business AI tools create: client data pasted into public AI tools, AI assistants reaching files through permissions nobody has reviewed, AI accounts without multi-factor authentication, and phishing written by AI. It covers your AI tools, data access and configuration, not physical security systems such as cameras or alarms. If you came here looking for cameras or alarms with AI built in, read our guide to AI security systems instead.
How is this different from shadow AI discovery?
Shadow AI discovery finds the AI tools staff use without approval, while AI security protects the tools you have decided to keep. Discovery ends with a decision on each tool: approve, restrict or block. AI security then reviews permissions and data handling, assesses sign-in and other controls, and agrees remediation with you. If you do not yet know which AI tools staff use, start with shadow AI discovery and control.
Can AI assistants reach files they should not?
Yes. An AI assistant such as Microsoft Copilot can surface any file the signed-in person already has permission to open, including files shared too widely years ago. The assistant does not create the gap. Unreviewed permissions do. The fix is to review and tighten those permissions, and to check them again as people and teams change. We work in Microsoft 365 tenants every day. Read more on Microsoft Copilot for NZ SMBs.
Who responds, and when?
Our engineers respond 8.00am to 5.00pm, Monday to Friday, excluding NZ public holidays. Outside those hours, help comes only if you hold the paid after-hours add-on. Even with the add-on, the NZ night is not staffed: overnight is unmanned and early morning is uncovered. Remediation by people follows the same hours. We would rather tell you that now than have you find out during an incident. Ask about the add-on on a 15-minute call.
Does this service fix what it finds?
Yes, within the scope you agree before the work starts. Remediation covers the gaps you sign off, such as tightening access to the data your AI tools can reach and applying sign-in controls. Work outside that scope is not included, and you decide on any risk left over. Remediation by people runs 8.00am to 5.00pm NZ, Monday to Friday, unless you hold the paid after-hours add-on. If you are not sure what needs fixing, start with an AI readiness audit.
How does AI security relate to ISO 42001?
AI security puts controls around the AI tools you use, and ISO 42001 is the management standard for how a business governs AI. ISO 27001 covers information security in general. ISO 42001 adds the management of AI itself: policy, risk assessment and ownership. As at 12 May 2026, OxygenIT is certified to both, so we treat AI as part of your security, not a separate project. For a governance system of your own, see ISO 42001 AI governance.
Book a 15-minute call
Book a 15-minute call to talk through the AI tools your business uses and where the risks sit, or call our sales line on 0800 242 206.
Or call 0800 242 206
