01 Do you confirm urgent transfer or account-change requests by calling back on a known number?Always: it's a hard rule Sometimes, depending on the situation No, we trust the email or the phone call
02 Does the team know that voice and face can now be faked (deepfake), and have they had a short briefing on it?Yes, we addressed it directly We're planning to No, the topic hasn't come up
03 Can employees paste company documents and data into any free AI?No: they have one approved, secure tool No clear rules Yes, we encourage free chatbots
04 How is login to Microsoft 365 and email protected?FIDO2 key / passkey / Windows Hello (phishing-resistant) Password + a code from SMS or an app Password only
05 Is external mail tagged, and are links and attachments filtered (e.g. Safe Links)?Yes, both Partly No
06 Are you in control of who has access to which files (before you turn on AI like Copilot)?Yes, permissions are under control We're not entirely sure Plenty of „everyone in the company” links
07 Do you verify the identity of new remote candidates and new suppliers?Yes, through an independent channel Sometimes No
08 Do AI agents in your company have access to external tools (email sending, databases, APIs), and do irreversible actions require human approval?Yes, every sensitive action requires human sign-off (Human-in-the-Loop) We're only now planning action verification workflows Agents operate fully autonomously without guardrails or checks