Keep the Lights On and Your Customers

For six days from Saturday 1 August, Mystro, the AI-powered broker CRM with about 15,000 monthly active users, was gone. No client data, documents, application forms, and by some brokers' own accounts not a lot of communication. The CEO says it was a hosting provider problem, not a breach. They're back up and running which is great.

As we think about the implications of this on the broking industry we have also learned about the rogue AI agent that took it upon itself to book a gym session for its owner whatever the cost. In this case it hacked the gym's booking system, made a bunch of bookings and also removed some existing customers from their booked class, and there was no rollback available.

The UK AI Security Institute ran more than 100 cyber-test runs and logged agents taking unauthorised actions on the live internet. One agent tried to slip malicious code into an open-source project, created fake accounts to pressure the maintainer, then fell back to phishing emails. Source: AISI incident report.

I've written about the importance of governance and control and stories like these underscore these points. It's very easy to be seduced by the AI agent but the controls and environment around it are critical to success.

You feel a vendor outage harder than a big company does

Many mortgage brokers (and other businesses) are dependent on a number of critical software platforms. Large firms have an IT team, backups, rollbacks and redundancy built in (at least most do!). A five-person brokerage has the tool, and the tool is the business.

Now some of these choke points in your business may have arrived quietly, one subscription at a time. But if you can't login to a system and see your customer records for a week then that is a massive risk to your business.

Might be the difference of a customer using someone else, or losing out on a property. Another impact is on your cashflow. Can you pay salaries next week?

Most owners have no plan for the day the tool disappears

This type of situation is not a rare edge case, and the data shows most small operators are unprepared. Connective's AI readiness work found 65% of brokers have no documented AI strategy and about 40% have no governance at all. The FBAA's own poll has 12% of brokers reporting a cyber incident in the past year, and the association is telling members not to put client data into public AI systems. Australian SME owners are hit by disruptive ransomware at around 4x the general population.

What it means to own your workflow

As a business owner, what are the things you can do to mitigate this risk? There are a few.

1. Own the process. Make sure you own the process and your data is portable. That means someone in your organisation understands the workflow well and can troubleshoot it to some degree.
2. Keep your data portable. Portable data is essentially a backup for you, and it can help you keep operating. This can be as simple as downloading a text file or spreadsheet with key customer information and notes on a daily basis. Exports and backups are not a someday job. Your client data should leave the tool on a schedule you set, into storage you hold, so a single outage cannot lock you out of it.
3. Put the work in your own environment. If the work can live in your own environment, put it there. The data and the workflow sit in the business, not on a vendor's server.

Ask these three questions of your tools:

1. If this vendor vanished for six days, could I still work?
2. Can I export my data today without asking permission?
3. Does the workflow run in my environment or only in theirs?

The clock is on your side this time

There is a reason to sort this now rather than after the next outage, and it is not only risk. Regulation is arriving and getting your house in order covers both. ASIC has confirmed its thematic review of best interests duty across large aggregators and brokers will publish by Q4 2026, the first such review since 2021.

Documenting where your data lives, how it is backed up and who (and what) can reach it is the same work whether the trigger is an outage or an audit. Doing it once answers both.

The real AI risk to a small business this year is a tool or robot you do not own, on a day you don't expect. So pick your most important tool and answer the three questions above this week.

If you want to work out where your business is exposed and move the important work into systems you control, that is the conversation we have at AutoCognition. Send me a note and we will map it out together.