The spreadsheet your agency read (and what to ask on Monday)
How a stray accounting file taught one company that vendor AI use — not your employees — is the bigger risk
Nick Dreyfus opened with a small mistake that turned into a business decision: an employee dragged an accounting spreadsheet into a shared folder the marketing agency used. The agency’s AI quietly read everything in that folder, then used the numbers to price a campaign — cutting margins to roughly a 10% markup where the company normally prices at about double cost.
That’s the episode’s spine: your AI policy can look perfect in-house and still miss the place decisions really come from — the vendors you trust.
Why vendor AI is the invisible supply-chain risk
You can picture the restaurant with perfect hygiene in the kitchen and no idea where its lettuce came from. Nick: “Your AI policy is in your kitchen. Your vendors are the farm.” Few companies have written AI policies at all. Fewer still require the same discipline of their external partners.
Vendors often have 100% of your data for the task they perform — bookkeepers, marketing agencies, payroll, billing firms. If those vendors use consumer tools or models that retain data, your confidential numbers, pricing, and client details can feed systems you never authorized.
That doesn’t have to look like a breach. It looks like a normal business decision made by a model nobody approved.
“The scary part is not that something leaked. The scary part is that decisions came back in.” — Nick Dreyfus
The practical Monday email (two questions)
Nick gives a single, no-budget move you can use immediately. Send this to every vendor who touches your data:
Are you using AI on any of our data that you have access to? If so, what guardrails and security do you have around it?
If they say no, have them sign a simple statement promising to notify you before they ever start. If they say yes, follow up with specifics: what platform, is it a paid/enterprise account or a consumer account, what data is retained and for how long, and whether their team has its own AI policy.
If a vendor refuses to answer or stonewalls, treat that as a business risk: either negotiate contractual guardrails or consider changing providers.
Flip the control: let vendors work in your environment
Nick recommends a move that separates thoughtful buyers from the rest: require vendors to use an account you provide, behind your multi-factor auth and single sign-on. You maintain visibility and controls without blocking the vendor’s access to models.
Practically, offer to pay the license and ask for a credit — it often nets out and gives you governance. Good vendors will accept this as standard practice; those who refuse may signal a risk you need to weigh.
What running agents actually costs and who should run them
Most organizations treat AI as a tool to buy. Nick’s view: you don’t need an appliance, you need a kitchen and a chef. From audits, running a useful business agent commonly costs between $3,000 and $25,000 per month, depending on design and usage.
Two common waste drivers:
Overly chatty agents that loop and check unnecessarily, burning tokens.
Using the wrong (expensive) model because teams don’t build the agent correctly.
A partner who designs the agent properly can often run it on a cheaper model at the same accuracy, and set alerts so you only investigate when usage exceeds expected thresholds — the surprise should be success, not an unexpected bill.
The decision you can make today
Treat vendor AI use as an explicit business risk, not an IT curiosity. Send the two-question email. Require vendor access through your accounts when appropriate. Have your attorney and compliance team define enforceable contract language if you’re regulated.
Nick’s final line is practical: this was preventable — not with more budget, but with a couple of questions. If you want a deeper review (an AI readiness audit, vendor checks, or an agent-cost audit), the episode includes links to that help.
If you only remember one concrete move from this episode, remember the two questions to send on Monday. It’s free, specific, and it changes the decision-maker from an invisible model back to you.