The "AI" label is on every product category now, from email filtering to surveillance to the help desk. Most of it is marketing; some of it is real. After two years of running AI-adjacent tools across our managed client base, here's what we've found genuinely useful, and what's still vaporware.
01What's actually working.
Email security analysis (Abnormal, Microsoft Defender for Office 365) does detect BEC and impersonation attacks that rule-based systems miss. The catch rate improvement is real and measurable. This is the single highest-impact AI category for SMBs right now.
Endpoint detection behavioral analysis. Modern EDR products (SentinelOne, CrowdStrike, Microsoft Defender for Endpoint) use ML models to detect attack patterns the signature-era products couldn't catch. The detection improvement is tangible.
Meeting transcription and summarization (Teams Premium, Zoom AI Companion, Otter, Granola). Useful, mature, and a real productivity gain for operations with lots of meetings.
02What's genuinely useful with caveats.
Microsoft 365 Copilot. Real productivity tool for heavy Word/Excel/Outlook users; uneven fit for organizations that don't already use M365 deeply. Licensing is $30/user/month on top of existing M365, not trivial. Calculate the ROI per user before broad deployment.
Customer-facing chatbots. Range from genuinely helpful to actively harmful. Deploying carelessly produces a worse experience than no chatbot at all. Small, well-scoped deployments outperform broad "replace human support" attempts.
Code-generation assistants (GitHub Copilot, Cursor). Real productivity gain for in-house developers; not relevant for most SMBs without software teams.
03What's still mostly marketing.
"AI-powered cybersecurity" features on network gear (firewalls, switches) that are frequently just rebadged signature matching. Scrutinize these claims, ask what specifically the AI does and what detection improvement it delivers vs the previous version.
"AI analytics" on budget surveillance products. The good ones work; the cheap ones hallucinate. The only way to know is to see live demo footage on cameras installed in conditions similar to your own.
Any category where the AI requires moving significant amounts of your proprietary data to an unfamiliar vendor's cloud. Re-read the data-use terms carefully. The answer might be no.
04Data-governance questions AI deployment forces.
Once you deploy a tool that touches your email, documents, or CRM, which most AI tools do, you're now making decisions about where your data is processed, what the vendor can train on, and whether regulated data (PHI, financial records, legal work product) is appropriately handled.
Practical approach for regulated industries: deploy AI tools in a tenant or workspace configured with appropriate data-residency, training-opt-out, and retention settings. Microsoft's enterprise tenant settings are the most mature here.
05Where to start.
Highest-ROI starting points for most SMBs: email security AI (you probably already have it, make sure it's enabled and tuned), EDR with behavioral detection (if you don't have real EDR, start there), meeting transcription (try it; it's cheap and measurable).
Pilot first, deploy broadly second. The AI product that changes how your team works deserves six weeks of evaluation before the year-long commit.
Current AI-pilot status across the client base: Copilot M365 rolled out to four firms (two kept it, two dropped), Otter.ai deployed to three, Glean piloted and declined by two, custom GPTs wired to CRM at one. Honest recommendation is usually "wait six months, let the pricing settle"but we'll do the pilot with you if you want the data.