Catalogue the Clinic Before You Renovate It
An agentic CRM launch and a public vendor-audit checklist arrived in the same week — and together they raise the same question: do you know what is already running in your business?
3 August 2026 — Two very different things landed this week, and they answer the same question from opposite ends.
The first was Attio's agentic CRM — a customer platform where the agent is not a feature bolted onto a database but the interface through which the database is used. It is a good product, and it points at where business software is going: the system stops being something you operate and starts being something that operates for you.
The second was far less exciting and considerably more useful: a five-step checklist for auditing a vendor through public information alone. Website reconnaissance. Certificate history. Subprocessor lists. Privacy policy version history. Job postings. All of it available to anyone, free, without a sales call.
Read together, they define the actual decision facing a small business in 2026. The tools are getting better faster than the diligence around them. You can now buy an agentic platform in an afternoon that will hold your customer data, and the only thing standing between you and a bad decision is whether you spent forty minutes checking who you are buying from.
The same week supplied a useful frame for the risk side: the argument that we have entered an "exploit age," where the marginal attacker is automated and the marginal defender is not. Whether or not you accept the label, the asymmetry it describes is real. Attack economics have improved dramatically; defence economics have not improved nearly as fast.
What this means if you run an SME. Before you deploy anything agentic, produce an inventory of what you already run — every tool that touches customer data, every subscription someone expensed, every API key in a script nobody remembers writing. The inventory is the unglamorous prerequisite for every useful thing that follows: classification, vendor review, access control, incident response. Businesses that skip it end up renovating a building without knowing where the load-bearing walls are.
Forty minutes of public-source diligence on a vendor is the highest-return security work most small businesses can do this month.
Ninth in a weekly series on the developments that matter to small and mid-sized organisations.