Security leaders in SMEs should make risk-aware choices about Claude plans and products rather than enabling all features immediately, and should include shadow AI usage by employees in their risk modeling.