My first reaction to the ISO 27001 documentation was incredulity. “This is not security,” I remember thinking, “this is just ass cover in case things go wrong.”
Working with others changed my mind. Over the years, we collaborated with agencies that did not bother with certifications, and the difference was evident: decisions buried in emails, informal release processes, porous security. The “ass cover” was a list of what was missing.
In the AI era, standards have become a point of difference. Anyone can vibe code an app, publish a website and incorporate a company in an afternoon. Faced with so many alternatives, buyers are having trouble figuring out what is credible and what is not.
Economists have neat theories to describe this situation. George Akerlof’s market for lemons shows that when we cannot judge quality, we assume the worst. Michael Spence’s work on signalling shows that confidence is restored by signals that are expensive to fake.
AI makes cheap signals cheaper, so buyers look out for the costly ones. A good place to start is brand consistency, social proof and certifications.
Key idea
Armed with AI, anyone can build a product, a brand and a company at a low cost. Buyers discount anything that seems easy to produce and look for signals that are costly to fake: named clients, partner agreements, audited standards and time in market. Evidence of commitment is the new currency of trust.
Brand proof
A brand is convincing only when it is consistent. Visual identity and tone of voice must be applied accurately across channels, from email signatures to social posts. Originality matters: websites designed exclusively with AI come across as cheap templates.
Claims of authenticity are being tested. Pangram is sharpening its AI text detection and extending it to images. More than 6,000 organisations now apply Content Credentials, the C2PA’s open provenance standard. AI-generated assets are fine, but buyers are looking for intent and are growing weary of thinly veiled slop.
Social proof
The best way to prove your claims is to have people make them on your behalf. In a recent buyer survey, vendor collateral came last among the resources buyers rely on, and 47% said they trust online resources less than they did a year ago. To build trust, newcomers have to borrow credibility from companies and individuals the buyer is familiar with.
The strength of those connections matters more than their number. Anyone can fill a panel with names of companies they are loosely associated with. Partner programmes, signed agreements and named quotes carry more weight than a collection of logos under the hero banner.
Process proof
AI agents cast a spotlight on the classic security asymmetry: defences must hold every time, while an attacker only needs to be successful once. In the OpenAI/Hugging Face incident this summer, agents performed 17,600 actions over 4 days. Consistency has to come from routine, which is what standards encode.
Certificates signal that an organisation is mature and disciplined enough to adhere to a set of standards. ISO 27001 attests to a management system in which risks are assessed, access is controlled, and incidents are managed and disclosed. It is evidence that the chances of intrusion are lower, that any mishaps will be properly handled, and that the impact will be minimised.
SMEs are the least prepared. The UK government’s latest breaches survey found that the share of small businesses with a formal cyber security policy fell from 59% to 52%. Organisations holding the entry-level Cyber Essentials certificate are 92% less likely to claim on their insurance, proving that even the bare minimum can make a real difference.
Are you here to stay? Prove it.
Brand, social and process proof points are evidence of staying power. As the cost of entry falls, buyers are seeking certainty that a supplier is there to stay and that the relationship is worth investing in.
SME leaders would do well to take a simple practical test. List every claim you make and identify the ones that a competitor could reproduce in an afternoon. Back those up with evidence: named clients, partner agreements, relevant certificates.
Among the deluge of cheap claims, these records are what cautious buyers look for first: proof of good habits, in a world full of bad ones.
Reading list
Anatomy of a frontier lab agent intrusion (Hugging Face) – How a certified platform detected, contained and disclosed an attack it could not prevent.
The market for “lemons” (Quarterly Journal of Economics) – Akerlof on why buyers who cannot verify quality assume the worst.
Job market signalling (Quarterly Journal of Economics) – Spence on why a signal only persuades when it is costly to fake.
Beyond the hype (TrustRadius) – Buyers have stopped reading vendor collateral and turned to peers and third parties.
2026 Edelman Trust Barometer (Edelman) – Trust is retreating into familiar circles, leaving newcomers to earn it with evidence.