The Fire Drill Test for SMB AI

Ten minutes into my interview with Murali Swaminathan, his building tried to evacuate him.

“Ladies and gentlemen, your attention, please,” the PA announced. “This is a fire evacuation drill. There is an emergency at level 15.” Several floors were sent to the stairs. “Do not use the lift. I repeat, do not use the lift.”

Freshworks’ chief technology officer apologized and offered to reschedule. Then he put in his AirPods and kept going. His floor was clear, and it was only a drill. The announcements kept interjecting anyway.

A fire drill works because nothing in it is new. Wardens know their floors, exits are marked, and nobody experiments with the lift at that time. Swaminathan makes the same case for AI in smaller companies: automate what already works, rehearse it, and then earn the right to do more.

If something “cannot be accomplished through humans, you can’t just assume that AI is going to make it work for you,” he says.

It sounds obvious. So why do so many AI projects stall? For small companies, part of the answer starts with who the research is about.

You are not in the sample

Let’s start with a basic question: who counts as “mid-market”?

Freshworks’ new Global Cost of Complexity survey counted companies with 250 to 5,000 employees. When I asked Swaminathan, he set the bar higher: at least 500 employees, up to 5,000 or 10,000, or “$1-$10 billion revenue for us.” The National Center for the Middle Market (NCMM), which Freshworks quotes in its own release, defines the U.S. middle market as companies with $10 million to $1 billion in revenue. Singapore counts any firm with 200 or fewer workers or up to S$100 million in revenue as a small or medium-sized enterprise, or SME.

That is four definitions, and no two match. Swaminathan’s mid-market starts where the NCMM’s ends. A 300-person regional insurer or distributor falls below his floor entirely.

This matters when you benchmark. A CDO at a 300-person firm who reads “mid-market” research may be comparing herself with companies of up to 5,000 people, more than 16 times her size. Her job is different, too. Swaminathan says these firms run on “lean IT.” At a 300-person company, the CDO may also be the CIO and the security lead.

And the distance between small and large firms is growing. Singapore’s Infocomm Media Development Authority (IMDA) found that AI adoption among SMEs tripled from 4.2% to 14.5% in 2024. Among larger firms, it rose from 44% to 62.5%. The small firms moved fast, yet the gap widened from about 40 to 48 percentage points.

It’s easy to blame money, but that is not the main barrier. An OECD survey of more than 5,000 SMEs in seven countries found the top barriers to generative AI were doubts that it suits the work (57%), legal and copyright concerns (54%), data privacy (52%) and staff skills (50%). Simply put, small firms lack confidence that AI fits, and people who can make it fit.

Getting started is affordable. Getting AI to work is not, and Freshworks has tried to measure that cost.

The complexity tax

Freshworks surveyed 12,021 IT decision makers. It found that mid-market companies lose an average 25% of their AI spending to complexity before they see any return. In the U.S. alone, the company estimates USD16.29 billion a year goes to making AI work at all. The top reasons pilots fail are system integration (27%), skills shortages (26%) and too much configuration (26%).

The details EW worse. Only 15% of respondents have AI integrated across core operations, and 36% are stuck in pilots. Teams run an average of 4.2 AI tools. Eight in 10 say AI output adds noise, errors or rework. Only one in three has a formal governance framework that it applies consistently. And 72% of executives expect a return within eight months, while 55% say deployment alone takes six to 12 months.

“The autonomy that you are trying to give this AI agent has to be earned. It just cannot be granted.” — Murali Swaminathan @ Freshworks

For a large enterprise, a 25% loss is a line item. For a small firm with one AI budget, it can consume the entire pilot.

Moving fast doesn’t help. Indian mid-market firms are more than twice as likely as the global average to run AI across core operations. They also lose more to complexity: 27% of budget.

Independent studies agree. MIT’s NANDA initiative found that 95% of generative AI pilots stall and never reach scaled adoption. Gartner predicts that more than 40% of agentic AI projects will be canceled by the end of 2027, citing cost, unclear value and weak risk controls.

Swaminathan puts the blame on deployment, not the technology. “AI’s job is to make it simple,” he says. “But if you deploy too many tools … it’s going to get complex for you.”

So what should a small team do with a small budget? The same MIT study offers a starting point.

Buy the boring thing first

AI tools bought from vendors or partners succeed about two-thirds of the time, MIT found. Tools built in-house succeed about a third of the time. Freshworks reports that 54% of mid-market firms already buy rather than build.

For a team with no machine learning engineers, the choice is easy. Buy the tool, and spend your few skilled people on the process, not the plumbing.

The process is where most CDOs slip. “The blind spot is trying to achieve too many things, not having focus on outcomes that you want to build and not having clear metrics,” Swaminathan says. His fix: pick a process people already run well, prove it in one team, measure the result, then expand. “The CDOs should know how much to chew.”

Freshworks’ answer for lean teams is templates. It ships “35 to 50 workflows out of the box,” he says, such as employee onboarding and password resets. Templates get you started fast. They can also tie you to the vendor that wrote them. Know the cost of leaving before you sign.

Buying the tool, however, does not mean buying someone to blame.

You own the workflow

When an AI agent gets something wrong, who is responsible?

Swaminathan splits it three ways. Model providers supply “the bare bones.” Application vendors such as Freshworks own the guardrails between your data and the model: content filters, keeping personal data out of prompts and keeping data in the right region. The business process belongs to the customer.

“When it comes to the business process itself, we are expecting the CDOs to take responsibility,” he says. “They can’t delegate it to a model provider or application provider.”

While that position suits a vendor, it is also hard to argue with. A badly designed workflow runs badly at machine speed. What Swaminathan didn’t explain is how that split appears in a contract. Ask before you sign, while you still have leverage, and get the answer in writing.

His rule for rollout is worth mulling over: “The autonomy that you are trying to give this AI agent has to be earned. It just cannot be granted.” In practice, AI starts in assist mode, moves to recommend mode and only then acts on its own. Run a marathon “on the get-go without training,” he warns, and you fail.

Earned autonomy needs proof. That means measuring the right thing.

Measure solved problems

Start with outcomes, not activity. A ticket can be “picked up in 15 minutes, resolved in 30 minutes,” Swaminathan says, “but it may not really solve the problem.” His warning signs of a failing deployment: ticket volume isn’t falling, and staff aren’t being freed up. A small team can track both in a spreadsheet.

Proof also needs good records. Will AI agents replace IT service management (ITSM) software, the help-desk systems that log and route employee requests? Swaminathan, who oversaw ITSM engineering at ServiceNow before he joined Freshworks in 2024, says no. The belief that AI will replace such software entirely, he says, is today’s real hype.

“When it comes to the business process itself, we are expecting the CDOs to take responsibility.” — Murali Swaminathan @ Freshworks

“The system of record becomes a system of context,” he says. The system of record holds the official data: who the user is, which laptop they have, which tickets they raised and which rules apply. Those links tell an agent what it needs to know, so it doesn’t guess. They also keep the audit trail intact. “A compliance person comes in and says, ‘OK, I want to know who approved this one,’” he says. If an AI approved it, you need to know when, and under what conditions.

For a small firm, the lesson is practical. Run agents inside a platform that already holds your records, instead of adding another tool.

Measurement covers the AI you approved. The harder problem is the AI you didn’t.

One person, three hats

Early 2026 gave every small-company security lead a warning. OpenClaw, an open-source AI agent that anyone can install, went viral. Researchers found more than 1,800 exposed installations leaking API keys and credentials. Koi Security, which Palo Alto Networks agreed to buy in February, audited 2,857 add-on “skills” for the agent and found 341 that were malicious. Freshworks reports that 71% of U.S. mid-market IT leaders say unapproved “shadow AI” is common in their organizations.

Swaminathan’s rules are simple. Route every AI tool through single sign-on. Log access. Block what isn’t approved. Keep role-based permissions, so each tool sees only what its user may see. “Just because you [run] OpenClaw, it doesn’t mean you run OpenClaw in the full admin mode,” he says. “If you are working with an enterprise, there are no secrets.”

He also warns against layers of committees. Freshworks’ own AI governance council meets monthly, with engineering, legal, infosec, IT, finance and procurement at the table. Requests arrive as tickets and go through a checklist. Each is approved, approved with exceptions or deferred, and every decision is recorded so the next request follows the same path.

A 300-person firm can’t fill that table. It can copy the method: one intake form, a short checklist and a monthly half-hour with whoever covers legal, finance and security. Swaminathan’s minimum bar for any AI vendor is short: a SOC 2 Type 2 audit of its security controls, ISO/IEC 42001 certification (the international standard for managing AI), role-based access, your data kept inside your boundary and no training on your data.

That half-hour may be the cheapest AI control a small company can buy.

The small-company CDO’s checklist

• Check the sample. Before you show “mid-market” research to your board, check the company sizes behind it.
• Buy before you build. In MIT’s study, bought tools succeeded twice as often as internal builds.
• Automate only what already works with humans.
• Make agents earn autonomy: assist, then recommend, then act.
• Limit the number of AI tools.
• Put accountability in the contract.
• Measure solved problems, not closed tickets.
• Run one intake path for AI tools. No ticket, no tool.

Near the end of our call, the PA went quiet. Swaminathan thanked me “for persevering.” It was never a real fire. Everyone in his building knew where the stairs were because someone had rehearsed the route long before the alarm. The small companies that get value from AI will be the ones that rehearsed theirs.

Image credit: iStockphoto/UlianaD