AI Is exposing the access problems organisations failed to fix
99% of organisations had sensitive data exposed to AI tools, according to Varonis’ 2025 State of Data Security report. The data security company examined 1,000 real-world IT environments covering nearly 10 billion cloud resources across Microsoft 365, Azure, Salesforce, Slack, and Google Cloud. It also found that 90% had exposed sensitive cloud data and 88% still had stale but enabled accounts.
Those figures describe the environment into which businesses are deploying tools such as Microsoft 365 Copilot. Years of collaboration have left organisations with old SharePoint sites, broadly shared Teams content, forgotten OneDrive permissions, and links created for projects that ended long ago. Much of that information may have been technically accessible for years without attracting attention because somebody had to know where to look for it.
Copilot changes that experience. It can retrieve and synthesise information a user already has permission to access across Microsoft 365. Microsoft states explicitly that Copilot respects existing permissions and sharing controls. It also warns that overshared or poorly governed content can affect Copilot results.
In the Microsoft environments I work with, this is one of the most important issues to resolve before wider AI adoption. A SharePoint site may still be shared with “Everyone except external users”. A project site can retain contracts, pricing information or HR material years after the work finished. Personal OneDrive folders may have broad historical sharing permissions. Some sites no longer have an active owner who can explain who should still have access.
Copilot works from the access people actually have. If an employee has technical permission to open a document, the fact that they were unlikely to discover it manually offers little protection once an assistant can retrieve relevant information in response to a prompt. A permissions mistake that previously required persistence or prior knowledge can become considerably easier to surface.
There is also a problem with aggregation. Individual documents can appear unremarkable while collectively revealing something commercially sensitive. Headcount plans, budget changes, recruitment activity, and internal correspondence could together indicate a forthcoming restructure. Client emails, pricing documents, and renewal dates could reveal the state of an important commercial relationship. The exposure can emerge from information a user was individually permitted to access across several locations.
I have encountered broader governance weakness through conventional data-protection work. In one corporate IT environment, supplier information was being shared through WhatsApp Web, which was not an approved channel for handling business data. The response involved reviewing sharing controls, strengthening Data Loss Prevention policies, and reinforcing the approved routes for sensitive information. It was not a Copilot incident, but it demonstrated how easily information can move beyond the controls an organisation believes are governing it.
Deploying AI over that environment increases the need to understand where sensitive information actually sits and who can reach it.
Microsoft’s own Copilot readiness guidance recommends identifying potentially overshared content, inactive, or ownerless sites and inappropriate access before deployment. SharePoint controls can also restrict sensitive sites so that people without the required group membership cannot access the content or see it through Copilot.
The practical work begins with the information estate. Organisation-wide access should be removed where it is unnecessary. Old sites need an owner or an archive decision. Historical sharing links need reviewing. Sensitive documents need appropriate classification and protection. Where access cannot be corrected before a roll out, restricting particularly sensitive areas from Copilot can provide a temporary control while the underlying problem is resolved.
Purview, sensitivity labels and DLP can enforce those decisions, but they cannot make them. Technology cannot determine which commercial information a particular team genuinely requires or whether a five-year-old project site still needs 200 members. Someone in the business has to own those decisions and be prepared to remove access that no longer has a legitimate purpose.
I would also test readiness from the perspective of real employees. Accounts representing different roles can be used to test queries around salaries, board papers, client pricing, contracts, and planned organisational changes. The purpose is to see what each role can retrieve before thousands of employees begin asking similar questions. I have not personally completed this form of AI retrieval testing in a live client environment, so I treat it as a recommended readiness method, not a case study from my own work.
An organisation ready to scale Copilot should be able to show where its sensitive information lives, who owns the repositories containing it, who currently has access and when those permissions were last reviewed. AI auditing, DLP, and incident-response planning then sit on top of an information environment the business understands.
The 99% figure should concern leaders because it suggests AI is arriving in organisations whose data estates already contain substantial exposure. Copilot will operate on the permissions and information structure it inherits. Cleaning up that inheritance is part of deploying the technology responsibly.
For more startup news, check out the other articles on the website, and subscribe to the magazine for free. Listen to The Cereal Entrepreneur podcast for more interviews with entrepreneurs and big-hitters in the startup ecosystem
