Why Microsoft Copilot May Be Your Most Risky Insider Threat

Mary Rundall, Senior Director of Product Marketing, Concentric AI

GenAI assistants like Microsoft Copilot have been transforming the business world since their debut just a few years ago. Innovation is skyrocketing, and productivity is off the charts. The dreaded role of meeting notetaker? Gone. That end-of-day proposal? Finished before your coffee gets cold. Seriously, what’s not to love?

Well…if you’re part of the IT or cybersecurity team, you might have a few thoughts on that last part. While GenAI assistants provide a lot of value, they also have significant implications when it comes to data security.

News headlines love a good villain story – the rogue ex-employee out for revenge or the sneaky vendor smuggling trade secrets to a competitor. But in reality, most insider threats come from normal people just trying to get their work done. This includes those who click the wrong link, use the “super handy” unauthorized app they found online, or share a file with the wrong person. No malice, just a combination of ignorance and convenience, with a dash of “I thought it would be okay.”

If you follow that logic, it’s not a stretch to say that GenAI assistants like Microsoft Copilot might just be the most talented accidental insider threat your organization has ever seen. Not because they’re plotting anything sinister - far from it - but because they are doing exactly what they were built to do. Think about it: Most employees only touch a few applications per day, each packed with their own mix of public and sensitive data. But behind the scenes, they often have access to far more information than they realize. It’s like giving everyone a master key and hoping they only open certain doors.

Unlike us mere mortals, GenAI assistants like Copilot are aware of everything they can access and will leverage that knowledge every time to complete their tasks to the best of their abilities. Does that mean they’re peeking at every piece of company data? Not exactly. Just like regular users, Microsoft Copilot is bound by access rules and can see only what those rules allow it to see. In turn, it will reveal sensitive data only to users who are cleared to view it. The catch is that there is usually far more access than should be allowed.

The underlying issue is that most organizations don’t truly know what sensitive data they have, where it’s located, and who has access to it. Without that visibility, a lot of sensitive information ends up mislabeled or not labeled at all. And when labels are wrong or missing, the access rules that depend on them fall apart. It’s like a small oversight that turns into a runaway snowball that can wipe out your data security policies along the way.

Most security pros I talk to get it. GenAI is risky. But many have no idea what to do about it. Some have drafted policies saying users can use only approved GenAI applications and cannot share sensitive data with them. Others have gone nuclear and blocked GenAI entirely. Spoiler alert: neither approach works in the long run.

Policies are only useful if you can enforce them, and outright blocking GenAI is a short-term fix at best. Eventually, business units that stand to benefit significantly from this technology will push back – and, let’s be honest, they’ll win. Progress will happen with or without security. Unless you want to be the person holding back innovation or earning the title of “productivity villain,” it’s time to stop fighting GenAI and start figuring out a plan for keeping your data safe while letting the magic happen.

Easier said than done, right? Data security isn’t new; it’s been around in some form for decades. But making it work is a whole other story. Security teams devote endless hours creating rules and regular expressions to teach their data security tools what to look for. Sure, some sensitive data is located, but there are also plenty of false positives. So, the team tweaks, tunes, and retunes, hoping for better results, but most of the time, the improvements are negligible, and sensitive data still slips through the cracks.

But don’t lose hope just yet. There are modern data security governance tools available today, powered by context-aware AI, that deliver the results you’ve been chasing and significantly reduce the risk of Copilot disclosing sensitive information to the wrong people. Here’s a look at how this technology can help your team get a handle on data security governance:

Data discovery and categorization: Forget rules, regex, and trainable classifiers because context-aware AI doesn’t rely on them. Instead, it scans all your structured and unstructured data across cloud and on-prem environments to accurately identify what sensitive data you have, where it lives, and who holds the keys. And it doesn’t stop at spotting PII and PCI - it can categorize and subcategorize each data record. That means you can assign precise labels and permissions based on the exact type of sensitive data.

Classification and access policies: New data is generated constantly, making manual labeling processes impractical. Context-aware AI can automatically assign labels and permissions to new data based on semantically similar existing data. The result is a more accurate classification with much less effort. Just make sure your chosen solution can actually remediate issues directly from the platform. Otherwise, you may end up relying on a patchwork of tools.

Continuous risk monitoring: A one-time snapshot is helpful, sure, but it ages faster than milk on a hot summer day. You need continuous monitoring for risks like data in the wrong place, improperly labeled or mislabeled data, or over-permissioned content, so you can act fast. Context-aware AI can also detect anomalous user activity in relation to data that may indicate a breach or insider attack, like privilege escalation followed by a flood of encrypted or shared data records.

Copilot user activity: You’ve discovered, labeled, and locked down your data – great! Now, you need a way to verify to make sure your data governance is actually working. Your solution should give you visibility into exactly which data records Copilot has shared, who accessed it, and when. That way, you can be confident it is revealing sensitive information only to the people who are supposed to see it.

We’re just scratching the surface of what we can accomplish with GenAI assistants, and the future is looking incredibly exciting. The best part? You don’t have to choose between innovation and security. With the right data security governance in place, you can protect your data while empowering your teams to do their best work.