Security concerns delaying Microsoft Copilot deployments

Research published by CoreView has found that security concerns are causing many organisations to delay or pause Microsoft Copilot deployments, with security leadership particularly worried about the risk of the AI assistant exposing confidential data. Infosecurity Magazine reports that the research highlights concerns about how Copilot accesses and processes organisational data, the difficulty of controlling what information the tool can retrieve, and the risk that users may inadvertently share sensitive content through AI-generated responses. The findings suggest that while many organisations are interested in the productivity benefits of AI assistants, the security and data governance implications are not yet well enough understood or controlled to proceed with confidence.

Why this matters for UK organisations

For UK organisations evaluating or deploying Microsoft Copilot, this reflects a broader challenge with generative AI tools in the workplace. The concern is not that the technology is inherently insecure, but that it operates across a wide range of data sources, user permissions and content repositories in ways that are difficult to predict or audit. Organisations need to understand what data Copilot can access, how it respects existing permissions and data classification, and whether the tool's behaviour is consistent with data protection obligations and internal information handling policies. The research suggests that many organisations are finding these questions difficult to answer with confidence, and are choosing to delay deployment until they have clearer controls in place. This is a sensible and proportionate response, and reflects the reality that AI assistant deployments should be treated as a data governance and security decision, not just a productivity or IT rollout. Organisations that proceed without clarity on these questions risk creating data exposure, compliance issues or user confusion that could undermine confidence in the technology.

What to review

Organisations considering Microsoft Copilot should review what data the tool can access, how it respects existing permissions and data classification, and whether the organisation has sufficient visibility and control to meet data protection and confidentiality obligations. This includes understanding how Copilot interacts with SharePoint, OneDrive, Teams, Exchange and other Microsoft 365 services, and whether existing data classification, sensitivity labels and access controls are sufficient to prevent unintended data exposure. Organisations should also consider whether they have the governance, training and user guidance needed to help employees use AI assistants safely and appropriately, and whether incident response plans include procedures for investigating suspected data exposure through AI-generated content. It is also worth reviewing whether AI assistant deployments are being treated as a strategic decision with clear ownership, or whether they are being rolled out as part of a broader Microsoft 365 licensing or productivity initiative without sufficient security and governance oversight.

Source: Infosecurity Magazine