AI deployment outpaces data security checks, study finds

As reported by Infosecurity Magazine, a new study by Syskit reveals that organizations are deploying enterprise AI tools, such as Copilot on Microsoft 365 data, at a faster rate than they are verifying the underlying data foundations and security permissions.

The State of Microsoft 365 Governance Report, published September 10, found that 76% of UK and US organizations have piloted or deployed enterprise AI. However, only 43% completed a thorough review of permissions and oversharing risks beforehand. Controls for AI agents also lag, with 91% confident in their visibility of active agents but only 22% having a formal policy defining AI agent access. One in 10 organizations allow AI agents to inherit the full permissions of the user who deployed them. This lack of rigorous permission review exposes organizations to risks, as AI tools can now surface sensitive content, including legacy files shared broadly years ago, with greater ease.

The study highlights that 41% of organizations leave SharePoint sites accessible to all staff without restrictions, and 35% have former employees' files still available to active users. Furthermore, 47% identify orphaned teams, groups, and sites as a key governance challenge, content that AI tools can access with the same authority as secured data. The report surveyed 327 IT and security decision-makers in US and UK organizations with 500 or more employees.

Source: Infosecurity Magazine