Gartner has put a number on something most CIOs and CISOs already feel in their gut: through 2026, at least 80% of unauthorised AI activity inside the enterprise won\u2019t come from an external attacker. Instead it will originate from inside the tenant, through oversharing, misuse, and AI behaving exactly as badly as the data it was pointed at. <\/p>\n\n\n\n
This statistic matters because it reframes the whole conversation. For a decade, security budgets have been built around keeping people out. Copilot and its agentic successors have quietly flipped the risk model. The people who can now find, summarise and act on your organisation\u2019s most sensitive data are the people who already have a login. The threat isn\u2019t the firewall. It\u2019s the folder nobody labelled, the SharePoint site nobody decommissioned, and the \u201ceveryone\u201d permission group nobody has audited since 2019. <\/p>\n\n\n\n
At Insentra, our Information Management, Governance & Compliance (IMGC) practice exists to help partners and their clients govern, protect and prepare their data for the AI era, fixing exactly that problem before it becomes a Copilot incident, a regulator\u2019s finding, or a board-level embarrassment. <\/p>\n\n\n\n
Across our work with organisations operating in highly regulated environments, including government agencies, councils and enterprise businesses, we continue to see the same eight problems. From SharePoint information architecture and Microsoft Purview governance design through to tenant-to-tenant migrations, these challenges appear in different forms but share a common underlying cause. They may look like eight different fires, but they are really one fire, viewed from eight different angles. <\/p>\n\n\n\n
Unstructured SharePoint sites, inconsistent metadata, duplicated folders, unmanaged Teams environments and unclear information ownership make it difficult to understand what information an organisation holds.
Copilot does not fix poor information management. It can make existing information easier to discover, including content that should have been reviewed, archived or removed.
Without a clear information architecture and consistent governance, organisations risk amplifying existing problems as AI adoption grows.<\/p>\n\n\n\n
Sensitive content shared \u201cjust to be safe,\u201d links left open long after the project ended, and no sensitivity labelling to catch it before an AI agent does.<\/p>\n\n\n\n
Without appropriate sensitivity labelling, access controls and regular reviews, these risks can remain hidden.<\/p>\n\n\n\n
Introducing Copilot does not automatically create these access issues, but it can make the consequences of existing oversharing much more visible. <\/p>\n\n\n\n
Retention requirements, records management obligations and regulatory controls are difficult to demonstrate when they rely on spreadsheets, manual processes and institutional knowledge. <\/p>\n\n\n\n
For organisations, particularly those operating in government and regulated industries, information governance needs to be more than a documented policy. <\/p>\n\n\n\n
It requires consistent implementation, clear ownership and the ability to demonstrate that controls are working. <\/p>\n\n\n\n
As privacy, security and operational resilience expectations evolve, organisations need greater visibility into how information is stored, accessed, protected and retained. <\/p>\n\n\n\n
Microsoft Copilot licenses have been purchased, pilots have been launched and AI adoption is gaining momentum. But one fundamental question remains, does the organisation understand what information Copilot can access?<\/p>\n\n\n\n
If nobody has a clear picture of existing permissions, sensitive information, sharing arrangements and governance gaps, scaling Copilot becomes difficult to justify confidently. <\/p>\n\n\n\n
The answer is not necessarily to delay AI adoption indefinitely. It is to understand and address the highest-priority information risks before expanding access.<\/p>\n\n\n\n
Access permissions that were appropriate when originally assigned can become a security risk over time. <\/p>\n\n\n\n
Employees change roles, projects finish, contractors leave and organisational structures evolve. Yet permissions are not always updated to reflect those changes. <\/p>\n\n\n\n
Inherited permissions, outdated group memberships and unnecessary access can leave sensitive information exposed. <\/p>\n\n\n\n
Without regular access reviews and clear ownership, organisations can lose control of who has access to what, and why. <\/p>\n\n\n\n
Many organisations lack a consolidated view of where sensitive information resides, who can access it and how exposed it is across Microsoft 365. <\/p>\n\n\n\n
This makes it difficult to identify the combination of information exposure, excessive permissions and misconfigured controls that can create significant business risk. <\/p>\n\n\n\n
Microsoft Purview and other security capabilities can help improve visibility, but technology alone is not enough. Organisations also need the right governance framework, policies and processes to turn that visibility into action. <\/p>\n\n\n\n
Years of accumulated redundant, obsolete and trivial (ROT) information can leave Microsoft 365 environments cluttered with content that no longer serves a business purpose. <\/p>\n\n\n\n
Duplicated documents, outdated project files, abandoned Teams and unnecessary data create more than a storage challenge. <\/p>\n\n\n\n
They make information harder to manage, increase the complexity of governance and can introduce unnecessary noise into search and AI experiences.
Organisations need a structured approach to identifying, classifying, retaining and disposing of information in line with business and regulatory requirements. <\/p>\n\n\n\n
Tenant consolidations, mergers and acquisitions, SharePoint modernisation and broader cloud migrations create opportunities to improve information management. They can also transfer existing governance problems into a new environment. <\/p>\n\n\n\n
Moving content without understanding its structure, ownership, permissions and retention requirements can simply reproduce the same issues elsewhere. <\/p>\n\n\n\n
A successful migration should do more than move information. It should create an opportunity to improve information architecture, reduce unnecessary exposure and establish better governance from the outset.<\/p>\n\n\n\n
None of these are new problems. What\u2019s new is the cost of leaving them unaddressed. Each of these eight issues is governance debt, built up through decisions deferred, postponed cleanu<\/s>ups and unclear ownership. AI is the first technology capable of exposing the debt across an entire organisation, instantly and in ways that are easy for people to understand.
Addressing the underlying governance framework provides a sustainable way to resolve all eight challenges. Fixing individual folders, applying isolated sensitivity labels or updating policies one at a time will only address the symptoms, not the root cause. Why IMGC <\/p>\n\n\n\n
Insentra\u2019s Information Management, Governance & Compliance (IMGC) practice was established to help organisations navigate the growing complexity of information governance, security and compliance in an increasingly AI-driven world. Across global markets, organisations face evolving regulatory requirements, increasing scrutiny over how information is managed and protected, and growing pressure to demonstrate effective governance.
From government agencies and local authorities managing public records and information access obligations to regulated organisations navigating frameworks such as GDPR, NIS2, DORA, ISO 27001 and regional privacy and cybersecurity legislation, the challenge is universal: ensuring information is governed, protected and managed throughout its lifecycle. <\/p>\n\n\n\n
Drawing on our Microsoft 365 and Microsoft Purview technical expertise, governance and compliance knowledge, and practical delivery experience, Insentra helps partners and their clients turn these challenges from known risks into managed capabilities. Through Strategy, Implementation and Operations, we help organisations establish a stronger information governance foundation, address existing risks and prepare their environments for AI adoption without unnecessarily slowing down the business.
What\u2019s coming <\/p>\n\n\n\n
Over the next eight instalments, we\u2019ll explore each of these challenges in detail, examine how they look in a real tenant, why they are becoming increasingly urgent as an organisation accelerate AI adoption, and the practical governance frameworks that can help address them. The objective is to move beyond identifying problems and provide practical guidance that helps organisations build a more secure, governed and AI-ready Microsoft 365 environment. <\/p>\n\n\n\n
Before expanding your use of Microsoft Copilot and AI, do you know what information your organisation holds, who can access it and where the risks lie? <\/p>\n\n\n\n
Insentra’s Know Your Data Assessment<\/strong> is a paid, three-to-eight-week engagement designed to uncover information exposure, identify governance gaps and prioritise risks across your Microsoft 365 environment. <\/p>\n\n\n\n You’ll receive a clear risk heat map and a practical Copilot-readiness roadmap to help you take control of your data and move forward with confidence. <\/p>\n\n\n\n Don’t let unmanaged data become your biggest AI risk.<\/strong> <\/p>\n\n\n\n \ud83d\udc49 <\/strong>Book a Know Your Data Assessment Scoping Call<\/strong><\/a><\/p>\n\n\n\n