Topic starter
14/07/2026 4:23 pm
TL;DR: As Microsoft 365 Copilot and other GenAI tools spread content across SharePoint, OneDrive, Teams and Exchange, traditional pattern-based data security platforms struggle with false positives, slow scans and limited visibility, according to Proofpoint. The governance problem is no longer just data discovery, but controlling how human and AI interactions can surface, transform and exfiltrate sensitive information.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “Proofpoint DSPM vs. Varonis for Microsoft 365 and Copilot: better accuracy, lower cost, faster time to value”.
By the numbers:
- AI-powered verification reduces Personally Identifiable Information false positives by up to 99%, according to Proofpoint.
Key questions
Q: Where does legacy DSPM fail when Copilot starts surfacing sensitive data?
A: Legacy DSPM fails when it assumes static discovery is enough.
Q: Why do Copilot and GenAI increase data governance risk?
A: They increase risk because they add new ways for sensitive data to be surfaced, transformed, or shared without changing the original governance assumptions.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Audit Copilot-accessible content paths Inventory where Microsoft 365 content can be surfaced through Copilot, including SharePoint, OneDrive, Teams, Exchange and connected SaaS, then rank the highest-risk repositories by business sensitivity.
- Rework permissions around exposure, not storage Reduce excessive permissions and oversharing on content that Copilot can reach, because repository placement alone does not describe the real exposure surface.
- Test classification against AI-generated outputs Validate whether your current DSPM can still identify sensitive material after it has been summarised or reformatted by GenAI workflows, not only in its original file form.
Bottom line: Copilot and similar GenAI tools change data exposure from a file discovery problem into an interaction governance problem that spans Microsoft 365, email and SaaS.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:31 pm
Copilot-era exposure is a governance problem, not a classification problem. Legacy DSPM treats discovery as the primary control, but AI changes the unit of risk from files to interactions. When users and services can retrieve, summarise and redistribute data at speed, visibility into access paths matters more than static labels. Practitioners should govern data movement as a live control surface, not a one-time scan result.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations treat AI data governance as part of DSPM?
A: Yes, because AI training, retrieval, and prompt data can expose sensitive information even when the model itself is secure. DSPM should govern where that data resides, who can access it, and whether it is tagged and retained appropriately. Otherwise, AI becomes a new route for data exposure.
👉 Read our full editorial: Copilot expands data exposure faster than legacy DSPM can govern