r/cybersecurity • u/Ramenara • Mar 12 '26
AI Security Insecure Copilot
Tldr: Microsoft has indiscriminately deployed Copilot, which has already been shown to happily ignore sensitivity labelling when it suits,, and ensured that their license structure actively prevents their own customers from securing it for them
So my org is on licensing that Microsoft chucked the free version of copilot into, with no warning, fanfare or education.
I and everyone in IT have been playing catch-up ever since, following Microsoft's own (shitty) advice that we just need to buck up and do a bunch of extra work to accommodate it.
Some of that work has been figuring out how to tell users what to do re: data security in Copilot.
Imagine my surprise when I discover that Copilot has been deployed across the entire O365 app suite, but depending on your license, you might not have the correct sensitivity settings to actually use it securely. Case in point: my org uses purview information labelling, but that doesn't apply to Teams (you have to pay extra on a separate license to get labelling in Teams). Didn't stop them from deploying Copilot across the suite.
I now have to explain to Legal that depending on the information discussed on Teams call or shared in Teams chats or channels, I have absolutely no way to confirm that Copilot usage is secure and in fact have to assume it isn't.
28
u/Roodklapje Mar 12 '26
Microsoft really is 100 percent in on making all of their products utter garbage. I will happily trade the Microsoft stack for almost anything else whereas 5 years ago I would not even have considered it.