Two-thirds of organizations have delayed or cancelled deployment of Microsoft Copilot over concerns that the AI-powered assistant could expose confidential data, a survey of security leaders has revealed.
CoreView’s State of Microsoft 365 Security and Governance 2026 report, published on 21 July, suggested that there are widespread security concerns around deployment of Copilot.
One worry is that deploying Microsoft Copilot AI could expose confidential SharePoint data. Much of this revolves around a data governance problem in organizations, particularly when it comes to SharePoint.
Respondents suggested that there is confusion around the access and permissions which Microsoft Copilot has, with concerns around data leakage or SharePoint sharing links outside the organization.
The people most likely to cancel or delay the deployment of Microsoft Copilot over organizational security concerns are C-level executives. According to the survey, three quarters of executives at this level have issued instructions to delay a rollout of Copilot across their organization. 60% of Managers have also taken this decision.
"It is the most senior leaders who are pausing, because they can see exactly what AI will surface - a decade of sharing links and permissions nobody cleaned up. The risk was always there but AI has made it visible and urgent,” said Simon Azzopardi, CEO of CoreView.
Of those in organizations which have delayed or cancelled a Microsoft Copilot deployment, almost three quarters (73%) said that this was because of concerns that AI could be used to surface confidential information from inside their organization.
“For a Microsoft flagship product with enormous executive mindshare, that is a striking level of organizational hesitation,” said the report.
According to CoreView, for many organizations the source of this hesitation to deploy Copilot can be traced back to an experience with a security issue involving Microsoft 365.
These cybersecurity incidents were linked to the absence of at least one foundational security control, including administrator MFA, privileged access management (PAM) or configuration tamper detection.
The survey found that cybersecurity leaders are concerned that the issues which resulted in security incidents for Microsoft365 could also result in security incidents for Microsoft Copilot.
To counter these concerns, it is recommended that organizations apply security controls like PAM to both user and Copilot accounts to help prevent unauthorized access and exfiltration of data.
Organizations should also examine permissions and access of SharePoint applications to ensure that this access cannot be invertedly shared in a way that puts the data at risk, either by AI applications or human users.
Image credit: PhotoGranary02 / Shutterstock.com