Announcing the Copilot Risk Report

Know What Your AI Can Reach Before It Answers

‍

Jul 16, 2026

Every Copilot deployment we've reviewed shares the same flaw. The rollout plan is detailed. The license negotiation is done. But data security is relegated to a footnote.

Here's the problem with that. Microsoft 365 Copilot doesn't see "sensitive data." It sees whatever your users can access and serves that data up to anyone who asks the right question. Most organizations have never measured what that data actually includes. They're not deploying Copilot recklessly. They're deploying it blind.

We built the Copilot Risk Report to end the guessing.

What we keep finding

Cyera has assessed hundreds of enterprise M365 environments, and the pattern remains largely the same. 97% of sensitive data lacks a sensitivity label, meaning the DLP policies and Copilot restrictions that depend on labels don't apply to it. Of the labels that do exist, 83% are wrong or under-labeled. Roughly 40% of enterprise file types, including CSVs, ZIP archives, images, and code files, structurally cannot receive a label at all. Copilot reads every one of them.

In a typical environment, more than 23,000 sensitive files are accessible to every employee by default.

These aren't edge cases. They're the baseline. Each of those files is a Copilot answer waiting to happen: an HR spreadsheet summarized for the wrong person, or a signed contract pulled from a PNG nobody knew existed.

What the Copilot Risk Report is

The Copilot Risk Report is a full accounting of your Copilot exposure, built from a scan of your actual M365 environment. Not a benchmark. Not a survey of other companies. Your actual data estate.

It delivers a Copilot readiness score measured against Microsoft's own official Copilot requirements — eight security controls, each assessed against your actual posture — a map of where your sensitive data lives and who can reach it, an analysis of how accurate your existing labels really are, an inventory of the file types your current controls can't touch, every identity ranked by how much sensitive data it can reach — with Copilot itself on that list, and a prioritized remediation path to close the gaps.

The report is free. There are no agents to install, and there is no production impact. Findings arrive in days.

Why this belongs on your desk

If you're an executive, you've likely already approved Copilot spend, or you're about to. That signature makes the data question yours. When an auditor or a board member asks what governance existed the day Copilot went live, "we followed the deployment checklist," won't hold. The checklist doesn't cover the 40% of files that labels can never reach. What holds is a stronger answer: you measured your environment against Microsoft's own Copilot requirements before you flipped the switch.

The instinct at this point is usually to slow down. That's the wrong lesson. Pausing Copilot doesn't fix your data, and your competitors aren't waiting. The manual alternative, classifying and labeling by hand, takes 6 to 12 months. Copilot is live now, or will be long before that project finishes.

The right move is to measure first. You can't govern what you haven't seen, and until you've seen your own numbers, every Copilot decision you make is a guess dressed up as a strategy. The organizations that get this right won't be the ones that deploy slowest. They'll be the ones who knew exactly what their AI could reach before they flipped the switch, and could prove it.

That's what the report gives you: evidence to deploy on, not assumptions to defend later.