A significant majority of organizations have either postponed or canceled their planned deployments of Microsoft Copilot, citing substantial security concerns regarding the AI-powered assistant's potential to expose sensitive internal data. A report published on July 21, 2026, by CoreView, titled "State of Microsoft 365 Security and Governance 2026," indicates that two-thirds of organizations are hesitant to proceed with Copilot's integration due to these worries.
The primary apprehension centers on the risk of Copilot surfacing confidential information, particularly from SharePoint. Many organizations reportedly struggle with data governance issues within SharePoint, leading to confusion about the access and permissions granted to Copilot. This lack of clarity fuels fears of data leakage or the inadvertent sharing of SharePoint links outside the organization.
The decision to delay or cancel deployments is most prevalent among senior leadership. The survey found that three-quarters of C-level executives have instructed their organizations to pause Copilot rollouts, a sentiment shared by 60% of managers. CoreView CEO Simon Azzopardi noted that executives are particularly attuned to the potential for AI to highlight long-standing issues with shared links and unmanaged permissions, making a previously latent risk both visible and urgent.
Of those organizations that have delayed or canceled Copilot deployment, 73% specifically attributed their decision to concerns that the AI could uncover confidential internal information. The report characterizes this widespread organizational hesitation as striking, especially for a flagship Microsoft product with considerable executive interest.
CoreView suggests that this reluctance often stems from prior cybersecurity incidents involving Microsoft 365. These incidents were frequently linked to the absence of fundamental security controls, such as multi-factor authentication (MFA) for administrators, privileged access management (PAM), or configuration tamper detection. Cybersecurity leaders are concerned that similar vulnerabilities could arise with Microsoft Copilot.
To mitigate these risks, experts recommend implementing robust security controls, including PAM, for both user and Copilot accounts to prevent unauthorized data access and exfiltration. Additionally, organizations are advised to thoroughly review and manage permissions and access for SharePoint applications to ensure that data cannot be inadvertently exposed by either AI applications or human users.
