Navigating AI with Data Security in Mind

Speaker A: Foreign.

Speaker B: Welcome to the BCN Podcast. Today we'll be discussing the rising security risks of unauthorized use of AI in the business space. Now, before we delve into it, this is a follow on to previous episodes where we looked at AI trends for 2025, how businesses are using this and the business use cases and not how all AI is equal. So this is a great follow on just to highlight some of the challenges, concerns and risks that we're seeing out there that businesses should be familiarizing themselves with and more importantly, educating their staff. With me today, I've got Rhys Gohill and Johan Venables, who are both Microsoft specialists within our business. Rhys manages the relationship we have with Microsoft closely to ensure that we're working closely in accordance with their strategies, best practices, and making sure that our clients are adopting their technologies as efficiently and cost effectively as possible. And when we've got Johan, who's sort of spearheading the AI adoption policies and processes that our clients are working with. Gentlemen, thank you so much for joining me today. On today's conversation, Rhys, do you want to quickly introduce yourself to our audience?

Speaker A: Great stuff. Thanks, Pete. Appreciate you having me on. Uh, so, yeah, Reece, go Hill. So I'm our Microsoft, uh, alliance manager here at BCN Group. So I managed a partnership and relationship between us and Microsoft, one of our most strategic partners.

Speaker B: Excellent. Thanks, Rhys, so much for joining us. Good to have you, Johan.

Speaker C: Yeah, sure, thanks, Pete. Uh, Johan Venables. I'm a cloud consultant, uh, specifically focusing around the Microsoft 365 suite as well as the productivity side of things. And I've been tasked last year when Copilot got released, to help and support businesses for the adoption of AI. And, uh, throughout that whole journey, it was quite exciting. Everyone wanted to get access to Copilot and, um, we encouraged clients to do that. But every topic was around data security, and businesses had to really look and focus on getting their sort of house in order, put security measures in place before they can even start using AI. And this year we're just seeing data security being the hottest topic, uh, where last year all the meetings I had with customers was purely around AI. This year it's just data security. So I've nicely fallen into that sort of role where I'm now supporting customers with the data security sides and helping them in guiding them with safe use of AI tools.

Speaker B: Perfect. Thanks, Jan, for joining us and sort of setting the scene. I think it's fair to say that as we all know, AI and its use in businesses today is ramping up at A, uh, phenomenal rate. I saw some really interesting stats last week that Microsoft kindly shared. 75% of all users in the SMB space are using AI and over 80% of people are using AI in their everyday lives. So, you know, the adoption has been phenomenal. It's been the biggest uptake in history and it's fair to say that it's not coming. It's. Yeah. So with that being said, obviously it does highlight some challenges and concerns that businesses need to be made aware of, specifically making sure that they've got guardrails in place, policies and AI councils established within their businesses to ensure safe and compliant usage of AI. Johan, I guess based on your experience, you've come across businesses looking to embark on this journey, some who have started on a more haphazard approach without any formal planning. What are some of the challenges and trends you're seeing in these businesses?

Speaker C: Yeah, so the first challenge that they have is understanding what AI tools people are using. Uh, it's a little bit difficult to do a discovery, to identify what people are doing with their data, where they putting it, whether it's AI or just an online app, it's really difficult to track that. And, uh, another challenge is just, uh, with regards to locking down those AI tools and understanding the risks that comes, uh, with it. Now we see organizations, what they do is that when there's a new AI tool released and there's so many of them, it's very challenging to keep on track with what AI tools are available and what companies tend to do is they immediately just block it. Now, I'm not a fan of that approach because the thing is you're hindering productivity because there's so many good AI tools available out there, which some of them are free. And yes, the risks are there by default. All these free AI apps are basically set to sort of, you know, train their large language models with your data and expose it to the public. If you. From an IT admin perspective, that is actually quite a nightmare. Right. So to manage that is a task of its own. There's lots of concerns. So what people tend to do is they panic and block it and then you sort of, you know, hinder productivity because there's so many good tools you can, you know, use to boost productivity. But it's, again, it's just educating staff, safe use of AI and making them aware of the risks and guiding them and, you know, making them aware with constant workshop session, training sessions by just showing them how to properly use these tools and then also governing it and Making sure that you, you know, from an IT security perspective, really look at the risks of these AI tools and then agree as a business, what IT is people can use and should not use.

Speaker B: Yeah. And that comes down to making sure that you've got those guardrails in place because, as you say, you don't want to hinder productivity and progress, so to speak. As we've seen before and covered off on previous podcasts, there are many different AI tools and models out there, all which have specific use cases and functions. But you do need to make sure that you've got the required measures in place to protect the company assets, the company information and obviously its continuity. Because we're seeing AI being leveraged for cyber attacks now as well. So it is a cause for concern. So setting up, uh, a governance framework is essential. And then looking obviously at the tool set at your disposal, which Microsoft has available to help businesses, uh, build out the structure, so to speak, to support that. And I guess, Rhys, maybe more one for you. Microsoft is also obviously putting their hands in their pockets to help businesses on this journey for getting ready for this adoption. And then also, uh, looking at the whole security aspect. Do you want to talk to us a bit about the Microsoft approach and what businesses have now available in terms of support?

Speaker A: Yeah, absolutely, Pete. So I think end of the day, Microsoft see this as obviously the progression and there's a lot of support available to you. But I think the important thing is, as ah, Johan was talking about, is what the value are going to get off the back of these AI tools. And actually therefore it's all about the adoption and understanding how you can get the most value out of these AI tools. You know, staff are already using AI tools to drive productivity and efficiency for their personal use. But actually the most important thing is what business value you're going to get from these, these AI tools is what support is, is actually going to drive the overarching business and, and the board and what they're trying to achieve. And therefore that's why Microsoft have heavily invested in supporting customers on this journey. And it's all about starting with the right approach and understanding your use cases, what revenue you're trying to drive, what cost efficiencies you're trying to drive, whatever it may be. And that is where Microsoft can come in and support alongside partners to understand what are your requirements, what pains and challenges you're currently seeing and what AI tools out there available to help drive and overcome those challenges. And that's where Microsoft can come in and look at Things like providing funding options to look at the use cases and look at that, uh, are of the possible of what is available from Microsoft 365 copilot, for example, what is available today and also what use cases are going to be for your business.

Speaker B: Uh, and it's great to see that Microsoft has recognized the need for that and their obligation as the provider of these tools to ensure that they are used, implemented, monitored and controlled in a fair ethical manner for the relevant industries.

Speaker A: I'll just say it's in their interest end of the day, isn't it? You know, if it's, you know, $30 a user a month for this license, you need to be making sure they're getting the value from it. So it's in Microsoft's best interest to help support you in making sure that you actually can see that. Good return on investment on that.

Speaker B: Yeah. And Johan, I know you and the team have obviously been working quite closely with Microsoft as well and based on the we've gleamed over the past, uh, what's it been, almost 18 months now since Copilot was first released. In creating a Copilot readiness approach that helps businesses articulate that journey, identify the goals and really get started. Do you want to walk us through, just at a high level, the approach that we're taking with businesses and what measures we're looking at to help identify some of these security challenges and bringing more awareness, so to speak, to the wider audience in terms of what they should consider when embarking on this um, digital transformation.

Speaker C: Yeah, sure. So in the last year we've obviously learned a lot and we've seen all the pain points that our customers have for testing and trialing Copilots. The feedback we got wasn't really that good because it was all down to training and uh, down to data quality. So a lot of businesses got quite frustrated because they want to get onto that AI journey as quickly as possible. But they need to get obviously their house in order first, which can be a time consuming project depending on what sort of stage your data is in and what sort of security services you've applied around that data. So what we've done is as a step one approach, uh, we've launched a webinar session that we can host during a lunchtime or maybe on a Friday afternoon for all the staff in the business to join the session. We look at inspiring staff to start using Copilot Chat because as you know, Copilot Chat is free. It's available to everyone with Microsoft 365 subscription and we want to help them gain immediate productivity with using the sort of free version of Copilot365. And with Copilot Chat, when you sign in with your 365 account, it's secured, you'll see it as a green shield. So it means it uses enterprise class security, uh, to protect any information you add into Copilot Chat. And we demonstrate that and we explain to staff the safe use of AI. We cover off all our other third party tools where we show them the risks and we sort of explain to them how to use it in a safe way and not to use sensitive content or any company data within these platforms. We generally just explain to them to generate new content from that platform, but don't put any data into it. But then we show them the sort of use cases in Copilot365 chat, you know, the free version. Basically show them how you can record a meeting transcript, how you can then easily upload it to Copilot Chat to summarize it, and show them a couple of quick tips and tricks on how they can immediately gain productivity with Copilot Chat. And then once we've set the scene, we then Switch over to copilot365 what it's like to have the full embedded Copilot within your office applications. Because you know there's a slight difference between copilot chat and copilot365 copilot chat. You need to manually feed the data, uh, and then copy the content out of it and then paste it in a document or a spreadsheet. And then you need to reformat it where with Copilot embedded in your apps, there's no need to go backwards and forwards between the two applications because it's inside your applications. You can generate that content, it indexes your data, it learns your data, understands your data, and you can easily search for documents or files or information within Microsoft 365. So once we finish a program, we then challenge everyone to go and have a play with Copilot Chat, get familiar with it, understand the importance of prompt engineering, and then while staff go away, start using Copilot Chat. We then start doing the housekeeping work. So we work with our customers to do a data assessment. We review where they are at with their digital transformation. Are they fully embracing the productivity stack? If not, we will then build a roadmap for them to get them into services like OneDrive SharePoint Teams. If they fully embed it, then we will look at usage reports, we'll help them Identify staff that's sort of thriving within that space. So we'll pull usage reports for those who's sending a lot of emails, attending a lot of meetings, generating a lot of content in SharePoint, in OneDrive. And those are the sort of people that you want to empower with Copilot, uh, you know, to help and you know, save them time so that they can do more and be more productive. And then we'll also do a review of their data, uh, highlight all the risks, show them the information that's overshared in the business so we can identify what links people have generated to share content, whether it's with anyone or people outside of the organization or the entire organization will identify where sensitive content is stored. And that could be anywhere, within emails, within OneDrive, within SharePoint Teams, conversations, everything within Microsoft 365. We'll then highlight the risks and then work with them on a plan to then tighten up that security where we look at a service called Microsoft Purview to sort of support them and lock down sensitive content within the business. So, uh, it doesn't get exposed to people who should not see that data. And we talked earlier about, you know, sort of the risks about third party AI tools, but there's also risks with copilot, people getting exposed internally with sensitive information they shouldn't see. Because look, the way Microsoft Copilot works is it uses semantic indexing and then it's got access to all the data within a tender that you as an individual have access to. It won't give you access to documentation, you know, if you don't have access to it. But it may be that someone in finance has overshade a very important document or a spreadsheet. I'll give you an example, and this is actually a real example. We had a customer where one staff member, ah, searched for his latest payslip and he then got access to that. But he also got access to a spreadsheet with everyone's annual bonuses because that was overshared. So you also have that from an internal perspective as a challenge. So you know, yes, we can protect data from AI tools, but you also need to protect it from Copilot because it's a very clever search engine. It will look for everything that you've got access to within Microsoft Graph.

Speaker B: Yeah, and that is such a pertinent point there that yes, I know we're primarily looking at unauthorized use of AI and the risks associated with company data, but it goes the other way too, right? Even with authorized use, there is an element of due diligence needed to ensure that your data is appropriately secured and locked down. Otherwise, it can pose a risk to the business in various shapes and forms. Now, you just touched on Purview, and I know we've got another podcast coming up where we'll be delving into Purview in a little more detail. And the benefits, the capabilities that this powerful tool brings to the scene, how businesses tracking the use of unauthorized AI at the moment, um, without Purview. And are there ways of them being able to do it, or is it really very difficult?

Speaker C: Yeah, there's definitely ways to do it. I mean, you could get, uh, network traffic logs that you can then basically export from your firewalls and your network, but that's a tedious task. It's very manual, and you need to filter through all those logs to then look at what AI tools they are using. And you need to know it all. You need to know what all the AI tools are, you know, are out there and what they are called to also identify that. So it is a big task. It's also a challenge, and, you know, you can miss something. Yeah. So there's ways of doing it, but it's not a great way.

Speaker B: And, um, just leading up to our next episode, Purview is one of those tools that you can use to track unauthorized use of. Of AI?

Speaker C: Absolutely. Yeah. So Purview is a data governance and compliance solution which is embedded within Microsoft 365, which nicely integrates with all your entire Microsoft 365 ecosystem. And you've, uh, got something called DSPM, Data Security Posture Management for AI, which gives you a set of tools to track what AI tools people are using in organization, which gives you a good sort of view of all the AI tools. And it will also give you a risk score to show you the risk of these AI, uh, applications.

Speaker B: Well, that sounds very interesting, and I think that in itself is an episode worth discussing because it not only focuses on that element of tracking unauthorized AI use, but opens up a whole new avenue of capabilities for locking down your data and security. I think that sort of brings us to the end of today's conversation. I think there were obviously a number of key points. Just to summarize it, Johan, from your past experience, what are the key takeaways and businesses who are looking to start the journey or have started the journey, what are the key points they should focus on that can help them on their way?

Speaker C: Yeah, uh, I think it's identifying use cases for AI tools, understanding what people are using, and Then measuring the risks of these AI tools, train staff, make sure they understand safe use of AI tools, constantly remind people not to use sensitive content with AI tools as well as just, um, look at supporting them with their adoption with, uh, whatever AI tool they use, whether It's Copilot or ChatGPT, just support them with this journey because it's a great benefit for the end users to helps the business become more competitive in the market. I, uh, would say support them wherever you can, but make sure that you put safeguards in place to protect your company data.

Speaker B: Excellent. Thanks. Jan Rees, what are your thoughts?

Speaker A: I completely agree with Johan. I think alongside, obviously understanding the risks of rolling out these AI technologies, end of the day, you've got to go back to what is the key reason you're trying to leverage them. And I've seen it in the past and one of the things I've noticed in a trial rollout is that quite often it's siloed, you know, within the IT team or with senior staff members, you know, the board, for example, trialing these out, these AI tools. You've actually got to go and look at getting champions within the entire organization, across every department, to understand each department's use case. And I think that is really important is making sure you do that staged rollout and actually getting to understand what real benefit, business benefit you're going to get from that.

Speaker B: Excellent. Thank you, gentlemen. I guess my take from IT is that, you know, AI is, yeah, um, trying to prevent your staff from using IT is simply not an option. They will find ways and means of doing it. So rather than preventing them, empower them, give them the knowledge, give them the expertise and give them the tools to work more productively and more efficiently. I think a, uh, great takeaway as well is Copilot Chat is free. It's available today. You can give your staff the tools they need in a safe and secure environment. Come and talk to us if you need any help or assistance or guidance in terms of how you might start that AI journey, or you may have started it and it hasn't quite worked out as you had hoped. We can help you there. Reese and the team have got direct links into Microsoft. We can bring them in to help assist with any challenges that you've got. Johan and the team have a wealth of experience now in working with businesses overcome these challenges. So feel free to get in touch with us. Visit our website, bcn.co.uk. there you'll find a wealth of information relating to the products and the services that we provide. We're definitely here to help. On the next conversation we'll be discussing purview, its role, its purpose, the capabilities it brings to the table. And if you are embarking on your AI journey or about to start, then that is definitely one you want to catch. Look forward to catching you next time. Don't forget to like and subscribe to, uh, our podcast. Thanks so much for joining us.