- A Brennan Copilot readiness check, reported by iTnews, found a firm with a strong Microsoft 365 platform but weak information classification and data governance.
- Copilot follows existing permissions, so it can surface files people were allowed to open but never found. Plain-English search removes the effort that hid those errors.
- Before rollout, review broad access, anonymous links and open sites, and check audit logging. ADAPT found about half of AI tools in pilot or deployment lack formal governance.
For years, a badly shared file could sit unnoticed. Nobody found it, so nobody minded. Finding a file took effort. You had to know it existed and roughly where it lived. AI assistants remove that effort. The old comfort goes with it.
A ready platform with a weak base
iTnews reported on a Copilot readiness check that Brennan ran this year for a professional services firm. On the obvious tests, the firm looked ready. Microsoft 365 use, central storage of content, SharePoint design and user readiness all scored strong.
The weak spots were how the firm classifies its information and how it governs its data. Nothing was broken. SharePoint was the main home for content. The result was a solid platform with thin rules around it.
The assessment spelled out the risk. Staff could end up finding files they are allowed to open but would never have searched for by hand.
How the exposure works
Copilot does not bypass access rules. It follows the permissions already set in Microsoft 365. It shows a person what they are allowed to see, and no more. That sounds safe. It is also where the trouble starts.
Large file stores are rarely tidy. Brennan looks for three kinds of mistake. Some files are open to the whole organisation. Some are shared by anonymous link. Some spaces in SharePoint, OneDrive and Teams are open wider than anyone meant.
Each of these is a wrong setting that stays harmless while the file is hard to find. Picture an unlocked filing room at the end of a long corridor, with no index. In practice it stays private. Now give every employee an assistant that fetches any folder on request. The lock never changed. The corridor vanished.
That is the shift. Search effort was acting as a security control. Few organisations would have counted it as one. Brennan's assessment says Copilot makes existing permission problems bigger rather than creating new ones. People will find things they did not know they could reach.
The wider governance picture
ADAPT held its Data & AI Edge event in Sydney on April 1, 2026. More than 200 A/NZ leaders attended. ADAPT's Gabby Fredkin presented figures on how ready their organisations are.
One figure covers governance. Around half of AI tools in pilot or deployment sit outside any formal governance framework.
Another covers data. Fewer than one in ten Australian chief data and analytics officers, 8%, call their organisation optimised for AI data readiness. The source does not describe the sample behind each figure. Read them as a signal from senior leaders, not a census.
ADAPT argues that firms treat readiness as a technical clean-up. In its view, it is really a question of priorities. So AI gets switched on over data that nobody tidied or put rules around.
Loose permissions are one concrete example of that gap. That link is our reading, not ADAPT's claim.
Readiness is not a rollout plan
iTnews also describes Brennan's wider method. It runs in stages: Enable, Protect, Direct, Apply and Automate. The first step, under Enable, is a permission audit across SharePoint, OneDrive and Teams.
Next, the team confirms that the Unified Audit Log records who opened files, who shared them and who changed permissions. Without those records, it is hard to reconstruct what Copilot surfaced.
The Protect stage brings controls scaled to the rollout. Sensitive sites get Restricted Access Control. The plan uses five sensitivity labels instead of fifty. Two or three Data Loss Prevention policies guard the riskiest content.
Brennan adds that these tools are built into Microsoft Purview. Licences are usually already bought.
A caution on the source. This is Brennan's own method, and Brennan sells the services. Its one-week engagement covers the Direct stage only. That is workshops to choose which Copilot use cases come first. The permission audit and the controls belong to the earlier stages. Treat all of it as one adviser's approach. The mechanism holds whoever sells the fix.
Readiness work also does not say where to deploy first. Microsoft's 2026 Work Trend Index asked 2,000 full-time workers in Australia about direction. Only 28% said their employer has a clear, shared approach to AI strategy and policies.
Questions to put to your team
First, who can see our most sensitive sites today? Have we checked for organisation-wide access and anonymous sharing links? Second, does the audit log record file access, sharing and permission changes? Can we search it?
Third, which sites hold payroll, legal, board or client material? Are they labelled? Fourth, who approved each AI tool now in pilot? Does it sit inside a governance framework? ADAPT's figure suggests many do not.
Finally, ask for a test, not a policy. Have someone with ordinary staff access ask the assistant plain questions about salaries, disputes or restructures. What comes back is your real permission model.
The lesson is simple. AI did not weaken your access controls. It removed the friction that was covering for them.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: ADAPT.
