AI Readiness & Data Exposure Review
An assistant can find anything the person using it can open. Before you switch one on, we find the overshared files, forgotten access and unlabelled sensitive data it would surface, and help you fix them.
Ask it what an ordinary employee might.
An assistant answers from everything the person asking can already open. Pick a question, then ask it again after the review.
Connected to files, Teams and mail
Asking as Sam, marketing coordinatorNo admin, HR or finance access
Try asking
Sam asks: What is everyone paid?
Assistant: Three files have pay details for named staff. The 2026 salary review lists every employee’s salary and proposed rise.
- Salary review 2026 FINAL.xlsxHR site › Pay reviewVisible because: Shared with Everyone
- Payroll export March.csvOneDrive › Finance › BureauVisible because: Anyone with the link
- Offer letter - Head of Operations.docxTeams › Office move 2024Visible because: Old project team, 214 members
Illustrative: the organisation, people and files are made up. The causes are common in Microsoft 365 and similar platforms.
Where oversharing hides.
Rarely deliberate. Usually a shortcut nobody went back to undo. These are the places we look first.
Open links
Made to send one file to one person, then forwarded. Most never expire.
Surfaced above by “What is everyone paid?”
How the review runs.
Before anyone gets the assistant, and without moving your files.
- Map
Every site, team, mailbox and link, and who can open each.
- Test as real users
We ask what staff would ask, signed in as test users for each role.
- Fix in priority order
Widest exposure first. Each fix has an owner, then we ask again.
- Guard
Labels, safer sharing defaults and a short AI use policy.
What you receive
- Exposure findings, with the evidence
- A prioritised fix list, with owners and dates
- Sharing, link and label defaults
- A go or no-go for switch-on
Switch-on decision (illustrative)
Not yet
Pilot once the HR site, payroll link and contractor access are fixed and retested.
Why have a security team do this?
“Will switching this on leak our data?”
An assistant only uses the access people already have, so we check that access first.
How we do it
We test as each role, show you the evidence and retest the fixes before switch-on.
- Data questions firstWhat could leak is settled before switch-on.
- Access set up properlyWe configure and test it ourselves.
- Verified with your peopleSessions in plain English, not slide decks.