The Copilot Exposure List
What Copilot can see today.
Pick one category of sensitive data: patient records, payroll and HR, or client contracts. We pull a short list of the actual files in that category that anyone in your company can open today, which means Copilot can hand them to anyone who asks. Named files, not a score.
- Read-only, nothing installed, access removed at the readout
- Run personally by a senior engineer, limited slots each month
- No charge for qualified businesses, and the list is yours to keep
The files are already exposed. Copilot just makes them easy to find.
Copilot can only surface what a person already has permission to open. That is the honest, reassuring part. The uncomfortable part is what "permission" actually looks like in most tenants after a few years of quick sharing decisions: a SharePoint site set to Everyone back in 2021, an org-wide link that never expired, a folder that inherited access from a project nobody remembers. Finding those files used to take curiosity and patience. Copilot turns them into the answer to a typed question.
You do not need Copilot deployed for this to matter. Every file on the list is open to your whole company right now. Copilot, or simply the next curious employee, just shortens the path.
What you get
- A named list, typically three to ten files, with the file name, where it lives, and the exact group or link exposing it.
- One category, chosen by you, checked properly.
- A 20 minute readout where we walk the list together and answer the obvious question: how bad is this, really?
- For referred businesses and existing clients, we also fix the single riskiest exposure we find, so the engagement ends with completed work, not homework.
What this is not
It is one category, deliberately. A sample, not a full review, and we will not pretend otherwise. If the list is clean, we tell you so and shake hands. If it is not, the full pass across every category, with the fixes, the sensitivity labels, and the guardrails that keep exposure from quietly growing back, is a scoped project with a written fixed quote at the readout. Either way, the list is yours to keep. And when the cleanup is done, rolling Copilot out properly stops being a risk conversation and becomes a productivity one. If you want the deeper technical background first, we wrote up how Purview secures Copilot in plain language.
How it works
1. A 15 minute call
We confirm the fit, you pick the category, and a one-page scope-of-access letter goes out for signature the same day. Nothing runs without it.
2. A 10 minute grant
Your admin approves a read-only permission grant. No software is installed on anything, and the grant can be revoked by you at any time.
3. The pull
We run it from our side, usually within two to three business days. We look at who can open files, never at what is inside them.
4. The readout
Twenty minutes, screen shared, walking the actual list together. The list is yours to keep, and our access is removed the same day.
Frequently asked questions
Is this actually safe?
Yes, and by design. The pull runs through a read-only permission grant that your admin approves and can revoke at any time, and we remove our access at the readout. We check who can open files by looking at names, locations, and sharing settings. We never open or read the files themselves, and nothing is installed on your computers.
Do we need Copilot already?
No. Every file on the list is open to your whole company right now, with or without Copilot. Copilot just makes finding them as easy as asking a question, which is why most businesses want the list before they turn it on.
What if the list comes back empty?
Then your sharing posture on that category is clean, we tell you exactly that, and you get to stop worrying about it. That is a real outcome and we are happy to deliver it.
Why is it free?
Because it is how we earn the bigger project when the list is not clean. A senior engineer personally runs every list, which is also why we only take a limited number each month. There is no obligation attached to the list itself.
What happens after the readout?
One recommendation, made plainly. If the list is clean, we say so and part as friends. If it is not, the full pass across every category, with the fixes, the sensitivity labels, and the guardrails, is a scoped project with a written fixed quote. Either way the list is yours to keep.
Ready to see your list?
The form takes about a minute. We come back within one business day, and a senior engineer runs every list personally, so slots each month are genuinely limited.
Request my list