We already have Microsoft 365 E5. Do we need anything beyond that?

Usually not, license-wise. E5 includes most of what this work needs. What it does not include is someone to configure it, tune it against your actual data, and keep it current as people create new sites. That is the gap we fill. If you are on E3, we will tell you exactly which add-on closes the gap and what it costs.

Will this delay our Copilot rollout?

It should not. We scope the pilot group's search to content we have already reviewed, which lets the rollout proceed on schedule while the broader cleanup runs behind it. The delay risk is higher if you skip this and have to pause the rollout after something surfaces.

How long does the assessment take, and what do we get?

About two weeks for a typical mid-market tenant. You get an inventory of what your AI tools can reach, the oversharing findings ranked by exposure, a remediation plan with effort estimates, and a draft AI use policy. It is built to be readable by your board and actionable by your engineers.

We use ChatGPT and Gemini too, not just Copilot. Does that change things?

It changes the controls, not the approach. Copilot inherits your Microsoft permissions, so that work is about what it can reach. Third-party tools are about what leaves, which means egress controls, browser policy, and knowing which ones are already in use. We cover both.

Who actually does the work?

Netrix engineers, named up front, on a team you will meet before you sign anything. No handoff from the people who scoped it to people you have never spoken to. If we go on to run monitoring for you afterward, it is largely the same faces.

Copilot & Generative AI Security

What we run

Four things that have to be true before you scale AI

Most AI security work is not AI work. It is the identity, permissions, and data hygiene you were going to get to eventually. Copilot just moved the deadline.

What Copilot can see

Before it answers a single question, we find out what it can already open. That is a permissions problem wearing an AI costume, and it is where every one of these engagements starts.

Oversharing and open-link audit across SharePoint, OneDrive, and Teams
Sensitive data discovery and classification with Microsoft Purview
Site ownership review, including the sites nobody has owned since 2021
A prioritized remediation list with effort and risk scored on each item

Controls on the data

We put the protection on the file, not the app, so it holds whether the content lands in a chat, a document, or an AI answer.

Sensitivity labels and auto-labeling that do not need a user to remember
Data loss prevention rules tuned for AI prompts and generated output
Restricted search and site scoping so the pilot ships while cleanup continues
Retention and eDiscovery coverage for Copilot interactions

Rules people follow

Policy that fits on one page and answers what your team is already asking: which tools are approved, what is safe to paste, and who signs off on a new use case.

Acceptable use policy for AI, written in plain English, not legalese
An approval path for new AI tools that takes days, not quarters
Shadow AI discovery, so you know what is in use before you write the rule
Role-based training for the people most likely to paste something they should not

Proof for the auditor

Insurers and examiners ask for evidence, not intent. We stand up the logging and reporting that answers them without turning it into a fire drill every quarter.

Copilot and AI activity logging piped into your existing SIEM
Alerting on unusual prompt volume and access patterns
Quarterly access recertification, run by us if your team is short
Reporting mapped to the frameworks you actually report against

What this looks like

Nothing gets breached. Something gets found.

The pattern we keep seeing

A manufacturer turns on Copilot for a pilot group of forty. Inside a week, someone in operations asks a budget question and gets back a salary band.

Nothing was breached. A SharePoint site set to "everyone in the organization" four years ago was doing exactly what it had been configured to do. The AI just made it easy to ask.

We spend the first two weeks finding the sites like that one. Then we spend the next six closing them, in an order that lets the pilot keep running.

2 weeks

To a full picture of what your AI can reach

1 page

The AI use policy your team will actually read

24x7

Monitoring once the controls are live

Most of what this needs, you already license

Why Netrix

The reasons this does not turn into a report you file and forget

You already own most of this. We start with the Microsoft licensing you are paying for and tell you plainly when you do not need to buy anything else. That conversation costs us revenue and saves you a budget cycle.
We work to your rollout date, not ours. Scoped search and staged site cleanup let the pilot go ahead while the long tail gets fixed behind it. Nobody has to go tell the CEO that AI is delayed.
This is not a new practice with a new name. Identity, permissions, and data classification are work we have been doing since long before the acronym changed. Copilot moved the urgency, not the discipline.
The assessment is the start, not the deliverable. The engineers who find the problems are the ones who stay to close them, and the same team runs the monitoring afterward if you want it.
Microsoft-centric mid-market is the whole job. Manufacturers, regional banks, and professional services firms with lean IT teams and real exposure. We are not learning your environment on your budget.

Questions we get

The five things buyers ask first

Let's talk

Find out what your AI can reach before you scale it.

Thirty minutes with a security engineer who has done this in Microsoft environments the size of yours.

Talk to a security engineer

No pitch deck. We will walk your tenant setup, name the two or three things that would worry us, and tell you which of them you can fix yourself.

Cybersecurity overview Microsoft security Data readiness Fractional CISO

Copilot doesn't leak data. Permissions do.