As enterprises experiment with artificial intelligence, managing data security for generative AI tools, including privacy and governance controls, remains a possible roadblock to its adoption.

The rapid evolution of tools such as Microsoft Copilot has brought both unprecedented opportunities and heightened risks, particularly around unstructured data and sensitive information. Enterprises need to navigate potential challenges by leveraging advanced data security solutions that enhance visibility and control over data access.

“Every conversation I’ve had with our customers over the last year has eventually ended up becoming a gen AI and Microsoft Copilot conversation,” said Brian Vecci (pictured), field chief technology officer at Varonis Systems Inc., which has been a Microsoft partner since its inception. “Never in my career have I been able to say something is as top of mind as this.”

Vecci spoke with theCUBE Research’s Principal Analyst Rob Strechay during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio at Microsoft Ignite 2024, where Copilot is a hot topic. They discussed how to get the most benefits from Copilot while ensuring data security and protection.

Top data security challenges in gen AI deployments

Organizations are looking at how to get the productivity benefits and convenience of Copilot without taking on additional risk, according to Vecci. Nearly every Copilot deployment is stuck in pilot mode because of data security and security issues.

“Everyone is looking at the privacy and security issues,” Vecci said. “[They’re] asking questions like: ‘What data do I have and where is it? Do I have anything sensitive open to people that shouldn’t have access to it? What are people asking Copilot? And what data is being referenced?’”

Harnessing data security for generative AI tools such as Copilot can prove to be an incredible productivity and even profitability gain for companies. However, Copilot can surface unknown risks due to a lack of clear governance policies.

“One organization gave Copilot to their traders, and instead of summaries they saw employee names, Social Security numbers and account details,” Vecci said. “They immediately turned it off. [It was] a privacy nightmare. [At Varonis], we put guardrails on data, making Copilot possible to use at scale safely and quickly … identify where there’s sensitive information like intellectual property or [personally identifiable information] or health information. We look at every single access control.”

Data can be in a OneDrive, SharePoint or Teams site, and it can be shared with users, making an organization more productive. But to use Copilot safely, it is essential to identify and manage where data is exposed and who has access to all the files, folders and document libraries in all those sites, according to Vecci. Addressing the scale and complexity of modern data governance manually is not a realistic approach for organizations. As a result, automation is a key strategy for mitigating risk and enabling AI adoption without jeopardizing privacy or compliance.

“You want to stop breaches. You want to prove that you’re compliant and that you’ve got the right controls in place,” Vecci said. “It can’t require manual work, because you probably don’t have the team to do it, and you want to prove that you did it, and that’s what Varonis does. We’re not just going to show you the risk — we’re going to automatically fix it, [and] we’re going to watch everything really closely. When it comes to a security perspective, if we’re not securing the data, what are we doing? Data is the valuable asset; that’s what we protect, and [at Varonis] we make it easy.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE Research’s coverage of  Microsoft Ignite24:

Photo: SiliconANGLE