This week, BBC News reported that hundreds of shared Claude conversations turned up in Google search results. Some contained personal details, some included unpublished corporate content and some had proprietary research; but none of these leaks were a hack. A user clicked “share” and a search engine did the rest.

Anthropic, the company behind Claude, fixed the indexing issue within days and when OpenAI had a very similar leak last year, they changed the ease that such logs were available. But the story isn’t really about ChatGPT or Claude, or whatever your LLM of choice is. It’s about a problem every IT leader already has, whether or not anyone in the business has typed a word into an AI tool: your data leaves the building one small, well-intentioned decision at a time.

The real lesson: insider risk management is policy failure, not a security failure

When it comes to data breaches, we tend to imagine ‘hacks’ – or, at the very least, external adversaries forcing their way in. However, in both of the examples mentioned above, this wasn’t the case. An employee used a legitimate feature exactly as designed, without realising a shareable link could become a publicly indexed page. Multiply that by every AI assistant, browser extension and SaaS tool your staff use daily, and you get a simple truth: most data loss today isn’t caused by attackers. It’s caused by people – trusted, well-meaning people – making judgement calls with no guardrails in place.

Insider risk management is the practice of governing and monitoring how employees handle sensitive data – intentionally or not.

That’s the core challenge of insider risk, and it’s exactly the gap that Microsoft Copilot, Purview and Mimecast Incydr are built to close.

Copilot: the AI surface you can actually govern

This is also the strongest argument for standardising on Microsoft 365 Copilot rather than leaving staff to reach for whatever public AI tool is open in another tab. Copilot operates inside your existing Microsoft 365 permissions and Purview policies, meaning sensitivity labels, DLP rules, and insider risk controls apply automatically, without staff needing to think about it.

A well-configured Copilot rollout doesn’t just make AI safer to use; it gives IT leaders a sanctioned alternative to the “shadow AI” habits that stories like this expose, so sensitive data has a governed home instead of ending up in tools nobody’s watching.

Where Purview fits

Microsoft Purview gives you visibility and control over data before it ever reaches a risky moment. For organisations wrestling with the AI question specifically, that means:

  • Classifying and labelling sensitive data (client records, IP, financial information) so it carries its risk level with it wherever it travels, including into Copilot and other AI tools.
  • Data Loss Prevention policies that can stop sensitive content being pasted into unauthorised apps or shared externally, rather than relying on staff to remember the rules.
  • Insider Risk Management, which flags unusual data-handling behaviour – a leaver downloading files, a spike in sharing activity – before it becomes a headline.
  • Audit and Discovery, so if something does go out the door, you can reconstruct exactly what happened and respond with confidence, not guesswork.

Done well, Purview turns “we hope people don’t do anything silly” into a governed, auditable system that assumes they might, and catches it regardless.

Where Incydr complements Purview

Purview is powerful within the Microsoft ecosystem, but modern data loss rarely stays inside one. Employees copy text into personal AI chatbots, upload files to unmanaged cloud storage or share links nobody’s watching, all outside Microsoft’s walls entirely.

This is where Incyder is powerful. Incydr is built specifically to see and stop data loss from insiders, tracking file movement across endpoints, browsers, cloud apps and AI tools, regardless of whether the activity is malicious or simply careless. It doesn’t just log the event; it gives security teams the context to tell the difference between a genuine risk and normal work, and to act proactively rather than after a story breaks.

Together, Purview and Incydr cover the two halves of the same problem: govern the data at the source and watch where it actually goes.

“Could this happen to us?” The takeaway for senior IT leaders

Every organisation now has an unofficial AI policy, whether it’s written down or not: it’s whatever your staff decide to do when nobody’s looking. The Claude story is a reminder that “share” buttons, copy/paste and everyday convenience features are the new insider risk frontier, not just malicious actors.

The fix isn’t banning AI tools: that ship has sailed, and staff will find workarounds anyway. It’s making sure sensitive data is classified, policies are enforced automatically and unusual behaviour gets flagged before it’s a headline rather than after.

If you’re not confident you could answer “could this happen to us?” with a straightforward yes or no, that’s the conversation worth having next.

Want to know where your gaps are? Get in touch with our team about seeing if Copilot if right for your business, a Purview readiness review or ask about we can support with adding Incydr to your cyber risk stack.