A survey of security leaders revealed that two-thirds of organizations have delayed or cancelled deployment of Microsoft Copilot over concerns that the AI-powered assistant could expose confidential data, according to CoreView’s State of Microsoft 365 Security and Governance 2026 report, published on 21 July. The report highlighted confusion around Copilot’s access and permissions, particularly regarding SharePoint data leakage or sharing links outside the organization. C-level executives are most likely to delay deployment, with three quarters of executives at this level issuing instructions to delay a rollout, while 60% of Managers have also taken this decision. Of those in organizations which have delayed or cancelled a deployment, almost three quarters (73%) cited concerns that AI could surface confidential information. The report noted that hesitation often traces back to a security issue involving Microsoft 365, linked to the absence of foundational controls like administrator MFA, privileged access management (PAM), or configuration tamper detection. To counter concerns, the report recommends applying security controls like PAM to both user and Copilot accounts and examining SharePoint permissions.