AI is transforming industries worldwide, but it’s simultaneously creating one of the largest data risks we've ever seen. According to the Varonis 2025 State of Data Security Report, 95% of healthcare organizations have exposed sensitive cloud data, and 64% have employees using unverified AI tools. The same
Found this nugget buried in the Purview Blueprints Github repo. Figured I'd take a crack at integrating credential SITs into my EXO SIT Finder. The "All Credentials" Bundled SIT is multitudinous and complex, as you can see in the linked Learn Doc below. Current SITs being
This post is a continuation of a series. See part 1, here. Most enterprises already live in dual worlds. On one side, Microsoft Purview governs information inside Microsoft 365. But on the other, dedicated DLP platforms like Digital Guardian DLP control endpoints, networks, and file movement. So what's
As a consultant in the Microsoft Security & Compliance space, you learn that some projects are more like therapy sessions. Half the organization wants to migrate to Microsoft, and the other half, clutching their Varonis or Symantec licenses, waits in the shadows for their "I told you so"
I didn't have much of a following when I initially wrote about SIT-search limitations in mailbox data-at-rest. Since then, I've spoken with multiple clients and data security professionals who were under the mistaken impression that Purview could find that data. Since this limitation still exists, and
One of the lesser-known (and dare I say "quietly devastating") mechanics in Microsoft Purview Insider Risk Management (IRM) is how Collection Policies silently override your IRM policy logic. They don't cooperate and they especially don't warn you. If there's a conflict, the
I've been getting a lot of questions lately in follow-up to my 99% DLP policy post. I followed your advice and have this nifty DLP Policy broken into three rules. How on earth do I sort through all of the Activity Explorer hits and tune this thing? Well,
Turning on DSPM for AI’s one-click policies gets your dashboards populated, but it doesn't guarantee prompt and response bodies in Activity Explorer. Without a specific edit, you'll mostly see headers, counts, and detections (not the text you need). "One-click" creates the coverage that
Building Custom SITs is one of the most powerful things you can do for tenant-specific Data Security in Purview. In a previous post, I went over how to do exactly that. But, powerful can also mean dangerous. Enter: Character Proximity I could make this post really short by just saying
It's 7:59 AM, you're not even one cup of coffee deep, and the HR Director is pounding down your door because they're locked out of a critical personnel file...which was encrypted by a terminated employee account you deleted yesterday. Let me show
No DLP solution on the market, including Microsoft Purview, can guarantee 100% detection of sensitive data exfiltration. You could argue that Exact Data Match (EDM) solves the precision problem, but EDM requires exact input formatting, rigid schema alignment, and constant upkeep. Any drift between your real-world identifiers and the uploaded
my reaction when you're back to read another one of my blogs: Mapping the NIST AI Risk Management Framework onto compliance dashboards, DLP rules, policies, etc. is great; don't get me wrong. But, configuring controls isn't always enough. In this case, we need to