Challenges
Adopting AI with the right controls
Staff are using AI tools already, often without knowing what they share. Controls come first: see what is in use, agree a policy, protect the data, then bring in the tools that earn their place.
The challenge
Someone in the team pastes a customer list into a chatbot to tidy it up. Someone else asks whether the business should buy Microsoft 365 Copilot. Both come down to one question: how to get the benefit of AI without leaking the data the business depends on. The answer starts with knowing what is in use today.
If it is left
By default a conversation with a public chatbot may be kept and used to train future models unless the user opts out, so the customer list, the contract clause or the HR note that was pasted in has left the business and may not come back. A ban does not work: the tools are a click away and the gains are real, so use goes onto personal phones where nobody can see it. Meanwhile Copilot bought without a permissions review surfaces every file a user can technically reach, including the ones they were never meant to open.
What good looks like
You can see which AI tools your staff use and what goes into them; a short written policy says which tools are approved, for what and with which data; unapproved tools and sensitive data patterns are blocked in the browser; staff know why; and Microsoft 365 Copilot, where it earns its place, runs on a tenant whose permissions were reviewed first.
What to do first
Before you call anyone
Ask, without blame, what people use
A short survey or a team meeting: which tools, for what. The honest answer is the baseline, and blame produces an inaccurate one.
Decide the one rule that matters today
No customer, financial, HR or contractual data goes into a tool the business has not approved. Say it in writing now; the full policy can follow.
Look at who can see what in Microsoft 365
Copilot shows a user whatever that user can already open. If the finance folder is readable by everyone because someone clicked Share with the company in 2019, fix that before any licence is bought.
Pick two or three real tasks
Summarising meeting notes, drafting the first version of a proposal, finding trends in a spreadsheet. Judge any tool, Copilot included, against those rather than against the demo.
Check your data protection position
Personal data put into an AI tool is still personal data under UK GDPR, and the ICO's AI guidance applies. Your data protection adviser should see the policy before it is issued.
To see where your business stands first, take the AI readiness check: a result for each area, with no name or email needed.
What we would do first
-
Discover the AI tools in use
Real-time visibility of the AI tools your staff use across the business, through DefensX browser security.
-
Agree an AI use policy
Which tools are approved, for what, and with which data, agreed with you and written down.
-
Put the controls in place
Unapproved tools restricted, sensitive data protected from leaking into AI tools, and staff briefed on safe use.
-
Bring in the tools that fit
Microsoft 365 Copilot where it earns its place, inside the Word, Excel, Outlook and Teams your staff already use.
How we approach it
-
Discover
DefensX browser security deployed to every user, then real data on which AI tools staff use, how often and with what. The list is usually longer than the board expects.
-
Write the policy
Which tools are approved, for what, and with which data; what must never be pasted into a public tool; who reviews AI output before it is used; how to request a new tool. Written with you, in language staff will read, and checked by your data protection adviser.
-
Control
Unapproved tools restricted in the browser, sensitive data patterns blocked from being pasted or uploaded, approved tools allowed, and exceptions handled by request rather than by workaround.
-
Review the Microsoft 365 permissions
Before any Copilot licence: SharePoint and OneDrive sharing reviewed, over-shared folders fixed, and sensitivity labels applied where the business needs them, so Copilot cannot surface what it should not.
-
Bring in the tools that fit
Microsoft 365 Copilot for the roles where the chosen tasks justify it, inside the Word, Excel, Outlook and Teams staff already use, piloted on those tasks with a baseline taken first, with training for each role, and with the same measures taken again before licences go wider.
The services that apply
-
Shadow AI protection
The discovery, the policy and the browser controls are this service; it is the part that has to come before any licence is bought.
-
AI Adoption and Copilot
Copilot sees whatever each user can open, so the permissions review, a pilot on real tasks and training for each role come before licences go to everyone.
-
AI Readiness Assessment
When it is not yet clear where AI would help, the assessment maps the work, finds the tools already in use and says what to fix first.
-
Microsoft and Azure
Copilot runs on your Microsoft 365 tenant, so the licences and the tenant's own security policies come through the service that manages it.
-
Security awareness training
The policy only works if staff understand why; short lessons on data handling and AI use build the habit.
-
Endpoint and identity protection
AI tools are also a phishing lure and a route for malicious browser extensions; the device and identity protection catches what the policy cannot.
How you would buy it
Every hour we work falls under one of four engagement models. These are the ones that fit this situation; How we work compares all four.
-
02
Fixed price
A defined piece of work or project
The discovery period, the policy and the first roll-out of controls are a short project priced as a fixed sum before we start; a Copilot roll-out with its permissions review is a separate fixed-price project.
-
03
Retainer
The way most of our clients work with us
Policy changes, exception requests, the usage report and the Copilot licences as people join and leave are pre-authorised within your retained hours afterwards.
Who you would work with
A tech consultant
Runs the discovery, drafts the policy with you and reviews the Microsoft 365 permissions before Copilot.
Our engineers
Deploy DefensX, set the controls and configure the licences, as Odyssey employees.
An account manager
Reviews the usage report with you and the approved list as new tools appear.
Further reading
-
Guide
Microsoft 365 Copilot Business: AI for SMBs
Microsoft's Copilot plan for smaller businesses brings AI into the Microsoft 365 apps you already use.
Read the guide →
Questions people ask
Should we block AI tools altogether?
Blocking everything pushes use onto personal devices where you cannot see it. The approach that works is to see what is in use, approve the tools that fit, restrict the rest, and protect the data either way.
What is shadow AI?
AI tools used at work without the business knowing or approving them. They can expose sensitive data and create compliance gaps, and by default a public chatbot may keep what is pasted into it.
How do you find out which AI tools our staff use?
Through DefensX browser security, which gives real-time visibility of the AI tools in use across the business and controls them where staff use them, in the browser.
Should we buy Microsoft 365 Copilot?
It depends on where it would help. We judge it against two or three real tasks in each role, review the Microsoft 365 permissions first so it cannot surface what it should not, pilot it on those tasks with a baseline taken first, and train each role before licences go wider.
Is Copilot safe with our data?
It runs inside Microsoft 365 under its security and compliance standards and does not train on your data, but it shows a user whatever that user can already open. That is why the permissions review comes first.
Does using AI tools affect our GDPR position?
Personal data put into an AI tool is still personal data under UK GDPR, and the ICO's AI guidance applies. The policy documents your approach and the controls stop personal data reaching unapproved tools; your data protection adviser confirms the policy against your obligations.
Do staff need guidance on using AI safely?
Yes. Staff get the policy in plain language, a briefing on the risks of common AI tools and how to use the approved ones well, repeated for joiners, and the wider security awareness training covers phishing lures that now use AI themes.
What happens when someone needs a tool that is not approved?
They ask, through one person you nominate, and we review it with you. The report of blocked attempts and exception requests is what keeps the approved list realistic.
Talk to a human about adopting AI
Call and we answer within three rings. Or tell us what you need and we will call you back at any time.