Cyber security
Shadow AI protection
See which AI tools your staff already use, stop sensitive data leaking into them, and put in place the policy and controls that let your team use AI safely, with DefensX browser security and guidance for staff.
Who it is for
Businesses in Teesside and the North East where someone has already pasted a customer list into a chatbot to tidy it up, where the board is asking whether to buy Microsoft 365 Copilot, and where nobody knows which AI tools are in use today. Accountants, solicitors, practices and any business holding data it is obliged to protect.
What you get
Real-time visibility of the AI tools your staff use, through DefensX browser security; a written AI use policy agreed with you saying which tools are approved, for what and with which data; controls that restrict unapproved tools and stop sensitive data being pasted into them; staff briefed on safe use; and a clear path to the tools that earn their place, such as Microsoft 365 Copilot, with the permissions and data controls to match.
The problem
AI tools such as ChatGPT and Microsoft Copilot bring real efficiency gains, but staff often use unapproved tools without knowing what they share, which exposes data and creates compliance gaps.
Using a public AI assistant is as easy as a web search: load the page, paste the text, read the answer. People use it as a proofreader, a summariser, a spreadsheet helper. Few of them know that, by default, a conversation with a public chatbot may be kept and used to train future models unless they opt out, or that the customer list, the contract clause or the HR note they pasted has now left the business. That is shadow AI: the AI equivalent of shadow IT, with higher stakes because the tools process sensitive data and generate outputs that influence decisions.
The risks are the ones a regulator or a client would ask about: data leakage, GDPR and industry compliance breaches, and reputational damage from an incorrect or biased output nobody checked. Banning AI does not work; the tools are a click away and the gains are real. Instead, find out what is in use, decide what is approved and with which data, control the rest, and tell staff why.
We do that with DefensX browser security, which sees AI tools where staff actually use them, in the browser, and enforces the policy there; an AI use policy written with you; and a path to the approved tools. Microsoft 365 Copilot sees whatever the user can see, so the permissions and data controls in Microsoft 365 come first, which is where our Microsoft 365 management and adopting-AI guidance pick up.
What Odyssey provides
- DefensX browser security, which sees and controls AI tools where staff use them
- Real-time visibility of the AI tools in use across your business, and the data going into them
- An AI use policy agreed with you, saying which tools are approved, for what and with which data
- Controls that restrict unapproved tools and protect devices and data against leaks into AI services
- Guidance for staff on the risks of common AI tools and how to use the approved ones well
- A path to Microsoft 365 Copilot and other approved tools, with the data controls set first
What is included
| Included | Detail |
|---|---|
| Discovery | DefensX deployed to every user's browser, with a report of which AI tools are in use, by whom and how often |
| Policy | An AI use policy drafted with you, covering approved tools, permitted data, review of outputs and what is not allowed, in plain language staff will read |
| Controls | Unapproved AI tools restricted in the browser, sensitive data patterns blocked from being pasted or uploaded to AI services, and approved tools allowed |
| Education | Staff briefed on the policy and the risks, with the briefing repeated for joiners |
| Reporting | A regular summary of AI tool use, blocked attempts and policy exceptions requested, so the policy can be adjusted rather than ignored |
| Review | The approved list reviewed with you as new tools appear and as Microsoft 365 Copilot or other tools are adopted |
| Phones and tablets | The DefensX secure browser app for iOS and Android, with the same policies as the desktop |
Not included, or sold separately
- Microsoft 365 Copilot licences and rollout
- Copilot is bought and set up through AI Adoption and Copilot, with the permissions review that must come first
- Data loss prevention across email and files
- DefensX controls the browser; wider data loss prevention in Microsoft 365 is configured under Microsoft 365 management
- AI tools on unmanaged devices
- A personal phone on a personal network is outside the control, which is why device management and the policy matter
- Legal advice on AI and data protection
- We write the policy with you from a security standpoint; your data protection adviser confirms it against your obligations
- Building or integrating AI into your own systems
- Scoped separately as Custom AI and Integrations
How it is delivered
-
Discover what is in use
DefensX deployed to every browser, then real data on which AI tools staff use, how often and with what. The list is usually longer than the board expects.
-
Agree the policy
Which tools are approved, for what, and with which data; what must never be pasted into a public tool; who reviews AI outputs before they are used. Written with you, in language staff will read.
-
Put the controls in place
Unapproved tools restricted, sensitive data patterns blocked from leaving, approved tools allowed, with exceptions handled by request rather than by workaround.
-
Brief the team
Staff told what the policy is, why it exists and what the approved tools are, with the briefing repeated for joiners.
-
Bring in the tools that fit
Microsoft 365 Copilot where it earns its place, inside the Word, Excel, Outlook and Teams your staff already use, after the Microsoft 365 permissions have been reviewed so it cannot surface what it should not.
Why trust Odyssey with this
-
ISO
Certified to ISO 27001 for information security
-
In-house
All work completed by Odyssey employees, never subcontracted
-
3
Calls answered within three rings, and a director is always reachable
- Odyssey is a Microsoft partner
Questions people ask
What is shadow AI?
AI tools used at work without the business knowing or approving them, which can expose sensitive data and create compliance gaps. It is the AI equivalent of shadow IT, with higher stakes because the tools process data and generate outputs that influence decisions.
Do you stop staff using AI altogether?
No. We set up approved tools and a clear policy, so your team keeps the benefits without leaking data. Banning AI does not work; the tools are a click away.
How do you see which AI tools staff are using?
We use DefensX browser security, which sees and controls AI tools where staff actually use them, in the browser, and gives you real-time visibility of the tools in use across the business and the data going into them.
Can we allow some AI tools and not others?
Yes. We set up policies that allow the AI tools you approve, restrict the ones you have not, and block sensitive data patterns from being pasted or uploaded to AI services.
Is Microsoft 365 Copilot safe to use?
Copilot runs inside Microsoft 365 under its security and compliance standards, and it sees whatever the user can see. That makes the Microsoft 365 permissions review the first step, so Copilot cannot surface a file someone should not have had access to in the first place.
Do you help staff understand the risks?
Yes. We brief staff on the policy and the risks of common AI tools, repeat the briefing for joiners, and our security awareness training covers wider threats such as phishing.
Does this help with GDPR?
It addresses the main AI risk under GDPR, personal data leaving the business through a public tool, by seeing where it happens and blocking it, and the policy documents your approach. Your data protection adviser confirms the policy against your obligations.
What happens when someone needs a tool that is not approved?
They ask, through one person you nominate, and we review it with you. The report of blocked attempts and exception requests is how we keep the approved list up to date.
Challenges this helps with
Related services
Ask about shadow AI protection
Send us your question and we will come back to you. We call back within the hour in office hours.
Rather talk? Call 01642 661888. Already a customer with a fault? Call the service desk on 01642 661800.
Please fill in every field marked *, then send again.
That email address does not look right. Please check it and send again.
We have had several messages from you in a short time. Please call us on 01642 661888 instead.
Online messages are paused for the moment. Please call us on 01642 661888.
Your message is too long for this form. Please shorten it, or call us.
Something went wrong on our side and your message was not sent. Please call us on 01642 661888.
We could not confirm that a person sent this message. Please try again, or call us on 01642 661888.
Talk to a human about shadow AI protection
Call and we answer within three rings. Or tell us what you need and we will call you back at any time.