Used to scan 7BN+ unstructured data items1BN Insight report
Case Study Data Assessment

1.9% of the Estate Scanned.
$27.4M in Extrapolated Risk.

A Canadian and US oil & gas group spanning 8 companies discovered $527,823 in direct privacy data risk across just 22 mailboxes — representing 1.9% of the total data estate. Extrapolated across the full environment, the estimated exposure reaches $27.4M. Only 4.5% of mailboxes are currently ready for AI deployment.

Sector
Oil & Gas
Region
Canada & United States
Environment
Microsoft 365
Assessment Type
Data Assessment
Estimated Financial Exposure
Based on IBM Cost of a Data Breach Report 2024
$27.4M
Full-estate extrapolated risk
Direct assessed risk (22 mailboxes)$527,823
Exchange Online risk (direct)$523,325
SharePoint Online risk (direct)$4,498
Monthly increase in risk (direct)+$14,402 / month
Extrapolated monthly increase+$748,917 / month
Scope assessed vs. full estate1.9% of total objects
Monthly privacy data growth rate4.06%
749GB
Data Assessed
Exchange 353 GB, SharePoint 377 GB, OneDrive 19 GB
1.3M
Items Profiled
93.1% from Exchange Online
3,051
Privacy Items Found
0.23% density — across assessed scope only
4.5%
AI Ready (Exchange)
21 of 22 mailboxes require remediation before Copilot
The Challenge

A multi-entity oil & gas group with unmanaged sensitive data across M365 — and a Copilot deployment blocked by its own data posture.

Across 8 companies operating in Canada and the United States, the group’s M365 environment had accumulated years of sensitive privacy and security data with no systematic governance. Travel workflows, recruiting processes, and field operations each generate sensitive information — and virtually all of it was sitting unclassified in email.

The assessment covered only 1.9% of the total data estate, yet found $527,823 in quantified risk — a signal that projects to $27.4M across the full environment. With Microsoft Copilot deployment on the agenda, 96% of users require data remediation before AI can be safely introduced.

Travel workflows are the dominant risk source

Travel information accounts for 34% of all privacy data found. In the oil & gas sector, field crew travel, accommodation bookings, and credit card authorizations flow primarily through email — creating a concentrated, unmanaged exposure in Exchange Online.

Copilot deployment is blocked by data posture

Only 4.5% of Exchange mailboxes meet the data hygiene prerequisites for Microsoft Copilot. 21 of 22 assessed mailboxes require remediation, and 96% of users need to complete a data review before AI can be responsibly deployed.

Growing at 4.06% per month with no containment

Privacy data is accumulating at 4.06% monthly — adding approximately 83 new at-risk items and $14,402 in additional exposure each month from the assessed scope alone. Across the full estate, the monthly exposure increase is estimated at $748,917.

Duplicate copies amplify the remediation scope

1,526 duplicate copies of privacy data were identified — the single largest quick-win opportunity at $263,912 in direct risk reduction and ~$13.72M extrapolated. Deduplication alone can significantly reduce both risk and review effort.

Assessment Findings

What a 1.9% sample revealed about the full estate

The Data & More assessment covered 22 mailboxes, 22 OneDrives, and 5 SharePoint site collections — delivering quantified risk findings across privacy data, security data, file types, and AI readiness.

Direct Assessed Risk
$527,823
99.1% from Exchange Online ($523,325). SharePoint contributes $4,498. The assessed scope is just 1.9% of the total M365 estate.
Privacy Data Occurrence Rate
0.23%
3,051 privacy items found across 1.3 million profiled items. Most privacy data found in .msg and .pdf files — consistent with travel and recruiting workflows.
Extrapolated Full-Estate Risk
$27,446,796
Based on applying the 0.23% density and $23,992 per-user risk figure to the full data environment — extrapolating from the 1.9% sample assessed.
Risk Concentration by Age
$220,748
The single largest age bucket is 1–3 years ($220,748), suggesting a wave of privacy data from 2022–2024 operations. 3–12 month data adds another $124,214 in active risk.
Risk Per User (Assessed)
$23,992
Each of the 22 assessed mailboxes carries an average of $23,992 in estimated financial exposure — a figure that anchors the full-estate extrapolation across the complete user base.
AI Data Readiness

Before Copilot can be deployed, 96% of users need to remediate their data.

Microsoft Copilot surfaces data from wherever it exists in M365. That means unclassified privacy data, plain-text passwords, and duplicate documents all become accessible to AI — creating compliance and security risk at the point of AI adoption. The assessment quantifies exactly what needs to be resolved before deployment can proceed responsibly.

Overall Readiness Status
Exchange Online — 4.5% ready
21 of 22 mailboxes require remediation
OneDrive for Business — 100% ready
No locations require remediation
SharePoint Online — 80% ready
4 of 5 site collections require remediation
2,882
Privacy items to be reviewed
1,035
Security items to be reviewed
96%
of users required to complete review
Risk by Data Category

Travel and health data account for more than half of all privacy risk

Both categories are directly tied to oil & gas field operations — crew travel, accommodation logistics, and health & safety compliance records. Together they represent 57% of total privacy data found.

Travel Information34%
Health Information23%
Recruitment19%
Drivers License7%
Misc. ID5%
Passport4%
National ID, Insurance, Employment & Other8%

Oil & gas context: Health info at 23% is notably higher than most sectors — consistent with safety compliance requirements (WHMIS, physical assessments, drug & alcohol testing) that generate health-sensitive records across field and office operations.

Risk by Storage Location & Age

Exchange Online carries 99% of risk — age concentration is recent

Exchange Online
22 mailboxes assessed — 21 requiring remediation
$523,325
99.1% of total risk
SharePoint Online
5 site collections assessed — 4 requiring remediation
$4,498
0.9% of total risk
Risk by document age
<3 months
$48,959
3–12 months
$124,214
1–3 years
$220,748
3–10 years
$133,729
10–20 years
$1,211

The 1–3 year age bucket carries the highest risk, suggesting a surge in data accumulation during 2022–2024. Unlike the legacy-heavy profiles seen in other sectors, this risk is relatively young and growing.

Remediation Opportunities

Four targeted actions.
$503K in direct impact. ~$26M extrapolated.

Each quick win targets a specific data workflow and delivers measurable risk reduction — in weeks, not months. The extrapolated figures show the potential impact when the same policies are applied across the full M365 estate.

~$26M
Extrapolated total impact
Quick Win
Items
Users
Complexity
Direct Reduction
Extrapolated
01
Travel information older than 12 months — including credit card authorizations, hotel bookings, and trip itineraries in email
804
14
$139,092
~$7.23M
02
Duplicate copies of privacy data — the same documents stored multiple times across mailboxes and drives
1,526
21
$263,912
~$13.72M
03
Recruiting information older than 12 months — CVs, interview notes, and candidate correspondence retained past useful life
309
13
$53,457
~$2.78M
04
ID cards and identification documents older than 6 months — used in onboarding and field access workflows
271
16
$46,883
~$2.44M
Total direct reduction
$503,344
Total extrapolated impact
~$26M
What This Enables

From data liability to AI-ready estate.

The assessment gives the group a complete, evidence-based picture of its data posture across all 8 entities — and a prioritised path that clears the way for Microsoft Copilot deployment while reducing the regulatory and security exposure embedded in everyday workflows.

A defined path to Copilot readiness

With a clear remediation scope (2,882 privacy items + 1,035 security items across 96% of users), the group now has a specific, bounded programme to complete before AI deployment — rather than an open-ended risk.

SOC 2 Type 2 compliance alignment

The assessment maps directly to multiple SOC 2 control sections (C1, C4, C7, C8, C9, D) — providing the data classification and governance evidence base needed for audit-ready compliance across the multi-entity group structure.

Full data inventory across all M365 systems

For the first time, the group has a quantified view of what sensitive data exists in its M365 environment, what it’s worth to an attacker, and which specific workflows are generating the most exposure.

Security data remediation alongside privacy

Beyond privacy risk, the assessment identified 1,035 security data items — including plain-text passwords and credential data. Addressing these reduces the attack surface available to a compromised account before the group scales further with Copilot.

The Forward View
$27.4M extrapolated risk
from 1.9% of the total data estate assessed
Direct risk (assessed scope)$527,823
Extrapolated full-estate risk$27,446,796
Risk per user (assessed)$23,992
Monthly risk increase (direct)$14,402
Monthly risk increase (extrapolated)$748,917
Privacy data growth rate / month4.06%
New privacy items / month (direct)83 items
AI readiness — Exchange Online4.5%
AI readiness — OneDrive100%
AI readiness — SharePoint Online80%
Users requiring data review96%

Get privacy data out of email. Focus on travel and recruiting workflows. Pick something and get started — progress over perfection creates quick wins you can build on.

Ready to See Your Numbers?

Every organization’s data tells a story.
Find out what yours says.

A Data & More assessment takes weeks, not months — and gives your team the complete picture needed to act with confidence.