From Foundation to AI – The Maturity Path from MVP to AI-Ready Data Security

Where the MVP ends, the maturity path begins

Articles one and two described the gap and the foundation. This third article covers the road: how an organization moves from a functioning MVP to the AI-ready data security posture that the Data Security Index 2026 envisions. The path has distinct stages, a clear sequence, and – importantly – a set of edge cases that appear along the way and that no marketing document discusses willingly.

An organization that has completed the MVP has a classified data estate with a Yellow default label, three label-based DLP policies covering the primary M365 workloads, and three IRM policies covering security violations, data leaks, and departing-user theft. That is the starting position. What follows is a deliberate sequence, not a shopping list.

Stage 1: Deepening the classification schema

Three labels are enough to start. They are not enough to satisfy GDPR, NIS-2, BaFin, or TISAX requirements in the long run. After three to six months of productive MVP operation, we extend the schema by adding sub-labels beneath Yellow and Red.

The critical design principle: sub-labels operate at the protection layer, not the selection layer. The user continues to pick Green, Yellow, or Red. The system derives the finer classification by combining the user’s choice with automated Sensitive Information Type (SIT) detection and applies the corresponding protection action. You configure this in Purview Information Protection using auto-labeling conditions on the sub-labels.

The result: regulatory granularity without additional cognitive load on the user.

Stage 2: Activating Data Security Posture Management

DSPM in Microsoft Purview reached General Availability in mid-June 2026. It provides centralized insights, recommendations, and remediation actions to improve data security posture across Microsoft 365, Azure, Fabric, and third-party SaaS platforms. Rather than focusing on endpoints or infrastructure, DSPM centers on the data itself: where it resides, who can access it, how it is used, and whether it is adequately protected.

Here is the critical point, and it is one that the Microsoft Security Workshop documentation states explicitly: DSPM’s value depends on having foundations in place first – specifically SITs, sensitivity labels, DLP, and Insider Risk Management. Without labels, there is no useful posture score. Without DLP policies, there is no measurable protection coverage. Without IRM signals, there are no contextualized risk stories.

An organization that built the MVP can activate DSPM and immediately see actionable data:

• how many sensitive assets are labeled
• how many are protected by at least one DLP policy
• how many users are flagged as potentially risky
• which recommendations deserve priority

DSPM generates recommendations from the last 30 days of user activity and the state of unprotected sensitive assets, and each recommendation can be turned into a one-click DLP or IRM policy. An organization that activates DSPM without the MVP sees empty tiles and generic suggestions.

Stage 3: SOC integration via Defender XDR and Sentinel

Data security signals must flow into the broader threat detection and response workflow. In the Microsoft stack, this means integrating IRM alerts, DLP alerts, and DSPM recommendations into the Defender XDR platform and Microsoft Sentinel for unified SOC triage. Playbooks define how an analyst handles a high-priority IRM alert, when escalation to HR or legal occurs, and how the forensic trail is documented.

This integration makes sense the moment the MVP produces reliable signals. Before that, it is pointless – the SOC has nothing to react to.

Stage 4: Securing employee use of GenAI

The first of the two AI strands the Index describes is protecting against undesirable employee GenAI usage. The numbers are clear: 47 percent of surveyed organizations are now implementing specific GenAI controls, up from 39 percent the year before. The top priority, cited by 42 percent, is preventing sensitive data from being uploaded into GenAI tools.

Execution starts with visibility. Microsoft Defender for Cloud Apps delivers the first reliable inventory of GenAI services actually in use across the organization. We routinely discover dozens of distinct AI services that IT was unaware of. The next step: classify them into sanctioned, tolerated, and blocked.

The single most important lesson from our practice: blocking alone fails. Employees find workarounds, and they do so with greater determination the more useful the blocked service is. The effective strategy is always dual: block the harmful AND provide an attractive sanctioned alternative. In most cases that alternative is Microsoft 365 Copilot, supplemented by an internal enterprise LLM offering through Azure OpenAI.

Since late 2024, Purview Insider Risk Management also includes a Risky AI usage policy template that detects when users enter sensitive information into generative AI tools or when AI-generated responses contain confidential data. This template becomes actionable once the MVP’s classification foundation is in place – it needs labels and SITs to determine what counts as sensitive.

Edge Case 1: Copilot meets overshared SharePoint

Microsoft 365 Copilot draws on all content the querying user is authorized to access. This reflects the established permission model and is technically correct. In practice it is problematic, because permissions in most SharePoint environments are not as restrictive as they should be. Sites with “Everyone except external users” permissions are the rule. Sites created years ago for a project and never cleaned up contain sensitive information accessible to every employee. As long as nobody actively searches for it, this goes unnoticed. The moment Copilot is deployed, it surfaces immediately – aggregated and presented in a fluent answer.

The solution is multi-layered:

Sensitivity Labels with container scope:

When you scope a Sensitivity Label to “Groups & sites,” the label controls site-level settings including external sharing, privacy, and access from unmanaged devices. New sites inherit their container label, enforcing a consistent baseline.

Restricted Content Discovery (RCD):

RCD is part of SharePoint Advanced Management and has been generally available since May 2025. It prevents specific sites from appearing in organization-wide search results and Copilot answers unless a user owns or has recently interacted with content on those sites. It replaces the older Restricted SharePoint Search (RSS), which Microsoft is retiring: new RSS enablement is blocked starting July 31, 2026, with full retirement on January 31, 2027. Organizations still using RSS must migrate to RCD or fix the underlying permissions before RSS stops enforcing. RCD is the correct mechanism for the transition period while permissions are being cleaned up.

DLP for Microsoft 365 Copilot:

Microsoft Purview now supports a dedicated Copilot DLP location. You can create DLP policies that detect and block sensitive content in Copilot interactions. Important technical constraint: within the Copilot location, you cannot use both SIT conditions and Sensitivity Label conditions in the same rule. You can, however, create separate rules for each in the same policy.

Permissions cleanup:

The most uncomfortable but most necessary step. The Purview Data Security Posture Agent and DSPM for AI’s weekly data assessments for the top 100 SharePoint sites used by Copilot help identify the sites with the highest oversharing risk. But someone still has to fix the permissions. This typically takes months and is not achievable without tooling support from SharePoint Advanced Management or third-party governance tools.

Edge Case 2: Autonomous agents and permission boundaries

The second edge case moves beyond Copilot-as-assistant to agentic systems that execute longer task chains on behalf of a user: coordinating meetings, assembling documents, drafting emails, creating tickets. These agents operate in the security context of the delegating user, but they act asynchronously and can trigger hundreds of actions in seconds.

The classical data security architecture assumes synchronous, user-driven actions: a human opens a document, a DLP check runs, a decision is made. With agentic systems, this assumption breaks. An agent can combine data that is individually innocuous but collectively sensitive. It can execute actions in a sequence that is not immediately traceable. And it can act within a permission scope that the delegating user technically has but would never have exercised in normal work.

Microsoft is addressing this with distinct agent identities managed separately from user accounts, fine-grained permission scopes per task, and runtime policies that evaluate agent actions before execution. Organizations working with agentic systems today should actively deploy these mechanisms and accept that agent security is a young discipline that will evolve significantly over the next two years.

Stage 5: Using AI inside the security function

The second AI strand is using GenAI within data security operations. The Index reports that 82 percent of organizations have developed plans for this, up 18 percentage points from 64 percent. The top use areas are discovering sensitive data (44%), detecting critical risks (43%), investigating incidents (43%), assessing posture (42%), securing the environment (41%), and fine-tuning policies (38%).

Since November 2025, Security Copilot is included with Microsoft 365 E5 licenses, which removes the licensing barrier for many organizations. Three specialized Purview agents are now available:

Triage Agent for DLP

Evaluates DLP alerts based on risk and classifies them into priority categories, reducing analyst triage time.

Triage Agent for IRM

Prioritizes Insider Risk Management alerts and surfaces the ones that require human attention.

Data Security Posture Agent

Enables natural language queries across files, emails, and Copilot interactions from within the DSPM experience.

Each of these agents accelerates a workflow that the MVP’s foundation makes possible. The Triage Agent for DLP needs DLP policies to have alerts to triage. The IRM Triage Agent needs IRM policies to have risks to prioritize. The DSPM Agent needs labeled content and classification signals to return meaningful answers. Without the MVP, these agents have nothing to work with.

Edge Case 3: Assistive AI vs. decisional AI

The Index reports that 39 percent of organizations are already using GenAI agents for data security. The top use cases span a wide range of autonomy: detecting critical risks (40%), automatically protecting and classifying data (36%), investigating incidents (35%), making recommendations (35%), reducing false positives (35%). At the same time, 38 percent of decision-makers express concern about agents used without proper approval or human oversight.

This tension defines the next phase. Our recommendation: draw a sharp line between assistive AI and decisional AI.

Assistive AI:

Summarizes alerts, drafts investigation narratives, suggests policy adjustments. The human analyst remains the decision-maker. Security Copilot and the Purview Triage Agents fall into this category. Deploy early, deploy broadly – the risk is contained.

Decisional AI:

Makes enforcement decisions: blocking a share, revoking a permission, escalating to HR. This category requires its own governance framework, its own approval process, and its own audit trail. Adaptive Protection is the most prominent example – it automatically adjusts DLP enforcement based on IRM risk levels. It is powerful and well-designed, but it is still an automated enforcement action, and organizations should deploy it with clear escalation paths and regular reviews of the risk-level assignments.

The line between assistive and decisional AI is the new boundary every data security organization needs to define. The Index acknowledges this when it reports that leaders emphasize the importance of keeping humans in the loop.

The twelve-to-eighteen-month target

What should an organization that starts with the MVP today be able to achieve in twelve to eighteen months? The answer:

• A classified data estate where at least 80 percent of actively used content carries a label
• DLP policies beyond the three MVP policies, covering industry-specific SITs
• An IRM program with activated Analytics for pattern detection beyond individual triggers, plus the Risky AI usage template
• DSPM running productively with regular posture reviews
• Copilot rolled out with RCD and DLP for Copilot in place
• First assistive AI use cases in production, with a clear separation from decisional AI
• A data-backed, measurable answer to the question: where do we stand relative to the Data Security Index – not as a self-assessment on a survey, but as verifiable metrics in our own tenant

An organization that walks this path arrives where the Index places the leaders. Not because it attempted a marathon on day one, but because it started with three labels, three policies, and the discipline to build from there.

Where to start

The Data Security Index 2026 ends with a call to integrate, consolidate, and adopt AI. We agree with the direction. We disagree with the implied starting point. For the vast majority of organizations, the first step is not DSPM, not Security Copilot, and not an AI agent. The first step is a label, a default, and a policy. Three colors. One foundation. Everything else follows from there.

If you want to start that journey, reach out. We guide the MVP deployment, we accompany the maturity path, and when the time comes, we tackle the AI topics that still sound like the future but will appear in next year’s Data Security Index as lived reality.