1
Identity
Know who is accessing information and what they are allowed to do.
AI Transformation Needs Trust
AI is changing what organisations can do. Copilot can access organisational information, Agents can interact with systems, and automation can take action. AI supports customers and employees, with data connected across the organisation.
But with greater capability comes greater responsibility.
Organisations need confidence that:
- The right people can access AI.
- AI can only access the information it should.
- Sensitive information remains protected.
- Agents operate within clearly defined boundaries.
- AI use is governed appropriately.
- People understand their responsibilities.
- Risks can be identified and managed.
The objective isn’t to restrict AI. It’s to create the confidence to scale it.
CPS helps organisations create the identity, data, security and governance foundations needed to adopt Copilot and AI Agents safely, responsibly and at scale.
The Security Challenge Is Changing
Traditional cyber security focused heavily on protecting systems, networks and devices. AI introduces another dimension.
Now organisations also need to think about:
- What AI Can See: What information can Copilot or an Agent access?
- What AI Can Do: Can an Agent update a record, send a message or initiate a process?
- Who AI Is Acting For: What identity and permissions does an AI-powered experience operate under?
- What AI Is Producing: How do organisations manage inaccurate, inappropriate or unexpected outputs?
- How AI Is Being Used: Can organisations understand where AI is being adopted and whether it is being used responsibly?
How AI Changes Risk: New capabilities can create new attack surfaces, data risks and operational dependencies.
The AI Trust Framework
Six Foundations For Responsible AI
These aren’t separate considerations. They work together to create trusted AI.
2
Data
Understand what information is sensitive and how it should be protected.
3
Security
Protect users, devices, applications and AI-enabled environments.
4
Governance
Define how AI should be used, controlled and monitored.
5
Human Oversight
Ensure people remain involved where judgement, accountability or approval is required.
6
Assurance
Continuously understand how AI is performing and whether controls remain effective.
Know Who (and What) Is Accessing Your Information
As AI becomes more embedded in business processes, identity becomes increasingly important.
- Employees already have permissions.
- Applications have permissions.
- AI Agents will increasingly need permissions too.
Microsoft Entra helps organisations establish appropriate identity and access controls across users, applications and AI-powered experiences.
This can help organisations:
- Verify identities
- Control access
- Apply Conditional Access
- Strengthen authentication
- Manage permissions
- Support Zero Trust
- Govern external access
The principle is simple: AI should only be able to access what it is authorised to access.
Explore Microsoft Entra, here.
AI Governance
Give AI The Right Freedom, and The Right Boundaries
AI governance shouldn’t be a document that sits in a policy library. It needs to influence how AI is actually designed, deployed and used. CPS helps organisations consider:
- Purpose: Why is AI being used and what outcome is it intended to achieve?
- Access: What information and systems can it access?
- Permissions: What can an AI Agent actually do?
- Human Oversight: When does a person need to approve or intervene?
- Risk: What could go wrong and how will it be managed?
- Transparency: Do people understand when they are interacting with AI?
- Monitoring: How will AI performance and behaviour be reviewed?
- Accountability: Who owns the outcome?
AI needs freedom to create value. But it also needs boundaries. Read our blog:‘AI Has Changed the Security Conversation’ to explore the balance between innovation, governance and trust.
Responsible AI
Build Trust Into The Way AI Is Used
Responsible AI is about ensuring AI is used in ways that are appropriate, secure and aligned with organisational values and obligations.
For organisations, that means thinking about:
- Accuracy
- Privacy
- Security
- Transparency
- Fairness
- Human oversight
- Accountability
- Appropriate use
The right approach will depend on the organisation and the use case.
CPS helps translate these principles into practical governance and operational controls.
AI Agents Change The Governance Question
The More An Agent Can Do, The More Carefully It Needs To Be Designed
An AI assistant providing a summary is one thing. An Agent updating systems, communicating with customers or progressing a process is another.
Before an Agent goes live, organisations should understand:
- What is its purpose? – What problem is it solving?
- What information can it access? – Which data sources does it need?
- What actions can it take? – What systems can it interact with?
- What decisions can it make? – Which decisions are within its boundaries?
- When must it escalate? – Where is human judgement required?
- How is it monitored? –Can the organisation understand what it has done?
- What happens when something goes wrong? – Are there appropriate safeguards and escalation processes?
Security By Design
Don’t Add Security After The AI Is Built
Security and governance should be considered from the beginning. When developing an AI use case, CPS considers:
- Identity
- Data
- Permissions
- Process
- Agent behaviour
- Human oversight
- Monitoring
- Assurance
This helps ensure security becomes part of the solution rather than a barrier added at the end.
The AI Governance Journey
From Policy To Practical Control
- 01 — Understand: Identify your AI use cases, risks, information and operating environment.
- 02 — Assess: Understand your current security, data, identity and governance maturity.
- 03 — Define: Establish appropriate AI policies, responsibilities and controls.
- 04 — Protect: Implement identity, security and information protection measures.
- 05 — Govern: Apply governance to Copilot, Agents and AI-powered processes.
- 06 — Monitor: Understand usage, performance, risks and emerging issues.
- 07 — Assure: Regularly review whether your controls remain appropriate as AI evolves.
What Could Go Wrong Without The Right Foundations?
AI adoption without appropriate governance can create risks such as:
- Information Exposure: Sensitive information may become easier to access or share.
- Excessive Permissions: AI or users may have more access than necessary.
- Uncontrolled Agents: Agents could undertake actions outside their intended boundaries.
- Shadow AI: Employees may use AI services outside organisational controls.
- Poor AI Outputs: Incorrect or inappropriate outputs could influence decisions.
- Compliance Risk: AI use may create new regulatory or information governance challenges.
- Loss Of Trust: Employees, customers or citizens may lose confidence in how AI is being used.
The answer isn’t to stop using AI.
It’s to understand and manage the risk.
Security And Governance Across The Microsoft Ecosystem
The Microsoft platform provides a connected foundation for secure AI.
Microsoft Entra
Identity, authentication and access control.
Explore Microsoft Entra
Microsoft Purview
Information protection, governance and compliance.
Explore Microsoft Purview
Microsoft Defender
Threat protection across users, devices, applications and cloud environments.
Explore Microsoft Defender
Security Copilot
AI-powered security investigation and response.
Explore Security Copilot
Microsoft 365
Secure productivity, communication and collaboration.
Explore Microsoft 365
Copilot Studio
Build Agents with appropriate permissions, actions and governance.
Explore Copilot Studio
Dataverse & Fabric
Provide governed data foundations for applications and AI.
Explore Dataverse
Common AI Security & Governance Opportunities
- Copilot Readiness: Understand whether your information, permissions and security environment are ready for Copilot.
- AI Agent Governance: Define how Agents should operate and what they can access or do.
- Information Protection: Identify and protect sensitive information.
- Identity Security: Strengthen authentication, access and permissions.
- Shadow AI: Understand and manage the use of AI across the organisation.
- AI Risk Management: Identify and prioritise emerging AI-related risks.
- Responsible AI: Create practical policies and controls for safe AI adoption.
- AI Security Operations: Use AI to strengthen threat investigation and response.
The Outcomes
What Does Trusted AI Enable?
- Confident Adoption: Give leaders and employees greater confidence in using AI.
- Reduced Risk: Identify and manage security, information and operational risks.
- Better Data Protection: Protect sensitive information as AI adoption increases.
- Stronger Identity Security: Ensure people and Agents have appropriate access.
- Safer AI Agents: Give Agents clearly defined permissions, responsibilities and boundaries.
- Improved Compliance: Create stronger visibility and governance around AI use.
- Greater Organisational Trust: Demonstrate that AI is being adopted responsibly.
- The Confidence To Scale: Move from isolated experimentation towards wider AI adoption.
AI Governance Should Enable Innovation
Good Governance Makes “Yes” Possible
A common concern is that security and governance will slow AI down.
Done well, the opposite can happen.
- If people understand the rules: They can experiment more confidently.
- If information is appropriately governed: AI can access it more safely.
- If Agents have clear boundaries: They can take more meaningful action.
- If security is built in: Organisations can scale with greater confidence.
The goal isn’t governance for governance’s sake.
The goal is creating the confidence to innovate.
The CPS Approach
Security, Governance And AI Transformation Together
Security cannot sit separately from AI transformation.
CPS helps organisations think about the whole AI environment, rather than securing individual technologies in isolation. We bring expertise across:
AI
Copilot, Agents and AI transformation.
Identity
Microsoft Entra and Zero Trust.
Information
Microsoft Purview and data governance.
Security
Microsoft Defender and Security Copilot.
Data
Dataverse, Fabric and organisational intelligence.
Governance
Responsible AI, risk, oversight and assurance.
Why CPS?
We Help You Innovate Without Losing Control
AI security is not simply a technical challenge.
It involves people, processes, information, technology and governance.
CPS brings these together.
- We Understand AI: We understand Copilot, Agents and the move towards Agent-First working.
- We Understand Security: We bring Microsoft security expertise across identity, endpoints, information and threat protection.
- We Understand Governance: We help turn principles into practical controls.
- We Understand Your Environment: We work with organisations where security, compliance and trust are critical.
- We Build For Scale: We don’t just secure your first AI use case.
We help create foundations that support what’s next.
Ready To Start Your AI Journey?
AI You Can Trust. AI You Can Scale.
The question isn’t whether your organisation should adopt AI.
It’s how you create the confidence to do it securely, responsibly and at scale.
CPS can help you establish the identity, data, security and governance foundations that make that possible.
Speak To An AI Security Specialist
Your Next Stage: AI Support & Adoption Assurance
AI transformation doesn’t end when the technology goes live.
- People need support.
- Agents need optimisation.
- Governance needs to evolve.
- New opportunities will emerge.
And organisations need to know whether their investment is actually delivering value.
Frequently Asked Questions
Is AI secure?
How do we secure Microsoft Copilot?
How do we secure AI Agents?
Can an AI Agent access sensitive information?
What is AI governance?
Do we need an AI policy?
What is Microsoft Purview's role in AI?
What is Microsoft Entra's role in AI?
How does Microsoft Defender support AI security?
What is Security Copilot?
How can CPS help?