Author: preterion.admin

  • AI Shouldn’t Have the Keys to the Castle

    AI Shouldn’t Have the Keys to the Castle

    Artificial Intelligence is rapidly becoming part of everyday business operations. From drafting emails and analysing documents to answering customer questions and automating workflows, AI tools are delivering genuine productivity gains.

    And this brings with it a plethora of potential dangers and problems.

    The problem is not the technology itself.

    The problem is how quickly businesses are placing trust in systems that are still evolving from a security perspective.

    Recent research highlighted a vulnerability known as “SearchLeak,” which affected Microsoft Copilot. While Microsoft responded quickly to address the issue, the incident exposed an important reality: AI assistants can become a pathway to sensitive business information when they are given broad access to business systems.

    In this case, the attack did not rely on malware, ransomware, or traditional hacking techniques. Instead, it manipulated the AI’s behaviour through carefully crafted instructions, causing the system to access and expose information available to the user.

    Yes, you read this correctly: the link contained malicious instructions for the AI reading it!

    The significance of this event goes beyond any single vendor or product.

    It highlights a broader challenge facing businesses today.

    For years, cybersecurity focused on protecting people from making mistakes. Staff were trained to identify phishing emails, avoid suspicious attachments, and verify unusual requests.

    AI changes the equation.

    Now businesses are deploying digital assistants that can search mailboxes, access SharePoint libraries, review documents, analyse spreadsheets, interact with customer records, and perform actions on behalf of employees.

    These systems operate with the permissions they are given. If an employee can access confidential information, the AI connected to that employee’s account can often access it as well.

    This creates a new category of risk.

    At Preterion, we strongly believe AI has an important role to play in modern business. It can improve productivity, accelerate innovation, reduce repetitive work, and help organisations make better decisions.

    However, there is a critical distinction between using AI as an assistant and using AI as an autonomous operator.

    An assistant helps people make decisions.

    An AI operator makes decisions on behalf of people.

    The further businesses move towards autonomous AI, the more important governance, security controls, and oversight become.

    So, What’s The Solution to AI Dangers?

    Before integrating AI into core business systems, organisations should consider several questions:

    • What systems does the AI need access to?
    • Can access be restricted to only the information required?
    • Are permissions aligned with the principle of least privilege?
    • Is there a human approval process for sensitive actions?
    • Can all AI activity be monitored and audited?
    • What controls exist if the AI receives malicious or misleading instructions?

    These questions are not intended to slow innovation.

    They are intended to protect it.

    The history of technology shows that new capabilities are often adopted faster than security controls can mature. AI is unlikely to be any different.

    The businesses that benefit most from AI over the next decade will not necessarily be those that adopt it first. They will be those that adopt it intelligently.

    At Preterion, we encourage organisations to embrace AI while maintaining control over their digital infrastructure. Innovation should never come at the expense of security, resilience, or operational stability.

    AI is an extraordinary tool.

    But for now, it should remain a trusted adviser—not the holder of the master keys.

    Preterion helps businesses balance Cost, Resilience Innovation, Security and Performance through strategic IT Service Management and vendor-neutral technology guidance. Our approach is built on ensuring technology serves and protects the business, not the other way around.

  • Your Copilot Is Not Your Lawyer

    Your Copilot Is Not Your Lawyer

    Why Businesses Need to Stop Using the Copilot Consumer Version (and What to Do Next)

    We’re all excited about AI assistants, and let’s be honest, Copilot is fantastic – especially because it is free and deeply embedded into the Microsoft ecosystem. But before your business team starts pasting sensitive data into the free, consumer version, you need to read the fine print. Those casual-sounding Microsoft Terms of Use are a defensive legal structure that could expose your company’s intellectual property (IP) and privacy.

    Here’s a breakdown of the two clauses that should make any IT leader or compliance officer nervous, and what your organization needs to do to keep things buttoned up.The Two Must-Read Clauses in the Consumer Terms

    Microsoft’s consumer terms are written with blunt language for casual users. But for a business, they are huge red flags:

    1. “For entertainment purposes only”: This is Microsoft’s polite way of saying, “We warned you, this thing can hallucinate.” The tool can and will make mistakes, so you absolutely should not rely on its advice for anything important or mission-critical. Human verification is non-negotiable.
    2. “We may use Your Content”: This is the kicker. When you submit content to consumer Copilot, Microsoft is permitted to process and use it to operate and improve the service. This means your content—your secret sauce, your confidential memos—could be used to train the model, unless you’ve specifically restricted it via an enterprise contract. If you’re dropping sensitive data in there, you’re taking a massive risk with your IP and privacy.

    Why the Terms Are the Way They Are

    This isn’t a malicious plot; it’s mostly just legal pragmatism and product strategy:

    • Legal Defense: The blunt language limits Microsoft’s legal exposure to casual users and helps them stay safe from misunderstandings.
    • The Enterprise Upsell: They market the consumer Copilot broadly, but the strong contractual protections—like data isolation and better security—are intentionally reserved for the pricier enterprise SKUs.

    Real Talk: Actionable Steps for Your Business

    You can’t—and shouldn’t—stop using AI, but you need to start governing it. If you’re a business, you need contractual protection plus operational governance.

    1. Block the Freebie for Secrets: Immediately restrict the use of consumer Copilot for any proprietary or sensitive content. If the data is involved in mission-critical work or is sensitive, always keep a human in the loop to look it over.
    2. Get the Proper Contract: If Copilot is serious business for your team, procure the enterprise agreements. These include the data handling and isolation guarantees that the consumer terms lack.
    3. Assign Ownership and Audit: Automation doesn’t eliminate the need for human bosses. Assign named owners for Copilot workflows. When feasible, log the inputs and outputs for potential audits.
    4. Standardize: Minimize risk by creating consistent prompts and templates for your team to use.

    Need a Quick Decision Checklist?

    • Sensitive Data Involved? 👉 Avoid consumer Copilot.
    • Need an Audit Trail? 👉 Get the enterprise contract and ensure logging is implemented.

    AI assistants are game-changers, but they aren’t magical replacements for human judgment. They are powerful tools that require smart management and stewardship.

    For more information on how companies are tracking and governing AI usage, check out: