Securing Copilot for Microsoft 365: New AISPM Capabilities from Zenity

In the realm of modern enterprise productivity suites, Copilot for Microsoft 365 stands as a huge driver for efficiency, offering business users the ability to aggregate, summarize, and process data within the M365 suite of tools. However, for organizations with diverse infrastructure and applications, and the need for real-time data interactions, the out-of-the-box functionality requires augmentation to reach its full potential, not to mention secure controls for Copilot for M365.

Enterprises seek to bridge this gap through the integration of plugins. Put another way, plugins are extensions that connect external applications and data sources to Copilot for Microsoft 365 and enable the real-time reading and writing of data to provide end users with better, faster, and smarter answers. These plugins, whether developed in-house, by third-party vendors, or by business users themselves, extend the functionality of Copilot to meet specific organizational needs. And with already over 50 plugins currently available for early access customers of Copilot for Microsoft 365, and thousands more anticipated as integration with Teams and the Power Platform expands, the use of these plugins is surging.

Yet, with great power comes great responsibility, and the use of these plugins poses significant challenges in terms of security and governance.

Challenges in Extending Copilot with Plugins

1. Lack of Visibility. The dynamic and popular nature of AI copilots makes it critical, yet arduous for security teams to maintain visibility into who is interacting with Copilot for M365, how data is being accessed and manipulated, and the customization of workflows. This becomes even more challenging with plugins, as they create new pieces of software that must be accounted for, yet are often black boxes inside of the marketplaces where they live. This lack of awareness that it is even happening can also lead to AI and LLMs performing unauthorized actions on behalf of end users, posing substantial risks to data integrity, privacy, and compliance.
2. Data Exposure and Leakage. Plugins inherit security controls from their creators, often leading to unintended data exposure and leakage. Much like low-code/no-code development platforms, it is very easy for makers to embed their own identities into these plugins; creating anonymity upon use. Misconfigurations within these plugins can result in unauthorized access and prompt injection attacks, facilitating the exfiltration of sensitive data beyond corporate boundaries. Additionally, the absence of stringent approval processes for plugin integration exacerbates the risk landscape, allowing for shadow AI deployments with minimal oversight.
3. Shadow AI. When creating with, and integrating plugins to Copilot for M365, it is done outside of the purview of IT. Furthermore, the marketplaces where the plugins are stored are black boxes, with little insight into the security bonafides and enterprise readiness of each individual plugin. This increases the risk of supply chain attacks, as these components are easily integrated into the flow of building and using plugins within enterprise use cases that are used by many.

The Zenity Solution

In response to these challenges, Zenity is excited to introduce advanced AI Security Posture Management (AISPM) capabilities tailored specifically to secure Copilot for M365; with support for other enterprise copilots coming soon. By prioritizing security and governance for plugins, Zenity empowers organizations to unlock the full potential of Copilot for M365 while mitigating associated risks.

Key Features

1. Enhanced Visibility: Zenity provides comprehensive visibility into plugin usage within Copilot for Microsoft 365, enabling organizations to monitor interactions and identify potential security gaps. Further, security leaders can gain business-level context as to what plugins are built by whom, what data sources they are interacting and connecting with, and more.

2. Risk Assessment: Leveraging AI-driven risk assessment algorithms, Zenity evaluates each plugin and interaction to identify anomalies and misconfigurations to minimize data leakage and meet compliance mandates. By flagging potential security violations, organizations can preemptively mitigate risks associated with data exposure and unauthorized access. Common violations in plugins include: hard-coded secrets, identity impersonation, supply chain risks, and over-sharing.

3. Security Guardrails: Zenity enables the implementation of customizable guardrails to ensure the secure deployment and usage of AI throughout its lifecycle. By establishing stringent controls, organizations can mitigate the risk of unauthorized actions and safeguard sensitive data from potential threats. For instance, a playbook can be created to detect when plugins are accessing sensitive data and have a hard-coded secret, and then send an email to the maker, the security team, quarantine that plugin until it has been triaged, and more. 

Conclusion

In an era defined by digital transformation and AI-driven innovation, securing enterprise and business productivity tools is a must for CISOs and security leaders looking to enable the business. Zenity’s pioneering approach to AI Security Posture Management empowers organizations to embrace and secure Copilot for M365 with confidence, unlocking unprecedented productivity gains while safeguarding against emerging threats. With Zenity as a trusted partner, organizations can navigate the complexities of plugin integration with ease, ensuring that the promise of Copilot is realized without compromising on security.

For more information on Zenity’s AI Security Posture Management solution, get in touch with us… we’d love to show you more!