In every organization there is someone on the security team, often the CISO, who knows exactly how bad the data exposure situation is. They have been trying to get this fixed for months, sometimes years. And the reason it has not been fixed is budget cycles: by the time a business case gets approved, the person who wrote it has moved on and the problem has gotten larger. 

The hardest cases are the organizations where one person knows (and is personally on the hook if something goes wrong) but cannot get a decision made fast enough to close the gap. Too many good security leaders are losing that fight. 

Policy Is Not Practice

Every framework your organization has aligned to (NIST CSF, ISO 27001, SOC 2 Type II, SANS) and every privacy regulation that applies to you (GDPR, Law 25, CCPA, PIPEDA) includes the same operational requirement: manage access to personal and sensitive data on an ongoing basis.  

Your policies say you do this. Your auditors are told you do this. 

The reality is different: not because your teams are failing, but because this work is not happening continuously and at scale. There are no clear metrics to demonstrate measurable risk reduction over time. That gap is real, and it is growing every single day. 

This Wasn’t a Breach: It Was Tuesday

Ninety percent of organizations have sensitive files exposed to every employee in Microsoft 365. Over time, thousands of small decisions (a file shared too broadly, a link that was never revoked) accumulate.  

Your IT team can see it, but they cannot fix it because they don’t have the business context to know which of the millions of shares are still legitimate. Only the person who created the share knows that. So the work does not get done at the scale it needs to, and the risk compounds. 

You Were Never Governed. You Were Just Lucky

For years, there was a form of protection built into the chaos: sheer volume. The fact that your files were buried across millions of folders made it statistically unlikely that any one person would stumble across something sensitive. That protection was not real governance, but it was something. 

AI just eliminated it entirely: the productivity tools your organization is deploying right now (copilots, AI agents, autonomous tools connected to your Microsoft 365 environment) inherit whatever access environment you have already created. Every salary file, every board document, every contract that was overshared months ago and never reviewed is now instantly discoverable, summarizable, and actionable by AI. 

In a worst-case scenario, a single compromised account combined with AI-powered tooling can mine years of collaboration data in minutes.  

The Fix Takes Days (But The Approval Months)

The pattern is consistent across organizations of every size and sector. Your security team will recognize the problem quickly. They will evaluate WeActis. They will like it — everyone does, because the solution is proportionate to the problem and it does not create more work for your IT team, it gives them relief.  

But then the normal process starts: a business case must be built, budget must be justified against competing priorities, procurement gets involved. Someone asks whether IT could build something in-house. Months pass, the committee meets. More months pass. 

Here is the irony: the business case to justify buying WeActis takes longer to build than the actual deployment. WeActis starts producing results in the first week. But during every week of that deliberation, your employees are creating new shares, new links, new access that no one will ever review. 

The cost of waiting is measurable: it is the number of new overexposures created between the day someone recognized the problem and the day your organization finally decided to act. 

Proof, Not Policy

Your auditors and regulators are not asking whether you have good intentions. Under GDPR, penalties can reach four percent of global turnover or €20 million.  

In healthcare, HIPAA enforcement has pivoted decisively toward access governance: OCR settlements routinely cite inadequate access controls and missing audit trails, seven-figure fines are now routine, and class actions regularly add nine-figure exposure on top of the regulatory bill.  

In financial services, frameworks like OSFI B-13, NYDFS Part 500, and the SEC’s cybersecurity disclosure rules have all moved the bar from “do you have a policy” to “show continuous evidence”; and recent enforcement against major institutions has been measured in tens of millions for controls that existed only on paper.  

In insurance, the NAIC Insurance Data Security Model Law requires insurers to identify, assess, and mitigate risks to non-public information on an ongoing basis; cyber underwriters (often insurers themselves) now demand the same evidence on renewal questionnaires, so a governance gap affects both your regulatory standing and the price of your own coverage. These regimes do not ask whether you have a policy. They ask whether you can demonstrate that your data protection measures are actively operating. 

An annual training completion report and a quarterly access review that has not happened in two quarters is not a demonstration of anything except the gap between your intent and your execution. 

A Personal Risk

There is something the regulatory conversation often glosses over: when governance controls fail and an incident occurs, the person in the room is usually the CISO. 

And that’s no longer just a career observation, it’s a legal one. 

In 2023, the U.S. Securities and Exchange Commission charged a sitting CISO personally (not the organization, the individual) for allegedly misleading investors about the company’s cybersecurity posture. The case drew a bright line that the security community has been absorbing ever since: if you are the person responsible for data protection controls, and those controls are not actually operating, your personal exposure does not end where the company’s begins. 

You do not need to be in a U.S.-listed company for this to apply to you. Under GDPR’s accountability principle, organizations must demonstrate that controllers and processors take responsibility for compliance.  

In healthcare, HIPAA explicitly requires organizations to designate a Security Official and a Privacy Official who are personally accountable for the program, and HITECH extended liability into criminal territory for the most serious cases. In financial services, NYDFS Part 500 requires the CISO to file an annual attestation of material compliance in their own name (not the organization’s) and amendments in force since late 2023 have sharpened that exposure substantially. In insurance, the NAIC Insurance Data Security Model Law mandates a specifically designated individual who must oversee the program and respond to regulators when an incident occurs. That name is the CISO’s. 

The Insurance Gap Most Boards Don’t See 

There is one more detail worth raising at the board level: Directors & Officers (D&O) insurance was designed to protect directors and named officers of the company. The Chief Compliance Officer and the CISO often sit outside that named schedule or fall into coverage gaps that carve out regulatory fines, willful-violation findings, or personal enforcement actions of the kind the SEC has now demonstrated it is willing to bring.

The result is a quiet asymmetry: the people most personally exposed when controls fail are frequently the least insured against that exposure. Boards that assume D&O will fully insulate the leaders running their data-protection program are often discovering the limits of that assumption only after an incident, when the organization is indemnified, and the individual is not. 

This Is Not a Transformation Project 

WeActis is a Teams app. It syncs with your Microsoft 365 environment, identifies overexposed data, and asks each employee to spend two minutes reviewing the shares they created. The employee who created the share is the one who reviews it, because they are the only one who knows whether it is still needed. Most of them appreciate it because it is specific, contextual, and effortless. 

Results start accumulating in week one. Your CISO gets real metrics to present to the board: not “95% of employees completed training,” but “employees revoked 12,000 unnecessary shares last quarter.” Your compliance team gets continuous evidence for auditors and your IT team gets relief from an impossible remediation burden. 

The Real Question

Your policies already say that managing access to sensitive data on an ongoing basis is a requirement.  

The question is whether your organization will continue treating it as something to address in the next budget cycle or whether you will make a decision that takes less organizational energy than the deliberation itself. 

Every day you wait, the problem gets bigger and the cleanup gets harder.

One takeaway for your next boardroom meeting

The business case to fix this problem takes longer to build than the fix itself. The real question is therefore no longer whether the organization can afford to act, but what each month of inaction adds to the remediation bill and to the personal exposure of the person who will sign the next attestation.