Security that lets the business move faster.
The data security platform for the AI era, built for Microsoft 365. Your people are already using AI, and Copilot will show them whatever they can already reach. ShadowSight shows you what data you hold, who can reach it and where it is going, so you can adopt AI with confidence instead of crossed fingers.
AI has changed what your data security has to see.
Data is leaving where you can't see
Customer data, contracts and code are being pasted into ChatGPT, Gemini and other AI tools as part of everyday work, with no policy and no visibility.
It surfaces what people can reach
Switch it on without auditing SharePoint and staff can find content they were never meant to see. Copilot doesn't create that access. It exposes it.
Blunt, blanket rules slow everyone
Blanket blocks and "no AI" policies stall projects, and people route around them. Without visibility, blunt controls are all you have.
See your data at rest. Watch your data in motion. One platform.
DSPM-style tools show where data is exposed and DLP tools watch it move. ShadowSight does both, on one read-only Microsoft 365 connection, so each half makes the other sharper.
Know it. Clean it. Lock it down.
Know what you hold and who can reach it.
- Discover and classify sensitive data across Microsoft 365 and Windows file servers, with a confidence rating on each finding.
- Map real access: org-wide permissions, open shares, anonymous links and orphaned accounts.
- Apply and correct Purview labels, and get alerted the moment one is downgraded or removed.
- Remove what shouldn't be there with a defensible delete, archive or migrate plan.
- Copilot-ready: audit who can reach what, before or after switch-on.
Watch it. Catch it. Prove it.
Catch leakage that looks legitimate.
- Personal email and cloud uploads that sail past native rules.
- Shadow-AI paste-ins of customer and sensitive data into ChatGPT, Gemini and other AI tools.
- Resignation-week downloads and slow drips to personal accounts.
- Behavioural detection, not just rule matches.
- Confirmed findings with evidence attached, reviewed by us, by you, or both.
Confidence lets you replace blunt, blanket controls with informed, targeted ones.
Block first, ask later
- Blanket blocks on uploads and sharing.
- "No AI tools" policies that staff work around.
- Sensitive data scattered and unclassified.
- Security reviews that stall projects.
See it, then decide
- Targeted controls on the data that actually matters.
- Staff use AI tools, and you can see what leaves.
- Sensitive data classified, labelled and watched.
- The business gets to yes faster.
Copilot works with whatever a user can reach. Most organisations have never audited that.
ShadowSight shows what your people can really access and tidies it up, before or after go-live.
"Don't we already have Purview, or a DSPM?"
Native tools and DSPM products tell you where data is exposed. ShadowSight also watches where it goes, and corrects labels rather than just reporting on them.
Nothing replaced
It adds depth to the Microsoft 365 you already pay for, rather than replacing it. No E5 licensing needed and no competing platform to learn.
Nothing new to deploy
Read-only against logs and signals your tenant already produces. No endpoint agents and no new infrastructure, just a lightweight collector if you include Windows file servers.
Three doors in. One platform.
1. Adopt AI safely
See what staff send to AI tools and what Copilot can reach, so adoption speeds up rather than stalls.
CIO · CISO · Board
2. Move faster
Replace blunt, blanket controls with targeted ones, because you can see the data and where it goes.
CEO · COO · CISO
3. Spend less
Remove stale and old sensitive data. Cut storage cost and shrink the attack surface.
CFO · CIO · CISO
Security that partly pays for itself.
Most SharePoint estates hold years of forgotten content, including old sensitive data nobody remembers keeping. Data Risk finds it, classifies it and gives you a defensible plan to remove it. You pay to store less, and there is less to lose.
Typical results. Your assessment produces a figure for your own tenant.
If your data lives in Microsoft 365, this applies.
Any Microsoft 365 organisation
If you run SharePoint. 50 to 5,000 staff, no E5 licensing needed.
Regulated
Finance, insurance, health. Classification and evidence that support obligations such as CPS 234.
Education & government
Decades of sprawl. Decentralised estates and records obligations. Scales to very large estates.
ShadowSight-managed
Our analysts validate findings first, so only confirmed risk reaches you.
Co-managed
We split the work, either way.
Self-managed
Your team runs it alone. Suits government and defence.
Start with a ShadowSight Assessment.
One engagement covers both halves, data at rest and data in motion, on your own data, with under a day of your team's time. Live in days, no disruption.
Scope
You decide what's in scope before anything is monitored or read.
Connect
One read-only admin consent for Microsoft 365. No agents, nothing installed.
See it
ShadowSight runs quietly against real data, in your own tenant.
Decide
You get findings with evidence attached, and decide whether to go live.
- Sensitive data footprint
- Cost-saving estimate
- Exposure and Copilot readiness
- Executive briefing
- AI and leakage findings
- Clean exit, certified
Frequently asked questions
What is ShadowSight?
ShadowSight is a data security platform for Microsoft 365, from Melbourne, Australia. It connects read-only to the Microsoft 365 you already run and covers both states your data can be in. For data at rest, Data Risk finds and classifies sensitive data, shows who can reach it and removes what shouldn't be there. For data in motion, Data Leakage Prevention catches data leaving through personal email, cloud storage and AI tools, including leakage that looks like ordinary work. Each half informs the other. WorkPulse, a role-calibrated read on office vs. remote efficiency, is also on the platform. It can be managed by our analysts, your team, or a mix of both.
How is ShadowSight different from Microsoft Purview?
It works alongside Purview rather than replacing it. Microsoft 365 already includes powerful capability — Purview, sensitivity labels, sharing controls and detailed activity logs. The gap is capacity: turning what Microsoft 365 produces into daily visibility and action without a specialist team to run it. ShadowSight adds that layer for both states of your data. At rest, it shows where Purview labels don't match what's actually stored and who can reach it. In motion, it adds behavioural detection for data loss that native DLP rules don't catch, and validates every alert.
Is our Microsoft 365 ready for Copilot?
Copilot can surface anything a user can already reach, and most organisations have never audited that. Data Risk maps sensitive data across SharePoint, Teams, OneDrive, Exchange and Windows file servers and shows exactly who can reach it: open shares, org-wide permissions, anonymous links and dead accounts that still hold rights. Every location gets one recommendation — delete, archive, migrate or fix access — with evidence and an owner, before or after you switch Copilot on.
Do we need Microsoft 365 E5 licences?
No. ShadowSight works with the Microsoft 365 you already run and adds its own detection and analysis on top, so you get coverage for data at rest and data in motion without moving to an E5 licence estate.
Do we need to install anything?
No agents or endpoint software. Connecting takes one read-only admin consent for Microsoft 365. The one exception is Data Risk for Windows file servers, which uses a lightweight collector running under a low-privilege account you provision.
Who manages ShadowSight — you or us?
Either, or both. We can run it end to end, with our analysts validating every finding before it reaches you; your team can run it exclusively, with no external analyst in the loop; or we share the work. The detection is the same in every model — only the reviewer changes — and you can switch models without a new deployment. How it's managed.
How long does it take to get started?
Connecting takes one read-only admin consent. For Data Leakage Prevention and WorkPulse, a Proof of Value shows findings on your own data within days, with under an hour of your team's time. For Data Risk, the Data Footprint Assessment is a fixed-fee engagement completed in 3–4 weeks with under a day of your team's time, with a first footprint estimate inside a fortnight.
Does ShadowSight store our emails or files?
Only if you choose to. By default, content is read transiently for classification and we keep metadata and our findings, not copies of your emails or files. Where a client chooses, ShadowSight can keep copies of emails and files within the platform as evidence. For Data Risk, each finding keeps a short verdict and brief masked extracts as evidence, never a copy of the file. WorkPulse works from activity metadata only — never message content, keystrokes or screens.
Where is our data hosted?
In the Microsoft Azure region where your business is located, to maintain data sovereignty. Where AI features are turned on, analysis uses Azure OpenAI in the same region, and you can turn AI features off entirely. Our staff don't access customer data from outside Australia.
What does a Proof of Value involve, and what does ShadowSight cost?
A Proof of Value runs quietly on real data in your own Microsoft 365 tenant, with no disruption to your business. At the end, you either go live or we revoke access, destroy the findings on your instruction and issue a destruction certificate. Pricing depends on the modules you choose and how it's managed, with bundled pricing when you take more than one module. Request pricing.
Start with a ShadowSight Assessment.
See your data at rest and in motion on your own Microsoft 365 tenant, with under a day of your team's time and no disruption.