Copilot is a search engine on top of your secrets
Nick Dreyfus: turning on Copilot doesn't add risk — it makes 20 years of forgotten permissions readable in seconds.
When I was 23, two weeks into a job, I opened the HR folder and could see every salary, bonus and payout in the company — CEO down to the newest hire. No special rights; I just clicked.
That moment is the through-line for this recording. Nick Dreyfus uses it to show a simple, uncomfortable fact: Copilot and similar AI tools don't grant new permissions. They make whatever access already exists effortless to use. If your folder map was built by decades of helpful shortcuts and forgotten groups, Copilot will politely pull answers together for anyone whose account can read those files.
Why companies look fine until the AI turns up
Nick walks through the usual three-way failure that creates the risk:
successive IT people who built different structures without documentation;
executives who never saw the permission map framed in business terms; and
access that gets granted in a hurry and never revoked.
Concrete example: a receptionist who could open management folders containing expansion plans — she never snooped, she didn't even know she had access. Before, someone would have had to click through folders for hours to assemble that picture. With Copilot, you ask one question and an answer appears in seconds.
That changes two attack scenarios that owners rarely imagine. First, an employee serving notice who has accumulated long-standing access can use Copilot to pull pricing, margins, contracts — everything that would have taken real effort before. Second, a breached external site where an employee reused credentials now becomes a remote stranger who can log in as your user and ask Copilot for secrets at 3 a.m. The tool improves productivity for everyone with valid credentials — including outsiders.
"Copilot did not create your permissions problem, it put a search engine on top of it." — Nick Dreyfus
A simple, practical prep plan you can do this week
Nick's fixes are practical and business-focused, not technical theatre. Do them before or immediately after you enable Copilot:
The newspaper test — open each folder and ask, if this were on the front page tonight, would we be okay? Mark green (public), yellow (sensitive), red (strictly private).
Tighten yellow/red by adding people individually when possible. Stop relying on broad departmental groups for sensitive content.
Ask the question nobody asks: why is this folder set up like this? If the answer is "it's always been that way," treat it as suspect.
Bring a third-party set of eyes. An outsider will see blind spots and reduce your day-to-day ticket load; Nick recalls his own ticket count dropping 40% in two weeks after getting outside help.
Use the right tooling as a starter — not a finish line — to map inheritance and stale groups, and make sure logging shows who asked what and when.
Nick is explicit: Copilot can be a gift if you build the foundation right. Otherwise it is a search engine on secrets you never meant to be searchable.
If one sentence sticks with you, let it be this: fix the permission map before you trust an assistant to read it. If that sounds like more work than you have time for, find an outside reviewer and make it your Monday task.
If you want the full conversation and the nonprofit program Nick mentions at the end, listen to the episode for the links and the real-world examples he walks through.