ECS 2027

31/05/2027, Congress Center Düsseldorf
Düsseldorf, Germany

The AI Data Breach That Never Happened: Following the Data Trail with Microsoft Purview

It is 4:55 PM, the end of the business day. You're about to leave when your manager asks you to send the latest report to an external recipient before 5:00 PM. To save time, you ask Microsoft 365 Copilot to draft the email, find the right document, and prepare everything for sending. With the clock ticking, you click Send. Moments later, Microsoft Purview Data Loss Prevention detects sensitive information. A policy is triggered, an alert is raised, and activity starts appearing across Purview. But what actually happened? Did the email leave the organization? Which content triggered the policy? Was the action blocked, overridden, or attempted another way? In this session, we investigate the incident from the perspective of a security analyst. Using DLP alerts, Audit, and eDiscovery, we reconstruct the full sequence of events and follow the data trail to uncover exactly what happened. Then we replay the same scenario with the right controls in place. We use Classification, Sensitivity Labels, and DLP to protect the information and explore what happens when a user attempts to bypass those controls through relabeling, label downgrades, or alternative workflows. Through one rushed end-of-day email, you'll see how prevention, detection, investigation, and evidence collection come together in Microsoft Purview, and why a breach that never happened can be just as valuable as one that did.