Skip to main content
HashnodeRodney Mhungu

Command Palette

Search for a command to run...

Data Security & AI Report – September 2025

Updated
•6 min read•View as Markdown
R
Rodney Mhungu

As a Senior Solution Engineer at Microsoft with several years of experience in data security and compliance, I focus on empowering customers to achieve their data protection, privacy, and risk management objectives using the Microsoft Purview product suite. With certifications such as CIPP/E, CISM and other Microsoft technical certifications, my work involves technical architecture design, proof-of-concept facilitation, demoes and collaboration with sales, product, and engineering teams to address technical challenges. I have supported large enterprises across industries like financial services, energy, and healthcare to deploy and scale data security solutions for organizations ranging from 2,000 to 100,000 + users. My mission is to help organizations adopt secure and compliant practices while optimizing operational efficiency in alignment with societal values.

Part of seriesData Security & AI Reports

Introduction

Last year, I started sending a quarterly internal data security report on behalf of the Dutch solution engineering team. It proved helpful for spreading messages on key focus areas in the data security space, but I’ve realized these reports belong outside Microsoft as well.

Compared to any previous year, customer asks around data security have exploded, driven of course by the rise of AI. Legendary financial analyst Mary Meeker captured this in her May 2025 report on AI, where she used the word unprecedented more than 50 times. One striking use of the word to me was her coverage on mass tech adoption cycles: in the US each major technology wave - PCs, desktops, mobile, now AI - reached 50% household adoption in half the time of the previous wave. This time AI household adoption is projected to take as short as 3 years, which is sure to disrupt every (big) company’s long term planning efforts. It’s no wonder why our customers and partners want more frequent, high-quality broad-based insights to keep up. Perhaps I can add value as a curator.

For the first time, I’ll publish this kind of report publicly before resharing internally. Just as DJs became cultural curators during the digital music explosion, I see newsletters and reports playing a similar role in today’s content explosion, hopefully helping you dodge a lot of AI slop along the way

Security for AI: Microsoft’s Focus Areas

In the Netherlands, we recently delivered several Innovation Hub sessions with financial services customers to map out secure AI deployment strategies. These sessions target the Frontier Firms of tomorrow: organizations that can harness intelligence on tap to keep pace with business demands moving faster than human capacity.

The feedback was great. Here’s the PowerPoint material so you can jumpstart your own journey.

Overview: Security for AI – Intro – Sept 2025.pptx

  • What it covers: Why agentic AI changes the threat landscape; risks across data, identity, threats, and regulations; Microsoft’s Zero Trust for AI approach.

  • Framework: Prepare → Discover → Protect → Govern.

  • Why it matters: Provides executives and technical teams with a shared mental model before diving into details.

  1. Data Leakage & Inaccuracy: Security for AI 1 – Data Leakage and Inaccuracy – Sept 2025.pptx

  • What it covers: Guardrails to prevent sensitive data loss and improve AI output quality. Covers access cleanup, sensitivity labels, DLP, AI usage discovery, and runtime checks.

  • Why it matters: Provides concrete steps you can implement quickly to reduce oversharing, prevent exfiltration, and curb hallucinations.

  1. Emerging Threats & Vulnerabilities: Security for AI 2 – Emerging AI threats and vulnerabilities – Sept 2025.pptx

  • What it covers: New attack vectors (prompt injection, model theft, data poisoning, plugin flaws). Demonstrates AI red teaming, posture management, and runtime protections.

  • Why it matters: Gives security architects and SOC leads actionable monitoring and incident response strategies.

  1. Agent Sprawl & Risks: Security for AI 3 – Agent sprawl and risks – Sept 2025.pptx

  • What it covers: How to manage the explosion of AI agents. Entra Agent IDs, least-privilege access, and monitoring of agent behaviours.

  • Why it matters: Prevents “shadow agents,” compliance gaps, and risky automation—treating agents like digital employees with proper identity and access controls.

  1. Compliance: Security for AI 4 – Compliance – Sept 2025.pptx

  • What it covers: Aligning AI use with regulations like the EU AI Act, ISO/IEC 42001, and NIST AI RMF. Shows how Microsoft Purview, Defender, and other tools provide audit-ready evidence.

  • Why it matters: Translates policy into proof, helping organizations stay compliant without stalling innovation.

Thanks to Tina Ying and her team for developing these resources, and to Dennis van de Laar, Charlotte van Beijsterveld and Alaa Riahi (among others) for organizing excellent Innovation Hub sessions where we could explore the relevance of these themes with customers.

Upcoming Events (ordered by Date)

Executing Microsoft Blueprints for Data Security

For those tackling compliance and secure-by-design, good to remind you that Microsoft has developed Secure by Default with Purview blueprint, that includes a high level activities and presentations, downloadable here:

Detailed guide - Secure by Default with Purview - Introduction to secure by default with Microsoft Purview | Microsoft Learn

Patrick Murray has launched a fantastic video series explaining and demoing this blueprint. Find the videos here:

Additional blueprints for specific data security use cases:

Thanks to Maxime Bombardier, Sopie Ke and others for toiling away at these blueprints.

Deep Dives (Videos, Podcasts and Blogs)

Your #MicrosoftPurview L400 on Steroids — A great set of level 400 videos from Ray Reyes, showing how Purview data security capabilities work in practice. Watch on LinkedIn: Your #MicrosoftPurview L400 on steroid | LinkedIn

All Things M365 Compliance - Ryan John Murphy and Nikki Chapple host a pod/vodcast tackling customer and SME topics in security and compliance

Hack the Hoax Podcast (Summer Specials)- Hosted by Ellen van Meurs and Jan Willem Roks, featuring Dutch customers at an Executive Briefing Centre (EBC) in Redmond, Seattle. These episodes explore how Purview product leaders see the future of data security, and how customers experienced the EBC

Also thanks to Anela Jaganjac for her behind-the-scenes work in organizing the Dutch multi-customer EBC session.

Tell me what you think! At Microsoft we focus heavily on execution, but without customer and partner input, execution can easily become just a collection of hammers looking for nails. Your feedback ensures these resources truly address real-world business problems.

#data-security#cloud-security#generative-ai#eu-ai-act#cybersecurity-1#enterprise-ai-adoption#microsoft-365#ai-security#microsoft-purview

Comments

Join the discussion

No comments yet. Be the first to comment.

Data Security & AI Reports

Part 1 of 1

In this series, I will publish curation of information on the state of data security and AI

More from this blog

Rodney Mhungu

7 posts

I publish all my new blogs and newsletter here: https://rodneymhungu.substack.com