Unplanned client data exposure
Client files shared outside the firm
Matter and engagement files are shared with clients, counsel and third parties, and the links outlive the work. Each live link is a client data exposure risk.
External collaborators with lingering access
Former contractors and external collaborators keep access to shared files after an engagement ends, and nobody is assigned to take it away.
AI rollout on loose permissions
Copilot works with whatever access people already have. Files that are overshared today become answers tomorrow.
Find files shared externally
The engagement ends but the share link stays live. TENET lists what remains open to outside recipients in SharePoint and OneDrive, so each live link gets a decision.
- Live shares listed from both file stores
- Outside recipients shown per shared file
- Device health from Intune and Defender in the same view
Engagement letter, closed matter
Shared with an external recipient
Due diligence folder
Shared with several external recipients
Pitch deck draft
Shared with one named client
Internal templates
Not shared externally
former-contractor
Identity · broad access still in place
svc-document-sync
Service principal · wide permission reach
partner-counsel
External identity · scoped access
matter-admin
Internal identity · role fits the job
Review who has access
Permissions are granted for a matter and rarely withdrawn. TENET maps what every account and automated identity can reach, so access review starts with evidence.
- Accounts and automated identities mapped side by side
- Broad permission reach flagged
- Evidence for the next access review
Stop mailbox takeover
Business email compromise starts with one stolen password or one malicious app consent. TENET flags impossible travel, legacy sign-ins, suspicious permission grants and third-party apps with broad access.
- Suspicious sign-ins per account
- Risky permission grants flagged
- Third-party apps ranked by access
Partner mailbox
Sign-in from two countries within an hour
Mail-sync app
Read access to all mailboxes
Legacy mail client login
No multifactor prompt
Office desktop sign-in
Known device and location
Transactions site
Shared externally
Research agent
No owner or sponsor
7 idle licences
Assigned, no recent activity
Copilot
18 users ready
Roll out Copilot safely
Copilot answers from whatever people can already reach. TENET shows which users are ready, which sites are shared too widely, which licences sit idle and which AI agents have no owner.
- Copilot readiness per user
- Idle licences before renewal
- AI agents without an owner
Evidence for client security reviews
Clients and insurers ask how you protect their data. TENET maps your Microsoft 365 and Azure controls to NIST CSF 2.0 and NIS2, keeps your security policies with review dates and produces reports you can share.
- NIST CSF 2.0 and NIS2 readiness
- Policy Vault with review dates
- Downloadable compliance reports
Protect · access control
Controls failing
Information security policy
Review overdue
Supplier register
2 reviews due
NIST CSF 2.0 report
Ready to download
FAQs
We do not have a dedicated security team. Is TENET a fit?
Yes. TENET ranks findings by risk so the people who look after IT as one of several jobs can see what matters first. Setup uses read-only access with no agents to deploy.
Run the free Self-Service Assessment to see your own findings ranked by risk.
Does TENET help us prepare for Copilot?
The free Self-Service Assessment includes a Copilot Readiness report. Inside TENET you can see which files are shared outside the firm, and track license usage and application adoption across your tenant.
Run the free Self-Service Assessment or read about Copilot license optimization.
Does TENET read our client files and emails?
No. Client files and emails are outside what TENET collects. It reads configuration and security signals, such as sharing settings and permissions, through read-only permissions, and it does not deploy agents.
See the Microsoft cloud integration guide for the exact roles and setup steps.
Find your Microsoft cloud risk
Connect your Azure and Microsoft 365 tenant with read-only access and see which identities, exposures and anomalies matter most.