ShadowSight

ShadowSight solves the challenge of Insider Threat – unsanctioned activity by employees – which is often unintentional but potentially devastating.

04/11/2026

Data nobody chose to include

There's a second way this goes wrong, and it's quieter.

The first is someone finding data they shouldn't. The second is someone using data without knowing it's there.

Picture a manager asking an AI assistant to draft a summary for a leadership meeting. A perfectly reasonable request. The assistant pulls from whatever the manager can access and builds a clear, confident answer in a few seconds, with a good structure and a professional tone.

What the manager doesn't see is where each part came from. One line draws on a document from another team. A figure comes from a file that was only ever meant for finance. A note about a restructure, never intended for circulation, quietly shapes a paragraph. Nothing is flagged. It reads well.

The manager did nothing wrong. They asked a normal question. But the output now carries information they didn't choose to include and can't easily trace. They're busy, the summary looks right, and it goes into the pack.

That's a different kind of risk. It isn't a hacker or a rogue employee. It's an honest person, a helpful tool, and data that was in the wrong place.

It's also harder to spot than the first scenario, because nothing looks wrong at the time. The output looks fine. The problem only shows up later, if at all. Perhaps when someone in the meeting asks where a number came from. Perhaps when the document is forwarded outside the organisation. Perhaps never, which is its own kind of problem.

Many traditional controls were built to watch for people copying files, emailing attachments and uploading to personal storage. They're much less suited to information being summarised, rewritten and folded into a new document that looks entirely original.

The common thread with the first scenario is that the fix doesn't sit with the user. You can't train every manager to second-guess every sentence an assistant writes. The fix sits upstream, in knowing what sensitive data you hold and making sure it isn't sitting where an assistant can reach it unnecessarily.

How would your organisation know if something sensitive had found its way into an AI-drafted document?

www.shadowsight.io

02/11/2026

The file nobody knew existed

Back to our CIO.

The pilot has been running for about a week. It's going well. People like the tool and the feedback is positive. The CIO is starting to feel the decision was the right one, and the board is pleased with the early results.

Then one of the pilot users asks the assistant to summarise recent changes to staff arrangements. And it returns something they were never meant to see. A file about an individual, from an HR folder that was shared far more widely than anyone realised.

They weren't looking for it. They didn't know it existed. They close the window and, to their credit, mention it to someone.

That's the best case: a conscientious person putting their hand up.

The worse version is the person who doesn't mention it. Or the one who does go looking, now that they know it's there. Or the one who mentions it casually to a colleague, and by the end of the week it's the talk of the floor.

Either way, the CIO now has a problem that AI didn't create but did expose. And it's one they have to explain upwards. How long had that folder been open? Who else could see it? Has anyone else opened it? Those are reasonable questions, and they're ones that many organisations struggle to answer quickly.

They also have a decision to make about the rest of the pilot, with very little information about what else is out there. Pause it and the business loses momentum. Carry on and they're hoping the next surprise isn't worse.

This is the moment the scenario changes. Until now, the AI project looked like a technology rollout. From here, it looks like a data problem that the technology made visible.

What strikes me every time is how ordinary the trigger is. Nobody did anything unusual. A normal person asked a normal question and got an answer that went further than anyone expected.

If a pilot user came to you tomorrow and said "I saw something I shouldn't have", do you know what you would do first? And do you know how quickly you could find out who else had access?

www.shadowsight.io

30/10/2026

A clean-up project with a licence attached

Unpopular opinion: most Copilot rollouts aren't technology projects. They're data clean-up projects with a licence attached.

The licence is the easy part. Switching it on takes minutes. Training people to write good prompts is straightforward. Even the change management is something most IT teams know how to do.

The hard part is the question underneath it: do we actually know what's in our SharePoint, who can reach it, and whether it should still be there?

In the scenario we see most often, the honest answer is no. Sites created for projects that finished years ago. Libraries shared with "everyone except external users" because it was quicker at the time. Folders no one owns. Files nobody has opened in years but that are still perfectly findable. Copies of copies, saved to personal drives, with nobody sure which is the real one.

None of that matters much while people have to hunt for it. It matters a lot once an assistant can find it for them.

So the real plan looks different from the one on the slide. Understand the data first. Fix the access second. Then turn the tool on. In that order.

I know that's not the answer the business wants to hear. The pressure is to switch on and show value fast. But the organisations that do the groundwork first tend to have a much calmer rollout, because they're not discovering problems in front of an audience.

Skip it and you do the clean-up anyway, just after something goes wrong instead of before. Same work, worse timing, and a much harder conversation with the people who now want answers.

There's also a version of this where a good rollout and good governance reinforce each other. People trust the tool because they know what's behind it. Leadership backs it because the risks are understood. Adoption goes up because nobody is nervously waiting for the first incident. That's the version worth aiming for.

Do you agree? Or is there a way to roll out AI safely without dealing with the data first? I'd genuinely like to hear the counter-argument, especially from anyone who has done it.

www.shadowsight.io

28/10/2026

AI doesn't create access. It finds it.

AI doesn't give anyone new access to your data.

That sounds reassuring. It isn't.

An AI assistant answers from whatever the person asking can already open. It doesn't break in or bypass anything. It simply uses the permissions that are already there, exactly as they were set.

The difference is effort.

Before AI, finding a sensitive file in an overshared SharePoint library meant knowing it existed, knowing where to look, and being bothered enough to dig. Most people never did. They didn't have the time, they didn't know the site was there, or they assumed that if something sensitive was in there, someone would have locked it down. The data was exposed, but it was protected by obscurity.

Now someone types a plain-English question and gets an answer in seconds. "Show me the salary bands." "Find the disciplinary files." "What do we hold on this person?" Obscurity was doing a lot of quiet work in most organisations, and AI removes it overnight.

Nothing about the permissions changed. What changed is how easy they are to use. The gap between "technically accessible" and "practically findable" is where most organisations have quietly been living for years, and AI closes it.

In the typical scenario, our CIO hasn't made a mistake. They've inherited a decade of sharing decisions made by people who have since left. A site opened up for a project in a hurry. A library shared with everyone because it was quicker than working out the right group. A link sent to one person that is still live years later.

Each decision made sense at the time. Together, they form an estate where the real access model bears little resemblance to the one anyone thinks they have.
That's the uncomfortable part of this. The problem isn't something the AI introduces. It's something the AI reveals, and it reveals it to everyone at once.
Has obscurity been part of your security model, whether or not anyone wrote it down? And if you took it away tomorrow, what would people find?

www.shadowsight.io

26/10/2026

The call from the top

The call usually comes from the top.

The board has seen what AI can do. A competitor has announced something. A director mentions it at dinner, and by Monday morning the CEO is asking the CIO a simple question: why aren't we using this yet?

So the CIO says yes. Of course they do. Saying no to AI right now feels like a career-limiting move, and the business case writes itself. Faster drafting, quicker analysis, less time spent searching for things.

Over the next four weeks I want to walk through a scenario we see again and again. It's a composite, not one client, and it goes roughly like this.
A licence gets approved. A pilot group gets named. A go-live date goes in the calendar. Procurement gets involved, training gets scheduled, and a communications plan is drafted. Everyone is focused on the tool: which one, how many seats, what the rollout looks like.
Almost nobody is asking what the tool will be able to see.

That question decides how the rollout goes, and it rarely makes it into the project plan. Not because the people involved are careless. They're usually smart, experienced and under real pressure. It's because the question sits between teams. The AI project belongs to IT. The data belongs to the business. And the permissions were set up years ago by people who have long since moved on.

Here's why I think this matters now. In the past, a poorly governed file share was an untidy problem, something you meant to get to. With AI in the picture, it becomes a live risk, because the thing sitting on top of it is designed to find, combine and present information quickly. The tidiness problem and the security problem have become the same problem.

That's not a criticism of anyone. The pressure is real, and the instinct to move is understandable. But speed without visibility is how a good intention turns into a difficult conversation with the board a few months later.

I'll follow the CIO through the pilot, the surprises, the wrong turns and the reset. Each post stands on its own, so you can jump in anywhere, but they do build on each other.

If you've been the CIO or CISO in that room, what was the first question asked? Was it about the data, or about the tool?
www.shadowsight.io

30/09/2026

Manager Impact on WFH Teams

When your team works from home, manager engagement matters more than ever.

In an office, a disengaged manager is partially masked by proximity. People still bump into each other. Conversations happen. Things get communicated, even if imperfectly.

Working from home removes that buffer entirely.

If a manager isn't actively reaching out, scheduling 1:1s, responding promptly and communicating clearly — the team notices, and their output reflects it.

ShadowSight WorkPulse pairs manager Microsoft 365 engagement signals with team productivity metrics. Response times, 1:1 meeting frequency, communication patterns — compared against team output.

The correlation is consistent: engaged managers produce productive remote teams. Disengaged managers produce struggling ones.

The data gives HR the right conversation to have — targeted support, not blame.

If you have remote teams that are underperforming and you're not sure whether the issue is individual, team, or management — WorkPulse will tell you.

👉 Go to shadowsight.io to see how WorkPulse surfaces manager engagement signals alongside team output. The data changes the conversation — every time.

30/09/2026

Hybrid Policy Evidence

Most hybrid work policies were written on a whiteboard in 2021 and never questioned since.

Three days from home. Two in the office. Or the reverse. Or whatever felt politically manageable at the time.

The question almost nobody answered with actual data: does where your people work make a meaningful difference to their output?

ShadowSight WorkPulse answers it.

Using twelve months of Microsoft 365 activity data, WorkPulse shows you the real productivity difference between your team's in-office days and their working from home days — broken down by role, department, and individual.

Some findings will surprise you. Deep work often goes up when working from home. Collaboration clearly goes down.

The evidence should shape the policy — not the other way around.

Build your hybrid policy on data, not assumption.

If your organisation is heading into a hybrid policy review, don't do it without the data. WorkPulse gives you twelve months of evidence before the conversation even starts.

👉 Go to shadowsight.io and request a hybrid policy evidence report for your Microsoft 365 tenant. Know what your data says before you decide what your policy should be.

29/09/2026

Meeting Overload

Working from home was supposed to mean fewer pointless meetings.

For many teams, it meant more.

When people can't see each other in person, the instinct is to schedule a call. And another. And another.

Before long, some teams are spending more than half their working day in video meetings — with almost no time left to do the actual work.

ShadowSight WorkPulse tracks the ratio of meeting time to output activity for every team in your organisation.

When someone working from home is spending six hours a day in meetings and producing two hours of output, that's visible, measurable, and something a manager can act on.

The solution isn't always fewer meetings. Sometimes it's better async habits, smarter scheduling, or simply the right to say no.

But you can't fix a problem you can't see.

If your remote teams feel constantly busy but aren't producing what they should be, meeting overload is the most common culprit. WorkPulse tells you exactly where it's happening.

👉 Visit shadowsight.io and ask about WFH meeting load monitoring. Find out which of your teams is buried in calls — and give them the evidence to do something about it.

29/09/2026

New Starter WFH Ramp

Onboarding someone into a working from home environment is one of the hardest things to get right.

There's no office to walk into. No team lunch. No chance to overhear a conversation and pick something up.

A new starter working from home has to actively reach out to learn — and it's very easy for them to fall behind without anyone realising it.

ShadowSight WorkPulse tracks new starter Microsoft 365 activity from day one — Teams engagement, email patterns, file activity, meeting attendance — and compares it against the expected ramp trajectory for their role.

If someone working from home is significantly below target by week four, you know at week four. Not at their three-month review when the damage is done.

Early visibility saves new hires. WorkPulse gives you that visibility from day one.

If you've lost a new starter in the first 90 days and wondered what you missed, WorkPulse shows you exactly when the warning signs appeared — and gives you the tools to act on them next time.

👉 Talk to the team at shadowsight.io about WFH onboarding monitoring — and stop losing new hires before you've had a chance to keep them.

28/09/2026

The Cost of Not Knowing

Every month your team is working from home without productivity data is a month you're paying for output you can't verify.

That's not an accusation. It's a measurement problem.

If 15% of your remote workforce is operating at significantly below-benchmark activity — and with no M365 monitoring in place, that's entirely possible — you're carrying that cost every single pay cycle.

No visibility. No intervention. No improvement.

At $105,000 average fully-loaded cost per employee, a 15% productivity gap across 200 WFH-capable staff is worth more than $3 million a year.

That's not a rounding error. That's a business problem.

ShadowSight WorkPulse gives you the data to close the gap — not by watching people, but by understanding where support, conversation, or changed working arrangements could make a real difference.

The platform pays for itself many times over. But only if you start.

👉 Visit shadowsight.io and request a WorkPulse ROI estimate for your organisation. We'll show you what the productivity gap is likely costing you — before you spend a dollar.

Address

525 Collins Street
Melbourne, VIC
3000

Website

http://www.shadowsight.io/

Alerts

Be the first to know and let us send you an email when ShadowSight posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Want your business to be the top-listed computer & electronics service in Melbourne?

Nearby computer & electronics services

SECMON1
Collins Street
ACS Victoria
Collins Street
Klipboard
Collins Street
Smarketech
Collins Street
Firehawk Analytics
Bourke Street
Webdevelopment solution
Level 3/480 Collins Street
Onsys Technologies
Collins Street Tower Level 3 480 Collins Street Melbourne