Lesson 37 — Protecting Sensitive Information
Security analysts work with some of the most sensitive information in an organisation: identities, authentication events, email content, endpoint evidence, customer data, confidential documents and sometimes credentials or regulated information.
Security Copilot can help analysts interpret that evidence, but it also makes disciplined data handling essential.
This lesson develops a practical approach to prompt minimisation, file handling, personal information, secrets, regulated content, generated reports, plugins, audit records and human review.
What you will learn
Protect sensitive evidence throughout AI-assisted security investigations.
Sensitive-information workflow
↓
Classify the information involved
↓
Confirm the user is authorised to access it
↓
Select only the minimum evidence required
↓
Redact irrelevant sensitive values where appropriate
↓
Use approved Copilot plugins and data sources
↓
Validate generated output against original evidence
↓
Classify the response based on its contents
↓
Distribute only to authorised recipients
↓
Retain or dispose according to organisational policy
Information handling model
| Information | Example | Primary control |
|---|---|---|
| Personal | User identity, email, sign-in location | Need-to-know and privacy controls |
| Confidential | Projects, customers, internal architecture | Classification and restricted distribution |
| Secrets | Tokens, API keys, passwords, private keys | Avoid unnecessary prompt exposure |
| Regulated | Financial, legal or other controlled records | Organisational and regulatory handling rules |
| Investigation evidence | Commands, alerts, timelines, indicators | Evidence integrity and source validation |
| Generated output | Incident summaries and reports | Classify according to contained evidence |
Learning objectives
Identify sensitive information in security operations, minimise unnecessary exposure, protect personal and regulated data, govern prompts and uploads, preserve evidence handling and validate AI-generated outputs.
Sensitive information is everywhere in a SOC
Security investigations routinely expose usernames, email content, IP addresses, device details, authentication events, malware artefacts, customer information and confidential business data.
Start with data classification
Apply the organisation's existing classification model so analysts know which information is public, internal, confidential, restricted or regulated.
Use the minimum necessary data
Give Copilot only the information required for the task rather than pasting an entire incident record when a small evidence set is sufficient.
Understand the purpose
Before using sensitive evidence, define the security purpose and whether the information is actually needed to achieve it.
Personal information
Identity investigations can expose names, email addresses, locations, sign-in history, device information and other personal information.
Confidential business information
Incident evidence may reveal projects, customers, contracts, intellectual property, financial information or internal communications.
Regulated information
Financial, health, government, legal and other regulated environments may impose additional handling and retention requirements.
Credentials and secrets
Passwords, API keys, access tokens, private keys, connection strings and recovery codes require especially careful handling.
Do not paste secrets casually
A prompt should never become a convenient place to store or move credentials.
Authentication artefacts
Tokens, cookies, session identifiers and authentication headers can be highly sensitive even when they do not look like passwords.
Email investigations
Email bodies and attachments can contain personal, commercial and legally sensitive information unrelated to the security question.
Endpoint evidence
Process commands, file paths, browser artefacts and user directories may expose sensitive local information.
Identity evidence
Sign-in logs, MFA events, application consent and directory changes can reveal sensitive user behaviour and privilege relationships.
Cloud evidence
Resource names, subscription details, configuration values and deployment information may reveal internal architecture.
Threat intelligence
Indicators may be shareable, but the internal context connecting an indicator to a customer, user or investigation may not be.
Separate indicator from context
An IP address or hash can have different sensitivity from the internal evidence showing where it was observed.
Prompt minimisation
Construct prompts around the specific question rather than including every available field.
Redact where appropriate
Remove irrelevant personal, secret or confidential values when they are not needed for the investigation.
Preserve identifiers when required
Do not redact an identifier that is essential to correlation, timeline analysis or evidentiary accuracy.
Use placeholders for training
Academy exercises, demonstrations and prompt testing should use synthetic names and identifiers where real data is unnecessary.
Avoid production data in experimentation
Do not use sensitive live incident evidence simply to test whether a prompt format works.
File uploads require governance
Uploaded investigation artefacts can contain substantially more information than the analyst intends to reference.
Inspect files before upload
Understand what a document, log, spreadsheet or text file contains before making it available to Copilot.
Malware artefacts
Suspicious files require established malware-handling procedures and should not be treated like ordinary documents.
Screenshots can leak data
Screenshots may expose names, tenant identifiers, email addresses, browser tabs, notifications and unrelated application content.
Copy-and-paste can leak context
Copied console output may contain tokens, tenant IDs, resource names and hidden context beyond the line the analyst wants to discuss.
Protect customer data
Customer incident information should remain subject to contractual, privacy and security obligations.
Protect employee data
Security investigations involving staff should follow organisational privacy, HR and legal requirements.
Protect legal material
Privileged or legally sensitive evidence may require special access, storage and distribution controls.
Need-to-know still applies
AI assistance does not remove the need to restrict sensitive investigations to authorised people.
Underlying RBAC matters
Copilot should only surface security information the signed-in user is authorised to access through connected Microsoft services.
Least privilege reduces exposure
Narrow permissions reduce the amount of sensitive information available to both the analyst and their Copilot sessions.
Plugin data paths
Every enabled plugin creates another data path that should be understood and governed.
Third-party plugins
Review what information a third-party plugin receives, where it processes data and which authentication method it uses.
Custom plugins
Document inputs, outputs, credentials, actions, ownership and approved data classifications before production use.
Microsoft 365 data
Access to Microsoft 365 services can expose highly sensitive organisational content and should be governed accordingly.
Promptbooks and sensitive data
Reusable promptbooks should define variables and instructions without embedding real credentials or confidential case data.
Agents and sensitive data
Agents should have clearly defined data sources, permissions, triggers and boundaries.
Generated responses can be sensitive
A response may combine multiple pieces of evidence into a more revealing summary than any individual source record.
Summaries need classification
Treat generated summaries according to the sensitivity of the evidence they contain, not according to the fact that AI produced them.
Executive reports
Business-facing summaries may still contain sensitive incident impact, affected systems and customer information.
Technical reports
Detailed investigation reports may contain indicators, usernames, commands, device names and internal architecture.
Distribution controls
Before sending a generated report, confirm the audience is authorised to receive the included evidence.
Do not assume anonymisation
Removing a person's name may not anonymise a record if device, role, location and event details still identify them.
Data residency and policy
Organisations should review applicable Microsoft service documentation and their own contractual and regulatory requirements for data handling.
Retention matters
Prompt, response, audit and investigation records may have different retention requirements.
Deletion does not replace governance
Deleting a session later does not justify exposing unnecessary sensitive information in the first place.
Audit access is sensitive too
Audit records and prompt-response visibility can reveal the same confidential information analysts were trying to protect.
Restrict governance reviewers
Only authorised personnel should be able to inspect sensitive prompt and response content.
Protect investigation integrity
Do not allow AI-generated wording to overwrite original evidence or analyst notes.
Keep original evidence
Generated summaries are derivative artefacts; retain source telemetry according to investigation and retention requirements.
Record transformations
Where important, document how raw evidence was filtered, summarised or transformed before it informed a decision.
Preserve timestamps
Time zones, event times and sequencing should remain accurate when evidence is summarised.
Preserve uncertainty
Do not transform 'possibly malicious' into 'malicious' merely because a generated summary sounds confident.
Validate quoted evidence
If a report contains exact commands, domains, IPs or other technical values, compare them with the source before distribution.
Beware hallucinated identifiers
Generated output can introduce plausible-looking but unsupported names, hashes, IP addresses or commands.
Use source-linked investigation
Whenever possible, keep important conclusions traceable to the underlying incident, alert, query or event.
Define prohibited prompt content
Policy should explicitly identify secrets or data categories that analysts must not enter without approved need.
Define approved use cases
Sensitive-data handling becomes easier when teams know which Copilot workflows are sanctioned.
Escalate uncertainty
When analysts are unsure whether data may be used, they should follow the organisation's privacy, legal or security escalation process.
Incident response exceptions
Emergency conditions may change operational priorities but should not silently eliminate accountability or evidence handling.
Breach investigations
Security incidents involving personal or regulated data may require legal, privacy or regulatory involvement.
Insider-risk investigations
These cases can contain especially sensitive behavioural and employment information and require tightly controlled access.
Executive investigations
Incidents involving senior staff should not lead to unnecessary expansion of access or informal sharing.
Third-party investigations
Customer, supplier and partner evidence may be governed by contractual restrictions.
Cross-border teams
Distributed SOCs should understand whether local requirements affect access to sensitive investigation data.
Training data hygiene
Screenshots and examples used in internal training should be sanitised unless real evidence is specifically authorised.
Demo environments
Use demonstration tenants and synthetic incidents for learning wherever possible.
Prompt libraries
Shared prompt libraries should contain reusable structures, not confidential investigation content.
Session naming
Avoid putting unnecessary confidential details into session titles or labels.
Handover discipline
Shift handovers should include enough evidence to continue the investigation without copying irrelevant sensitive content.
Ticketing systems
Generated Copilot output copied into tickets inherits the ticket system's access and retention model.
Chat and collaboration tools
Do not paste sensitive investigation summaries into broad channels merely because the text is convenient to share.
Email distribution
Confirm recipients before emailing AI-assisted incident reports.
Exports and downloads
Downloaded reports and copied responses can escape the controls of the original security portal.
Local storage
Avoid uncontrolled local copies of sensitive investigation artefacts.
Device security
Analysts handling sensitive Copilot sessions should use appropriately managed and secured devices.
Screen sharing
Live demonstrations can expose sensitive prompts, responses and browser context.
Logging and monitoring
Monitor Copilot administrative and user activity according to the organisation's governance model.
Review anomalies
Unusual use of sensitive data, plugins or file uploads should trigger investigation.
Data-loss prevention
Where available and appropriate, use organisational data-protection controls as part of the broader security architecture.
Sensitivity labels
Existing information-protection labels and handling rules should remain part of the organisation's data-governance approach.
Policy over convenience
If a workflow requires violating established data-handling rules, redesign the workflow rather than weakening the rule.
Human review before action
Sensitive evidence can affect employment, customer, legal and regulatory decisions; consequential conclusions require authorised human review.
Human review before publication
Public, customer or regulatory communications should never be released solely because Copilot produced a polished summary.
Measure sensitive-data incidents
Track accidental exposure, policy exceptions and corrective actions as part of Copilot governance.
Learn from near misses
A prevented disclosure or incorrectly broad prompt is an opportunity to improve training and workflow design.
Review prompts periodically
Sample approved workflows to confirm analysts continue using minimum necessary information.
Review plugin scope periodically
A plugin approved for one workflow may become unnecessarily broad as systems change.
Review permissions periodically
Sensitive-data access should shrink when job responsibilities change.
Final protection principle
Security Copilot should help analysts understand sensitive evidence without becoming a reason to expose more of that evidence than the investigation requires.
Example prompt-minimisation exercise
Agent Foskett investigation: “The screenshot said too much”
↓
He captured a screenshot of the investigation portal
↓
The PowerShell command occupied three lines
↓
But the screenshot contained much more
↓
The user's full name and email address
↓
A customer name in another incident
↓
The tenant identifier
↓
A Teams notification from HR
↓
And part of an API token visible in a browser tab
↓
None of it was needed to analyse the command
↓
Agent Foskett stopped the workflow before the image was reused
↓
The command and relevant process context were extracted instead
↓
The unnecessary information was removed
↓
The investigation continued with a focused evidence set
↓
The SOC added screenshot hygiene to its Copilot training
↓
The lesson was simple
↓
The sensitive data you expose accidentally can matter more than the data you intended to analyse
Sensitive-information checklist
| Stage | Question | Action |
|---|---|---|
| Purpose | Why is this information needed? | Define the security question first. |
| Access | Is the analyst authorised? | Confirm RBAC and need-to-know. |
| Minimisation | Is all supplied data necessary? | Remove irrelevant sensitive content. |
| Secrets | Are credentials or tokens present? | Exclude them unless explicitly required and approved. |
| Files | What else does the upload contain? | Inspect before use. |
| Plugins | Where will the data flow? | Use approved integrations only. |
| Output | Does the response contain sensitive evidence? | Classify and restrict distribution. |
| Validation | Are identifiers and conclusions accurate? | Compare with source telemetry. |
| Sharing | Who needs the report? | Send only to authorised recipients. |
| Retention | How long should it remain? | Follow organisational policy. |
Key takeaways
- Security investigations naturally contain sensitive personal, business and technical information.
- Use the minimum information necessary for the security question.
- Do not casually include passwords, tokens, keys or other secrets in prompts.
- Inspect screenshots, copied logs and uploaded files for unrelated sensitive content.
- Underlying RBAC and need-to-know principles continue to apply.
- Plugins and integrations create data paths that must be understood and governed.
- Generated summaries can themselves become sensitive information.
- Preserve original evidence and validate important technical identifiers.
- Use synthetic information for training and experimentation where real data is unnecessary.
- Restrict access to audit records containing prompt and response content.
- Apply organisational privacy, legal, contractual and regulatory requirements.
- Human review remains essential before sensitive conclusions are acted upon or distributed.
Related Agent Foskett resources
Continue Module 4 — Operational Security Copilot
Protecting sensitive information in Security Copilot
Security Copilot workflows should use minimum necessary information, least privilege, approved plugins, controlled file handling, evidence validation and organisational privacy and data-protection requirements.
Security Copilot prompts and confidential data
Analysts should understand the sensitivity of information included in prompts, uploaded files and generated responses, and should avoid unnecessary exposure of personal information, secrets and regulated content.
