Protect Sensitive Data In AI Chat Tools With Edge For Business And Purview

Microsoft commissioned Forrester Consulting to conduct a Total Economic Impact™ (TEI) study and examine the potential return on investment (ROI) enterprises may realize by deploying Edge for Business.¹ This abstract focuses on customers’ use of the Microsoft Purview inline data protections in Edge for Business and the value those protections deliver.

Forrester interviewed representatives from two organizations using the solution, including:

• A senior IT director at a US-based manufacturing organization with global operations and more than 45,000 end users.

• A director of IT at a US-based financial services organization with more than 1,000 end users.

Forrester also surveyed 314 decision-makers involved with their organizations’ enterprise browser strategies. This group included director-level and above respondents from organizations that used or did not use the Purview inline data protections in Microsoft Edge for Business.

With AI chat tools now available via browsers, business users are bringing consumer-grade and/or unsanctioned tools into the workplace to improve their productivity; however, this use may occur without adequate visibility or governance. Without enterprise-grade data protections, users may enter sensitive data into AI services, where it could be retained or used to improve models. This use can expose their organizations to financial, regulatory, strategic, and reputational harm. Although some broadly restrict AI chat tools, which limits AI enablement and user choice, organizations need a way to protect sensitive data across browser-based AI chat tools without such expansive restrictions.

The native Purview inline data protections in Microsoft Edge for Business help audit or block sensitive data in real time as end users submit text or file prompts to AI chat tools in the browser. In other words, prompts containing data that has been designated as sensitive are protected. Interviewees and survey respondents using these protections reported reduced data loss risk, greater IT and security efficiency, and better AI experiences for end users.

Investment Drivers For Adopting The Purview Inline Data Protections In Edge For Business

The interviewees’ and survey respondents’ organizations adopted the Purview inline data protections in Edge for Business to protect sensitive data while enabling the existing, widespread browser-based AI chat activity. Before adoption, 50% of survey respondents estimated that more than 30% of their organization’s users were using unsanctioned AI chat tools in Edge for Business. Separately, 78% estimated that unsanctioned tools accounted for more than 30% of all AI chat tool activity, and 47% reported that their organizations encouraged end users to use approved tools but did not block others.

As a result of this unregulated AI chat tool use, these organizations struggled with several challenges, including:

• Data loss risks. As browser-based AI adoption increased, interviewees’ and survey respondents’ organizations became concerned about the information users might share through AI chat tools, despite users’ good intentions. Sixty-seven percent of survey respondents “Agreed” or “Strongly agreed” that their organizations were at risk of exposing sensitive data through these tools. Additionally, 75% of survey respondents “Agreed” or “Strongly agreed” that users were unsure what data they could safely share with AI chat tools. Examples included internal documents, customer information, financial records, intellectual property, and other sensitive content. As a result, organizations faced unnecessary financial, regulatory, contractual, strategic, and reputational risks.
  For example, the senior IT director in manufacturing said, “Our engineering teams’ intentions with AI chat tools were good.” However, they explained, “There were incidents where employees, while not acting maliciously, shared proprietary company information such as product designs.”

• Lack of visibility into browser-based AI chat tools. Interviewees’ and survey respondents’ organizations lacked visibility into end users’ prompts, uploads, and outputs. Among respondents reporting actual or potential sensitive data exposure, 67% cited limited visibility into data being shared with unsanctioned AI chat tools and the resulting outputs. Among respondents reporting governance challenges, 65% cited limited visibility into how end users used AI chat tools. Additionally, 57% reported difficulty identifying the use of unsanctioned AI chat tools. The director of IT in financial services said, “We were not sure what information exchanges were happening between employees with access to sensitive data and some of those tools.”

• Inefficient and ineffective IT and security work. Because of limited visibility into browser-based AI activity, interviewees said their organizations’ IT and security teams struggled to efficiently address associated risks. Although they recognized opportunities to improve, 44% of survey respondents “Agreed” or “Strongly agreed” that they faced operational inefficiencies preventing them from doing so. The senior IT director in manufacturing said: “The team was less efficient. They did not have the tools to be able to even begin to manage all this. There were more people doing manual, reactive auditing.”

• End-user AI enablement challenges. Interviewees and survey respondents said their organizations struggled to protect sensitive data while enabling end users to benefit from browser-based AI chat tools. Sixty percent of survey respondents “Agreed” or “Strongly agreed” that balancing AI chat tool access with security, compliance, and data protection was difficult. An additional 34% of survey respondents “Agreed” or “Strongly agreed” that their organizations were under pressure to expand end-user access to browser-based AI chat tools.
  Interviewees described experiences ranging from broad AI access to complete restrictions on AI chat tool use. However, they recognized that completely banning AI was often impractical and could conflict with broader business objectives. The director of IT in financial services pointedly asked, “How do you enforce responsible use of AI without banning AI altogether?” The senior IT director in manufacturing said: “We want people to use the AI chat tools because we want operational efficiencies. So how can we do that in a secure manner?” As a result, these organizations sought the necessary education, policies, and technology that would enable responsible AI use.

Purview Inline Data Protections In Edge For Business: Key Features

The interviewees’ and survey respondents’ organizations chose to adopt the Purview inline data protections in Edge for Business for the following reasons:

• Protect against data loss with greater visibility and auditability. Interviewees and survey respondents wanted to address data loss challenges by protecting sensitive data in real time and giving IT and security teams visibility into browser-based AI usage. Relevant key features that drove the adoption decision for survey respondents included being able to prevent sensitive data from being shared (69%), strengthening security hygiene and posture for AI interactions in the browser (56%), and being able to audit prompts and identify risky AI interactions (45%).

• Easily guide end users to safe use. Survey respondents said being able to reduce shadow AI risk without broadly restricting AI access (65%) and the ability to enable user choice without sacrificing data protection (33%) were key factors in their decision. Interviewees said their organizations valued the ability to warn, block, and redirect users to Microsoft 365 Copilot, which includes enterprise data protection, while protecting against data loss from unsanctioned AI chat tools. This went beyond internal education and training, which interviewees said was not enough. The director of IT in financial services said their goal was “encouraging responsible use of AI rather than banning it.”

• Integrate with the Microsoft ecosystem. Interviewees said their organizations had already invested in Microsoft 365 E3, E5, and E7 and had adopted Edge for Business. As a result, they viewed Purview inline data protections as a way to address key challenges while extending the value of existing investments. The senior IT director in manufacturing elaborated, “We decided to use Microsoft Edge for Business specifically because within the Microsoft system, all these tools work together as an overall platform for governance and cybersecurity.” Key adoption factors for survey respondents included integration with the broader Microsoft ecosystem (39%) and the ability to enforce existing Purview data classifications when users interacted with AI chat tools in the browser (37%).

Key Results Of Adopting The Purview Inline Data Protections In Microsoft Edge For Business

The results of the investment for the interviewees’ and survey respondents’ organizations include:

Reduced risk of data loss via browser-based AI chat tools. By adopting Purview inline data protections in Edge for Business, interviewees and survey respondents reported the following security benefits:

• Protected sensitive data and prevented data loss due to unsanctioned AI use. Interviewees said their organizations reduced the risk of data leaks while enabling greater AI use. More consistent controls helped prevent data exfiltration and accidental data leaks. The senior IT director in manufacturing said, “We have reduced our risk exposure compared to using a standard browser without Purview.” Seventy-nine percent of survey respondents “Agreed” or “Strongly agreed” that Purview inline data protections helped protect sensitive data and prevent data loss from unsanctioned browser-based AI chat tools. They also identified several capabilities as “Effective” or “Highly effective” in delivering this benefit, including auditing prompts and file uploads (81%) and blocking sensitive prompts and file uploads (73%).

• Increased visibility into browser-based AI activity. As browser-based AI use increased, interviewees said they valued greater visibility into how users were using these tools. The director of IT in financial services said, “With Purview, we have visibility into both AI adoption as well as user behavior around data risk.” The senior IT director in manufacturing said, “We now have the capability to log, and we can tell what people are doing.” Additionally, 57% of survey respondents said Purview inline data protections in Edge for Business were “Effective” or “Highly effective” at providing visibility into risky AI interactions.

• Gained confidence. As a result of greater visibility, policy enforcement, and improved governance capabilities, interviewees said they were more confident managing AI-related risks and expanding AI adoption across their organizations. Among survey respondents, 69% “Agreed” or “Strongly agreed” that Purview inline data protections increased confidence in addressing data loss from unsanctioned browser-based AI chat tools.

Improved IT and security efficiency. Interviewees and survey respondents said that improved data protection and visibility helped IT and security teams work more efficiently and save on costs by:

• Spending less time investigating potential or actual AI-related data leaks. Interviewees said their organizations conducted fewer investigations after adopting Purview inline data protections in Edge for Business. One interviewee described replacing manual, reactive auditing with real-time prompt evaluation, logging, and policy enforcement. The director of IT in financial services said, “We spend less time monitoring, pulling reports, and analyzing.” Thirty-five percent of survey respondents “Agreed” or “Strongly agreed” that reducing shadow AI-related incidents resulted in time savings.

• Reducing the effort to safeguard against unsanctioned AI use in the browser. In addition to having fewer incidents to investigate, interviewees said their IT and security teams worked more efficiently. Forty-five percent of survey respondents “Agreed” or “Strongly agreed” that Purview inline data protections reduced the effort required for IT and security teams to safeguard against shadow AI. These respondents reported an average efficiency gain of 18%.

• Reducing the operational complexity and costs associated with third-party solutions. Interviewees said that using Microsoft solutions within their existing ecosystem was more efficient and cost-effective than using third-party tools. The director of IT in financial services said, “If we standardize on Edge, then the benefit is reduced operational complexity within our tech stack and IT.” The senior IT director in manufacturing said, “You have a direct cost reduction from not only avoiding additional licensing costs but also reducing the staffing required to maintain those tools.” Forty-seven percent of survey respondents “Agreed” or “Strongly agreed” that these benefits encouraged their organizations to standardize, or continue standardizing, on Edge for Business as their default browser. Respondents expected this standardization to create additional efficiency gains. For additional details, please reference: New Technology: The Projected Total Economic Impact Of Microsoft Edge For Business.

Improved end-user experience and AI enablement. Rather than choosing between broad AI restrictions and unrestricted access, organizations implemented governance controls that enabled responsible AI adoption at scale and were able to:

• Safely support and expand AI chat tool use in the browser. Interviewees said Purview inline data protections in Edge for Business helped their organizations achieve goals that had previously been difficult to balance. They were able to support AI chat tool use while protecting against data loss. As a result, users and the organization benefited. Sixty-eight percent of survey respondents “Agreed” or “Strongly agreed” that their organizations enabled user choice in AI chat tools while maintaining data protection policies. Additionally, 68% of survey respondents said Purview inline data protections were “Effective” or “Highly effective” at enabling AI chat tool use without broadly restricting access. One survey respondent said, “Edge for Business ensures the right balance between secure AI implementation and employee productivity.”

• Deliver a positive end-user experience. In addition to safely expanding AI chat tool use in the browser, interviewees’ and survey respondents’ organizations delivered a more positive end-user experience. Fifty-seven percent of survey respondents “Agreed” or “Strongly agreed” that Purview inline data protections in Edge for Business effectively directed users to Microsoft 365 Copilot, which includes enterprise data protection, when sensitive data was involved. Interviewees said this guidance created a more positive user experience. Users were better protected when using AI chat tools and felt more confident doing so. This helped encourage responsible and productive AI use. The senior IT director in manufacturing said, “With Microsoft Edge for Business, it is a more seamless end-user experience.”