INFORMATION RISK & EXPOSURE REPORT
A monthly read on Microsoft 365 information risk — what's sensitive, who's moving it, where it's exposed, and what to fix first.
📅 Reporting period — June 2026SECTION 01 — KEY FINDINGS
Automated policies scan every file, message and share across Microsoft 365. This period, three patterns stood out.
Each of these is broken down by information category on the next two slides — high-severity incidents trace back to Financial, Legal, HR, Governance and Business data, while mass-download alerts concentrate heavily in Business and HR.
KEY FINDING 01 — DETAIL
Five information categories account for this period's high-severity volume — shown here against each category's full Low / Medium / High mix.
Financial data carries the highest risk concentration: 50.4% of flagged financial events are high-severity, versus 4.5% for Legal — the lowest-risk category despite having the second-largest volume.
KEY FINDING 03 — DETAIL
Unusually large download activity, flagged per information category this period.
Business and HR together drive 72% of all mass-download incidents (75 of 104) — the same two categories that also lead in overall data volume on the next slide.
SECTION 02 — WHAT IS YOUR INFORMATION
Total sensitive & personal information identified across Microsoft 365 this period, broken down by category.
Personal information alone makes up 49% of everything mapped this period, ahead of HR (68.5K) and Business (54.3K).
SECTION 02 — DETAIL
Top sub-types by record count within each information category.
SECTION 02 — PERSONAL INFORMATION
Regulated personal-data identifiers, and personal information that overlaps with another sensitive category — each split by Low / Medium / High severity.
Personal information crossing into Financial records is almost entirely high-severity (200 of 220 events) — a small volume, but the riskiest overlap on this slide.
SECTION 03 — WHERE INFORMATION LIVES
Share of all identified sensitive information, by hosting application.
OneDrive and SharePoint together hold 70% of sensitive data — personal drives and document libraries, not email, are where most exposure risk sits.
SECTION 04 — INFORMATION IN MOTION
Sharing events this period, by direction and information category. Darker cells mean higher volume.
| Shared by Employees | 1K | 1K | 2K | 768 | 2K | 3K |
| Shared to Employees | 2K | 2K | 3K | 2K | 3K | 4K |
| Shared to Organizations | 342 | 720 | 2K | 111 | 2K | 2K |
| Shared to External Contacts | 2K | 3K | 11K | 699 | 11K | 16K |
External contacts receive the heaviest sharing across nearly every category — including 16K Personal and 11K each for HR and Business — far above any internal channel.
SECTION 04 — DETAIL
Same four sharing directions, filtered to PDF files only.
Filtered · PDF files · June 2026SECTION 05 — RECOMMENDATIONS
Five actions, drawn directly from this period's data.
Turn on the playbook that asks users to justify activity the moment it crosses a high-severity threshold — covering the 3.9K incidents this period.
Auto-apply sensitivity labels (MPIP) to information as it's created or shared, prioritizing the Legal and Governance categories.
Business (42) and HR (33) account for 72% of this period's alerts — start there.
This is the largest single exposure channel for Personal (16K), HR and Business (11K each) — worth a dedicated DLP rule.
Weekly alerts already surface your highest-risk users — pair that list with a manager-level review this month.
SUMMARY
324.7K records mapped, four apps carrying nearly all of it, and a handful of categories driving almost every incident. The detail is in the slides — the priorities are on the page before this one.