Picture this: A 60-person creative agency deploys Microsoft Copilot with multi-factor authentication enabled. The IT manager feels confident. “We’re secure,” he tells leadership. Sixty days later, a departing account director downloads 200 unreleased campaign assets, client strategy decks, and proprietary branding guidelines in two hours using Copilot’s search capabilities. The agency only discovers it three days