Evidenced
Structured systems
HR, finance and CRM are inventoried, owned and access reviewed.
AI data governance and audit readiness
Proving what you cannot see.
Classification, exposure evidence and control over the unstructured information your policy already covers on paper.
Free assessment: a 30-minute setup, read-only, results in one week. Demo: 30 minutes, tailored to your environment.
The question
Where is our sensitive information, who can reach it, and can we prove it?
Most organizations can answer that for a third of their estate. The rest is answered from policy rather than evidence.
Partial
Regulated identifiers
Pattern matching finds card, health and ID numbers. Nothing else.
Not evidenced
Everything else
Contracts, board papers, strategy, salary files, and the files AI creates from them.
The control gap
Every classification policy rests on four assumptions.
What the policy assumes
What the estate actually looks like
Owners classify documents as they create them
Most files are never labeled, and nobody measures how many
Sensitivity labels stay accurate over time
A label stops being true the moment a file is copied or edited
Access reviews cover the risk
Reviews cover systems and groups, not the content inside them
Third-party exposure sits in the register
The register lists vendors, not the files they can reach
Why it persists
Business-critical content has no fixed pattern.
A board memo has no RegEx.A salary file has no keyword.An acquisition draft has no label.
What cannot be matched cannot be counted. What cannot be counted cannot be evidenced.
The accelerant
AI turned a data problem into an audit problem.
Assistants answer at the permission level of whoever asks them. Content that was quietly overshared becomes content that is actively surfaced, at speed, with nothing in your register to show for it.
The Cognni approach
Classification that produces evidence, not effort.
No rules to write
AI reads each document the way a reviewer would: purpose, sensitivity, business context. No RegEx, no keyword lists, no asking owners to tag anything.
A record you can hand over
Every file inventoried and categorized, with owner, exposure path and date. An artifact an auditor can test, rather than a policy statement.
Findings that close
Labels and access boundaries applied automatically, so a finding is remediated rather than queued behind someone else's project.
Proof
What one customer found in week one.
1.4M
files scanned
In the first week at a 15,000-employee food manufacturer. Zero agents deployed, zero user disruption.
180,000
business-critical files surfaced
Classified as strategy, legal, HR or financial. None were visible to the existing controls.
2,300
exposed and overshared
Open to the whole organization or shared externally, each mapped with its full exposure path.
Days
to remediation
Labels and access boundaries applied automatically, before the first monthly review.
In the audit
The difference is what you can put on the table.
Today, most teams can show
- A classification policy
- A labeling standard nobody measures
- A register of systems, not content
- DLP exception reports for identifiers only
With Cognni, you can show
- A dated inventory of unstructured information
- Category and sensitivity assigned per file
- Who can reach each one, and by which path
- Remediation applied, with a record of it
Where it sits
It does not replace your Microsoft stack. It supplies it.
Cognni
Reads the content, creates the label, produces the inventory
Purview
Enforces labels. Cognni creates them for content Purview cannot pattern-match.
DLP
Acts on what it can identify. Cognni widens what counts as identifiable.
Your reporting
Receives a dated, testable inventory instead of a coverage estimate.
What we need from you: one 30-minute session with whoever owns Microsoft 365. The connection itself takes under 15 minutes. Read-only, agentless, scoped to the sources you choose. Nothing for your users to do.
Questions
Three questions worth asking any vendor.
Where does our data go?
The assessment is read-only and agentless, limited to the sources you nominate, and Cognni does not store the content of your files. Cognni is SOC 2 and ISO 27001 certified and HIPAA compliant. Ask every vendor to put that in writing before a pilot.
Why not Purview alone?
Purview enforces the labels it is given. Something has to create the label for content with no pattern. That is the gap Cognni fills.
Who has to sponsor it?
Compliance defines the categories and owns the output. IT grants read access once. Budget usually sits under AI governance rather than security tooling.
AI Exposure Assessment
Find out what your AI has already seen.
Every day, AI assistants answer from files nobody has labeled. In one week, the free assessment shows which sensitive data Microsoft 365 Copilot, ChatGPT Enterprise and Claude Enterprise can reach across your organization, and what to fix first.
Free assessment: a 30-minute setup, read-only, results in one week. Demo: 30 minutes, tailored to your environment.