Practice — 01
Data Intelligence & Discovery
You cannot protect, retain, delete or feed to AI what you have never counted. This practice produces the single most valuable artefact in governance: a complete, classified, continuously refreshed account of everything your organisation holds.
What the practice delivers
The full estate, one inventory
SharePoint, Teams, OneDrive and Exchange; Snowflake, Fabric, Dataverse and the data lakes; Box, Confluence, file shares and archive media. One inventory, one taxonomy, one owner of the truth.
Classification that holds up
Sensitivity and record types assigned by layered methods — pattern, context, trainable classifiers and human adjudication for the contested residue — then sampled and scored so accuracy is a published number, not a hope.
Risk, ranked
Not a heat map for a slide deck. A ranked register of concrete exposures — this repository, this data class, this audience — ordered by consequence, ready to hand to the Exposure & Access Control practice.
AI usage, surfaced
Which copilots, agents and models are already reading your data — sanctioned or otherwise — and what they can currently reach. Most clients are surprised. None regret knowing.
How an engagement runs
- Survey (weeks 1–2). Connectors deployed across the estate; first-pass discovery establishes scale, spread and the obvious concentrations of sensitive material.
- Classify (weeks 3–6). Taxonomy agreed with legal, privacy and records stakeholders; automated classification tuned against sampled ground truth until precision targets are met.
- Rank (weeks 6–8). The exposure register is built and priced in business terms: regulatory reach, breach consequence, discovery burden, AI readiness.
- Sustain (ongoing). The inventory refreshes continuously under Stewardship, so the map never again drifts from the territory.
Questions boards ask us
We already ran a discovery exercise two years ago. Why again?
A discovery exercise is a photograph; your estate is a river. Two years of sharing, migration and AI adoption make a static report an artefact of history. We build the inventory as living infrastructure, not a deliverable.
Does this require moving our data?
No. Discovery and classification run in place, inside your tenancy and your security boundary. Nothing is copied out to us — a point your privacy office will appreciate.
How does this relate to Microsoft Purview?
Purview supplies the classification engine wherever it reaches; our tooling and method extend the same taxonomy to the platforms it does not. You get one answer, estate-wide.