How Tampa General Hospital Safely Deployed M365 Copilot

As generative AI tools move faster than most organizations can govern them, healthcare providers face a particular version of that risk: AI systems designed to surface information can just as easily surface sensitive data that was never meant to be widely accessible. At Tampa General Hospital, CISO Jim Bowie and David Quigley, Manager of Identity Protection and Access Management, turned to Varonis to answer a question that couldn't wait — was it safe to greenlight Microsoft Copilot?

CHALLENGE

Years of Oversharing Across Thousands of SharePoint Sites

Generative AI tools make it easy for users to take a shortcut: rather than taking the time to figure out who should have access to a file, it's often simpler to just share it with the whole organization. Over time, that habit compounds, until everyone in the organization can potentially access sensitive files nobody meant to expose so broadly. When Bowie raised the question with Quigley, Quigley estimated it would take a couple of months to go across thousands of SharePoint sites and folders to analyze permissions and figure out who should have access to what — time the team didn't have once Copilot deployment came up for a decision.

SOLUTION

Answering the CISO in Days, Not Months

Bowie introduced Quigley to Varonis, whose dashboards let him analyze SharePoint permissions across the environment at a scale manual review couldn't match. Rather than the months Quigley had expected to need, Bowie gave him two weeks. What followed was faster still: the team reviewed close to 43,000 files and Quigley was able to report back to his CISO with a clear answer in seven days.

It really allowed us to go through close to 43,000 files, and me go back to my CISO in seven days and say, we're good.

With Varonis automation paired with the team's SOC and Managed Data Detection and Response (MDDR), issues that do surface can be addressed immediately rather than lingering as unresolved risk.

RESULTS

Confidence to Greenlight AI, and to Keep Pace with It

Bowie credits Varonis as the reason he could confidently recommend Copilot and future AI products through the hospital's AI Governance Committee. Without that visibility, he believes the organization would be stuck years behind, unable to move at the pace AI adoption demands. For Quigley, the value is in staying ahead of whatever comes next.

As long as we have Varonis, I feel that we'll be prepared for whatever Gen AI wants to throw at us, because we'll be able to look at that data, understand it, and be able to classify it and be able to mitigate any oversharing of permissions.

With Varonis in place, Bowie and Quigley can classify data, understand its exposure, and mitigate oversharing as new AI capabilities continue to roll out — turning what could have been a stalled initiative into a confidently governed one.