How a multi-site global manufacturer turned storage pressure into a business-led plan to identify, classify and protect its most valuable information.
HIGHLIGHTS
- Environment: Frontline teams, production and OT systems alongside Microsoft 365
- Data at risk: Product designs, manufacturing methods, customer specifications and commercially sensitive information
- Starting point: Limited visibility, inconsistent classification and legacy data
- Technology: Microsoft 365, SharePoint, OneDrive and Exchange Online, with Microsoft Purview capabilities assessed and recommended as part of the roadmap
OVERVIEW
For a global manufacturer with more than 10,000 employees, what started as a concern about growing volumes of data quickly turned into a bigger conversation about risk, visibility and ownership. The organisation knew it had a growing data problem, but lacked the visibility needed to quantify its scale, communicate the risk effectively to the leadership team and board, or build a compelling case for investment. Having qualified for Microsoft funding, it engaged Quorum Cyber for a Data Security Workshop: a structured assessment combining technical discovery and stakeholder sessions to identify sensitive information, expose risk and define a practical protection roadmap. The exercise showed that the issue went far beyond capacity. The organisation needed a business-led approach to understand what data mattered most, prioritise risk and protect critical information consistently.
THE CHALLENGE
A complex information estate from years of accumulated legacy data
As the organisation adopted cloud services, large volumes of historical content were migrated into Microsoft 365, often without being reviewed, archived or rationalised first. This resulted in duplicate and outdated content, oversharing and inconsistent permissions. The organisation also lacked a common definition of its ‘crown-jewel’ information or a way to reflect how sensitivity changed over time. Although IT could deploy controls, business teams needed to set priorities, leaders needed evidence of the commercial and operational impact, and the organisation needed a sustainable model for managing protection. What initially appeared to be a storage issue was, in reality, a broader data governance, risk and ownership challenge.
THE SOLUTION
A collaborative workshop to build a streamlined data security strategy
Working with the manufacturer, Quorum Cyber brought together technical findings and business insight to define what needed to be protected. The workshop uncovered where sensitive information existed across Microsoft 365, while conversations with business leaders identified the intellectual property, manufacturing know-how and other information that gave the organisation its competitive advantage. By agreeing what mattered most, and what level of risk the business was prepared to accept, the manufacturer was able to build a classification and protection strategy that reflected its own priorities rather than a generic set of controls. The findings informed an up-to-date classification model, an executive-ready business case and a phased roadmap for Microsoft Purview controls, including sensitivity labels, encryption, data loss prevention and controlled sharing.
DELIVERY PRINCIPLE
Focus on simplicity: crawl, walk, run
Quorum Cyber recommended observing how information was used before introducing prompts and targeted safeguards, then gradually strengthening protection as users and business owners became familiar with the new approach. This gave the customer a practical route to reduce risk without imposing disruptive controls too quickly.
THE OUTCOMES
A practical plan to guide next steps
- Clearer visibility: a fuller view of sensitive information, access and sharing across Microsoft 365.
- Sharper priorities: agreement on the data that mattered most and where investment should focus first.
- Business ownership: a shared classification model that connected technical controls to how teams create, use and value information.
- Executive backing: evidence that made the commercial, contractual and operational risk easier for senior leaders to understand and act on.
- A practical roadmap: a phased protection plan designed to improve security without disrupting day-to-day work.
“We went into the workshop thinking we had a storage problem. What came back was a much clearer picture of our real exposure – where sensitive information was sitting, who could get to it and what we needed to tackle first.”
— Data Protection Officer, manufacturing organisation
Why Quorum Cyber
Quorum Cyber brought together three capabilities the customer needed: practical Microsoft expertise, an understanding of manufacturing risk and the ability to communicate technical findings in business terms. The team linked Microsoft Purview controls to the realities of intellectual property, production, supply-chain and customer risk, giving senior stakeholders a clear reason to act. Crucially, Quorum Cyber could support the full journey, from discovery and business case development through deployment, optimisation and ongoing management.
“Quorum Cyber didn’t just hand us a technical report; they really understood our business and helped us explain the risk in a way our leadership team could act on. That gave us the evidence to move the conversation forward.”
– Data Protection Officer, manufacturing organisation
The next step
The engagement gave the manufacturer a practical foundation for sustained improvement. It is now considering a managed data security service to tune Purview policies, reduce false positives, monitor activity and investigate alerts. This would provide continuous specialist support, including 24/7 coverage, without requiring a dedicated in-house team. The programme also laid the groundwork for secure AI adoption, giving the organisation the visibility, governance and guardrails needed to use AI with greater confidence while maintaining control of its most sensitive information.
Find out how a fundable data security workshop can help your organisation uncover exposure, build the business case and prioritise the right controls.
