Securing the Modern Enterprise: A Practical View

A practitioner’s perspective

Before joining Protiviti, I spent nearly two decades at Microsoft in Security Consulting, working with enterprises on identity modernisation, cloud adoption, regulatory pressure and security transformation.

During that time, I saw the Microsoft security platform evolve from disconnected point solutions into a more integrated platform spanning security, identity, data and now AI. That shift changed security from a reactive add-on into something designed intentionally from the outset, and it continues to shape how I think about using the Microsoft ecosystem in a practical, governed way.

Security at the centre of transformation

Across industries, security has moved beyond being a standalone technical workstream. Today, it sits squarely in the middle of business transformation.

Organisations are modernising infrastructure, moving to the cloud, responding to regulatory pressure, simplifying operations and exploring AI, often at the same time. In that environment, the real question is not, “Which tool should we turn on next?” It is, “How do we move forward without increasing risk or uncertainty?”

The priority is aligning security to business transformation so it supports progress rather than slowing it down.

The fragmentation challenge

When I step into client environments, I rarely find a lack of security technology. What I see far more often is fragmentation.

Identity, data protection, security operations and AI initiatives often move in parallel but not together. Different teams own different pieces, governance is inconsistent and visibility is fragmented. Over time, that complexity creates challenges for security teams and uncertainty for leadership.

What leaders want is confidence: that access is governed appropriately, sensitive data is protected and shared intentionally, security operations are manageable and AI can be adopted safely.

As security practitioners and advisors, our role is to help bring those pieces together into a cohesive and sustainable approach.

Operating models, not products

One consistent lesson from working with my clients is that Microsoft Security delivers the most value when it is treated as an operating model rather than a collection of products.

In this model, identity becomes the control plane for trust and access, data protection and governance establish confidence in how information is handled and security operations focus on meaningful signal rather than alert volume. AI becomes part of the same conversation rather than a separate risk discussion. This is increasingly reflected in how platforms are packaged and adopted, with offerings like Microsoft 365 E7 combining the full E5 security and compliance foundation with an integrated AI stack as a single governed platform.

What matters is not the bundle itself, but what it signals: AI, identity, security, device management and data governance can no longer be treated as separate programmes. For example, governing AI use may require one team to manage access, another to define data protections and another to monitor activity. When those responsibilities stay too disconnected, risk management becomes fragmented. That is why security organisations may also need to adapt how they are structured and how skills are developed.

Identity, data and AI readiness

In our experience, identity and data are where many transformations either gain momentum or begin to struggle.

When identity processes are manual or inconsistent, everything downstream becomes harder. Access reviews slow down, privileged access becomes harder to manage and compliance turns into a series of one-off exercises.

Data protection is no longer just about compliance. It is about trust. If organisations do not know where sensitive data lives or how it is shared, security becomes reactive and AI initiatives slow. Identity and data readiness matter even more now. Establishing identity and data foundations that are secure, governable and sustainable creates a safer path to AI.

Simplifying security operations

Security teams are under constant pressure. Nearly every leader I work with says the same thing: more dashboards are not the answer.

The focus should be on simplifying security operations. And, as organisations adopt more AI and agent-based workflows, that also means improving visibility into what agents are doing, where they have access and how they are governed. One way to do this is through Microsoft’s AI-first, end-to-end security platform, with Agent 365 adding an important layer to observe, govern and secure agents.

What this means for leaders

For leaders, the takeaway is straightforward: the goal is to build the conditions for a secure, well-governed modern enterprise by treating identity, data governance, security operations and AI oversight as connected decisions.

Those evaluating next steps should start with five questions:

• Do we have a clear identity model for both people and agents?
• Do we understand where sensitive data lives and how it is shared?
• Can our security operations team distinguish meaningful signal from noise?
• Do we have governance in place before AI adoption scales?
• Are we building the skills needed to keep pace with evolving security demands, including AI?

If the answer to any of these is no, that is likely where the work should begin.

Additional resources

To go deeper on securing and governing agentic AI, these resources offer additional perspective:

Blog: Microsoft Agent 365 Brings Enterprise-Grade Control to Agentic AI

Webinar: Microsoft Agent 365: Governing Agentic AI at Enterprise Scale

To learn more about our Microsoft consulting services, contact us.