A comprehensive 12-month analysis of Microsoft 365 data security — tracking information exposure, risk trends, and actionable insights across your organization.
EXECUTIVE SUMMARY
12-month overview — July 2025 – June 2026
HOW TO READ THIS REPORT
This report spans 12 months. Depending on what is being counted, that range is shown two different ways — month by month, or added up.
Things that exist — data volume, record counts, headcounts. These are point-in-time snapshots, so we plot each month as its own bar to show how the number moved across the twelve months.
Things that happened — incidents, shares, exposures. These are activity counts, so we add every month together into one 12-month total. The monthly build-up is always shown alongside it.
SECTION 01 — THE PERIOD AT A GLANCE
One bar per month; dashed lines mark the monthly average.
Every signal moved up across the twelve months. Mass downloads grew fastest (+167%) against +59% for information volume — incidents are outpacing the estate they are detected in.
SECTION 01 — KEY FINDINGS
One of these is a headcount trend; two are accumulated activity totals — notice how each is presented differently below.
Both incident types grew across the twelve months: high-severity incidents rose from 1,583 in Jul to 3,900 in Jun, and the rate per 1,000 records rose +55% — incidents are growing faster than the information they are detected in. The category breakdown for each follows on the next two slides.
SECTION 01 — QUARTER BY QUARTER
Entity counts at quarter end; event counts accumulated per quarter.
| Signal | Q3 2025 | Q4 2025 | Q1 2026 | Q2 2026 | Change |
|---|---|---|---|---|---|
Information volumeas of quarter end | 215.3K — | 239.2K ▲ +11.1% | 274.2K ▲ +14.6% | 324.7K ▲ +18.4% | +50.8% Q3'25 → Q2'26 |
Top risky usersas of quarter end | 123 — | 133 ▲ +8.1% | 145 ▲ +9.0% | 168 ▲ +15.9% | +36.6% Q3'25 → Q2'26 |
High-severity incidentsΣ per quarter | 5.1K — | 6.3K ▲ +23.3% | 8.1K ▲ +27.7% | 10.6K ▲ +31.4% | +106.8% Q3'25 → Q2'26 |
Mass-download incidentsΣ per quarter | 130 — | 166 ▲ +27.7% | 207 ▲ +24.7% | 283 ▲ +36.7% | +117.7% Q3'25 → Q2'26 |
External sharing eventsΣ per quarter | 557 — | 722 ▲ +29.6% | 913 ▲ +26.5% | 1.2K ▲ +31.4% | +115.4% Q3'25 → Q2'26 |
High-severity incidents rose in every quarter: 5.1K in Q3'25 → 10.6K in Q2'26 (+107%). Mass downloads went from 130 to 283 over the same quarters. Small coloured badges compare each quarter with the one before it; the first quarter has no earlier quarter in this report.
KEY FINDING 01 — DETAIL
Each bar is the accumulated total for the 12 months. Segment shading shows how each quarter contributed to it.
Business (10.6K) and HR (9.3K) together account for 66% of all accumulated high-severity incidents over the twelve months. Every category shows the same shape — for Business, 17% in Q3'25, 21% in Q4'25, 27% in Q1'26, 35% in Q2'26.
KEY FINDING 03 — DETAIL
Each bar is the accumulated total for the 12 months. Segment shading shows how each quarter contributed to it.
Business (317) and HR (250) together account for 72% of all accumulated mass-download incidents over the twelve months. Every category shows the same shape — for Business, 17% in Q3'25, 21% in Q4'25, 26% in Q1'26, 36% in Q2'26.
SECTION 02 — WHAT IS YOUR INFORMATION
Record counts are a snapshot, not an activity — so every month is plotted on its own rather than summed.
Total information volume grew +59.4% across the twelve months (203,674 → 324,700), at a near-identical rate in every category — consistent with broader Microsoft 365 estate coverage expanding through the period rather than one category spiking.
SECTION 02 — DETAIL
Top sub-types by June record count. The small bars show the same Jul → Jun shape for each line.
SECTION 02 — PERSONAL INFORMATION
These are event counts — each total below is the 12-month accumulated sum, with its Low / Medium / High split summed the same way.
PII activity accumulates to 49,611 events across the twelve months — by far the largest single pool, and 14.7% of it (7,270 events) is high-severity. Personal information crossing into Financial records is almost entirely high-severity (1,546 of 1,699).
SECTION 03 — WHERE INFORMATION LIVES
Distribution of total volume across apps, shown as a 100% stack for each month so any shift is visible.
OneDrive's share grew from 33.9% in Jul to 38.8% in Jun while Exchange's share declined (33.1% → 29.0%) — a slow but consistent shift toward personal drives as the twelve months progressed.
SECTION 04 — INFORMATION IN MOTION
Accumulated sharing events for the full twelve months, by direction and information category.
| Shared by Employees | 7.7K | 7.7K | 15.3K | 6.0K | 15.3K | 23.3K |
| Shared to Employees | 15.3K | 15.3K | 23.3K | 15.3K | 23.3K | 31.0K |
| Shared to Organizations | 2.6K | 5.7K | 15.3K | 858 | 15.3K | 15.3K |
| Shared to External Contacts | 15.3K | 23.3K | 84.9K | 5.4K | 84.9K | 123.6K |
Across the full twelve months, external contacts accumulated 123.6K Personal and 84.9K each for HR and Business shares — by a wide margin the largest accumulated exposure channel, at 57% of all sharing events.
SECTION 04 — DETAIL
Same four sharing directions, filtered to PDF files, accumulated across the twelve months. Underlines show each category relative to the largest in its card.
SECTION 05 — RECOMMENDATIONS
Five actions, drawn from the twelve months' accumulated activity and monthly trends.
High-severity incidents went from 1,583 in Jul to 3,900 in Jun. If the Apr–Jun pace holds, the next month opens near 4.3K without intervention.
Business (317) and HR (250) account for 72% of the 786 accumulated incidents — start review there.
Information volume grew +59% over the twelve months (203,674 → 324,700). At the latest pace of +6.0% a month, volume doubles in roughly 12 months.
This channel accumulated the largest exposure totals — 123.6K Personal, 84.9K HR and 84.9K Business — 57% of all sharing events. Worth a dedicated DLP rule.
The flagged-user count grew +44% across the twelve months (117 → 168) — review the roster as it changes, not only at the reporting checkpoint.
SUMMARY
324.7K records as of June 30 — up 59.4% over the twelve months. 30.1K high-severity incidents and 786 mass-download incidents accumulated across Jul 2025–Jun 2026.