The Copilot Problem: All Risk, No Reward

Microsoft has a Copilot problem. Talk to anyone about the AI they’re excited about, or the one they used this morning, and almost nobody mentions Copilot. ThreatDown’s data bears that out. Of the five most common AI tools tracked by our AI visibility tool, Microsoft’s flagship AI accounts for 57% of the footprint, yet it is by far the least used per endpoint.

What we can see, Redmond can see too: it’s installed almost everywhere, and hardly anyone uses it. The company’s answer is a new Copilot app that rolls chat, coding, document editing, and AI agents into a single “super app.” It hopes the new app will finally persuade more of its Microsoft 365 customers to pay for its AI tools.

Microsoft’s problem is getting people to use Copilot. Everyone else’s problem is the large and unwarranted attack surface lurking on their endpoints.

So Much Copilot, So Little Use

The gap is stark. Copilot averages just 15 events per endpoint per week. Claude, by comparison, averages 175.

The reason isn’t a mystery: Claude is pulled, while Copilot is pushed. Anthropic doesn’t sell an office suite or meeting software, so Claude tends to be installed by people who actually want to use it. Copilot, meanwhile, arrives whether anyone asks for it or not. The Microsoft 365 Copilot app, for example, installs itself automatically on business Windows machines running Microsoft 365 apps unless an admin opts out. It can appear the moment a company buys the suite.

What gets pushed is the free version. The full version, which works with users’ emails, files, and meetings, is a paid add-on, and Microsoft’s own figures suggest only about 7% of commercial Microsoft 365 seats have it.

Every Tool Is a Way In

Every piece of software on an endpoint is something an attacker can target. Security teams spend their days weighing what a tool is worth against the effort it takes to secure it. For a tool nobody uses, that calculation is easy: all cost, no benefit.

Worse, unused tools tend to be unwatched tools. Nobody owns them, nobody monitors them, and nobody asks whether they should be there.

In the past, businesses could perhaps live with a few forgotten apps on their endpoints, but in a world where AI can outperform humans at vulnerability discovery and supercharge attacks, that tolerance looks like a luxury. In the era of AI-first attacks, every tool must justify its place.

A Bigger Tool Is a Bigger Target

The new app takes Copilot from the generative AI era to the agentic: it can write code, create and edit real files in Word, Excel, and PowerPoint, and run agents that act on a user’s behalf. 

More capability means more code, more integrations, and more permissions—giving criminals more reasons to go after it, a bigger attack surface to target, and worse consequences if it’s successfully exploited.

Those capabilities aren’t free, though. Coding, agents, and the rest sit behind the paid license, with usage-based billing on top. So, for most organizations today, the free app stays exactly as it is: installed and ignored.

Microsoft is betting that will change. If it does, organizations that embrace the new app will at least have a reason to monitor and secure it properly. The danger is that Copilot’s unloved reputation persists, and its new capabilities aren’t matched by any new enthusiasm for using it. Organizations that pay for it will need to see its events per endpoint multiply to justify the cost of securing it. If they don’t, they’ll be paying for a powerful tool that nobody uses and nobody watches.

The Status Quo Is Over

This matters more now than it would have a year ago, and it will matter even more in another six months. AI agents are helping attackers increase the speed, scale, and sophistication of their attacks, and the industry knows it.

In August, Microsoft joined more than 120 companies, including OpenAI, Google, Anthropic, AWS, and CrowdStrike, in signing an open letter calling for a coordinated response to AI-powered cyberattacks. Its central message was that status quo security won’t be enough, and there isn’t time to waste. It urged organizations to raise their security standards and meet them with “the urgency and coordination of an incident that takes precedence over everything except critical business operations.”

No Room for Passengers

Unused or unknown AI tools offer a rich attack surface, and each one needs to justify its place.

• Know what’s there. Find out which AI tools are running on your endpoints, including the ones that aren’t supposed to be there.
• Ask if it’s worth it. For each tool, ask whether it’s being used, and whether it justifies the effort of securing it, and remove it if it doesn’t.
• Keep watching. New AI tools appear constantly, and employees aren’t waiting for IT’s permission to try them. Checking once isn’t enough.

Security has always been about reducing the number of ways in. With attackers moving faster than ever, there’s no more room for passengers.