A Third of Revenue on the Line: Cascade’s High-Stakes Compliance Mandate

Cascade Environmental (Cascade), the leading field services contractor for drilling and remediation in the United States, faced a critical inflection point. With 30 offices across the U.S. and a small but agile IT team, Cascade needed to ensure that the sensitive data tied to its field operations remained protected as it prepared to introduce Microsoft 365 Copilot to all departments. The stakes were high.

That’s a third of the company’s revenue dependent on safeguarding CMMC-regulated data, such as job site reports and worksite assessments, before any AI rollout could begin.

Challenge: Sensitive Data Leaks Loomed as Copilot Rolled Out

To validate their readiness, Cascade worked with Opsin to simulate Copilot behavior across SharePoint, Teams, and OneDrive. The results were indicative:

Over 70% of Copilot-style queries returned sensitive information, including content regulated under CMMC.

The exposure wasn’t malicious—it was structural. Years of organic SharePoint growth and inconsistent permissions (such as “Everyone Except External Users”) had created an invisible attack surface, one that could be easily surfaced through natural language prompts.

Solution: Oversharing Detection and CMMC-Grade Remediation with Opsin Security

Cascade partnered with Opsin Security to assess and mitigate the risk of exposing sensitive CMMC-regulated content to AI tools like Microsoft 365 Copilot. With compliance tied directly to a third of Cascade’s revenue, it was critical to gain visibility and enforce the right guardrails before enabling AI across their environment.

Opsin’s platform provided deep visibility into the Microsoft 365 environment—including SharePoint, Teams, and OneDrive—and helped Cascade address permission sprawl, oversharing, and inconsistent governance.

Most importantly, Opsin enabled Cascade to proactively secure its data before rolling out AI:

CMMC-Centric Risk Discovery via Proactive Risk Assessment

Opsin’s Proactive Risk Assessment surfaced high-risk sites, libraries, and folders where CMMC-regulated information could be accessed by Copilot. The Proactive Risk Assessment helped identify locations where job site assessments, worksite data, and other sensitive operational documents might be unintentionally exposed.

Permission Remediation for “Everyone Except External Users”

Opsin uncovered widespread use of the permissive “Everyone Except External Users” configuration on SharePoint sites and document libraries. The platform guided Cascade through a secure, structured workflow to replace those permissions with Entra ID dynamic groups—ensuring proper access control without disrupting productivity.

Issue-Specific Fixes Without IT Bottlenecks

Opsin delivered actionable remediation workflows for both the IT team and departmental site owners. This empowered Cascade’s lean IT staff to delegate permission clean-up across business units, while maintaining centralized oversight.

Policy-Aware Copilot Readiness

With proper access controls and content-level security labeling in place, Cascade could confidently begin its Copilot rollout—knowing sensitive content wouldn’t be accidentally surfaced or leaked via AI queries.

Outcomes: Risk Remediated, Copilot Ready to Scale

With Opsin, Cascade moved from uncertainty to confidence—securing critical data, aligning with CMMC requirements, and unlocking the ability to scale Microsoft 365 Copilot company-wide.

Looking Ahead: A Culture of Responsible Innovation

As Cascade continues its phased rollout of Microsoft 365 Copilot, the groundwork laid by Opsin gives them the freedom to explore LLM use cases—without compromising security or compliance.

Cascade is now focused on defining clear, enforceable AI usage policies and continuously monitoring Copilot activity through Opsin’s continuous monitoring model, ensuring access, behavior, and data visibility remain aligned with business needs and regulatory obligations.