Close-up of a server unit in a blue-lit data centre

Sort the data before the AI: what CIOs can learn from Catholic Healthcare and AvePoint

Most conversations about Microsoft Copilot start with licences and use cases. The more useful conversation starts somewhere less exciting: where your data lives, who can open it, and whether you could get it back if something went wrong. A recent customer story from AvePoint shows why that order matters, and it comes from a sector where getting data wrong has real consequences for real people.

The organisation and the problem

Catholic Healthcare is a not-for-profit aged care provider in New South Wales and southeast Queensland. According to AvePoint's case study, it runs 41 aged care homes and 13 retirement villages, along with home and community services, and supports around 13,000 older Australians with 6,000 employees and 700 volunteers.

Like many organisations, it wanted to see whether Copilot could take routine admin off people's plates. But it holds sensitive information about residents, clients and staff, so the IT team wanted confidence in the data estate first. That meant knowing where information sat across Microsoft 365, who had access to it, whether permissions matched what the business actually needed, and whether data was protected and recoverable.

Moet Sela, Senior IT Operations Manager, put it simply in the case study: "Visibility was the key to ensure that the implementation of AI was accurate and correct and delivered the outcome that was required."

What they did

Catholic Healthcare already worked with AvePoint on backup and data protection for Microsoft 365. As it explored Copilot, it extended that relationship to cover governance. Using the AvePoint Confidence Platform, the team reviewed data access and sharing practices while strengthening backup, protection and archiving.

The order is the point. Copilot can surface anything a user is allowed to see, so any oversharing that has built up over the years becomes much easier to find once an assistant is doing the searching. Cleaning that up before rollout is far cheaper than discovering it afterwards.

CIO Brett Reedman made a point that many technology leaders will recognise: "People quite often jump to the conclusion that they need to implement a specific technology without understanding the true problem they're trying to solve. AvePoint really partnered with us. They took the time to understand the challenges we were facing and helped identify the gaps that existed within our environment."

The results

The case study reports that Catholic Healthcare now has greater oversight of data access, permissions and sharing across Microsoft 365. AvePoint's tools protect around 71 TB of organisational data, with recovery, archiving and long-term information management in place.

On the AI side, the organisation reported about 2,800 hours of productivity gains in a single month, as staff spent less time on routine admin and communications.

Sela summed up the approach: "Visibility, protection, and archiving reduce our risk profile when implementing AI across the organisation."

Where this is heading

AvePoint has since broadened what it offers. On 27 October it announced the AvePoint Trust Platform, built around four areas it calls Observe, Protect, Govern and Optimize. It covers discovering sanctioned and shadow AI agents, spotting overshared, stale or unlabelled content before an agent finds it, giving each agent an owner and a policy, and backing up and restoring agents themselves, including Copilot Studio agents. The October platform update adds agent visibility across several AI providers.

The same announcement quotes AvePoint's State of AI 2026 Report, which found that 88.4% of organisations had at least one AI agent related security incident in the previous 12 months. Whatever your own numbers look like, the direction of travel is clear: as more agents act on company data, knowing what they can reach becomes a basic part of running IT.

What CIOs can take from this

Start with visibility, not licences. Before a wide Copilot rollout, find out where your sensitive data sits and who can open it. If you can't answer that for your most important sites and libraries, that is the first piece of work.

Fix permissions before the assistant finds them. Old sharing links, broad groups and inactive accounts are easy to ignore until an AI tool starts pulling content from them. Treat permission clean-up as part of the AI project, not a side task.

Make recovery part of the plan. Catholic Healthcare treated backup and archiving as part of its AI readiness, not a separate topic. As agents start changing content and running workflows, being able to roll back matters more, not less.

Measure the benefit in plain terms. Hours saved on admin is a number a board understands. Agree how you will measure value before you start, so the conversation after rollout is about results rather than opinions.

Choose partners who ask about the problem first. Reedman's point applies well beyond this project. The best results tend to come from partners who take time to understand your environment before recommending a tool.

Final thought

Catholic Healthcare's story is not really about a product. It is about doing the unglamorous groundwork so that AI can be switched on with confidence. For CIOs under pressure to show progress on AI, that groundwork is often the fastest route to a rollout that sticks.

AvePoint is a partner of our CIO and CISO summits.