10 Common Issues Using Excel for Data Operations

Excel is still where most data work starts, and for a quick calculation it does the job well. The trouble begins when a spreadsheet becomes the system a business uses for high-stakes and sensitive data: the monthly close, the demand forecast, the audit sample, the regulatory submission.

In 2026, that risk has a new layer. Copilot and AI agents now write formulas, edit sheets, and summarize data inside Excel. Employees paste spreadsheet data into AI tools their company never approved. The result is more output, produced faster, with less certainty about how any of it was built.

Here are 10 issues that make Excel a risk, each backed by published research, regulator findings, or Microsoft's own documentation.

In a May 2026 DOSS survey of 1,003 US operations professionals, 53% said they deal with spreadsheet errors every week and 22% every day. The most common causes were manual data entry (59%), formula errors (46%), and copy-paste mistakes (45%). Respondents put the average cost of a single significant error at $4,315 and said about two in five incidents are fixed without ever being reported to leadership. Only 41% of their organizations had a formal quality-control process for spreadsheets used in high-stakes decisions.

Excel includes auditing tools such as Trace Precedents, Error Checking, and Evaluate Formula. Each one runs only when someone opens it and looks. There is no automated test that confirms every cell still behaves as intended after a change, and when incidents go unreported, nobody learns which checks were missing.

In July 2025, the UK government revealed that a Ministry of Defence official had emailed a spreadsheet outside government systems in 2022. It held hidden data on 18,700 people from Afghanistan who had applied to relocate to the UK, far more than the sender knew was in the file. Nobody noticed until excerpts appeared on Facebook in August 2023.

Reports say this was probably the most expensive email ever sent. It resulted in costs of £850 million due to the emergency resettlement scheme that followed.

A spreadsheet can hold far more than you see on screen.

Each worksheet stops at 1,048,576 rows. Open a larger file and Excel stops loading at that row. If someone then saves it back to CSV, the missing records are gone for good. In an automated process, nobody may be watching when that happens, and the data that's left looks complete.

The limits reach inside cells too. Salesforce's current support guidance warns that long text fields in a CSV export can be cut short when opened in Excel. If a field starts with a dash or an @ sign, Excel reads it as a formula and truncates it to 255 characters. Only some records are affected, so the damage looks random and is easy to miss.

Microsoft ended support for Office 2016 and Office 2019 on October 14, 2025. Those versions no longer receive security updates. However, spreadsheets move freely between older and and current versions by email and shared drive, and nothing in a workbook shows which version last touched it.

This means that any team still running them could be handling sensitive financial, customer, or employee data in software Microsoft no longer patches. That matters most for the files attackers like best, which brings us back to macros in issue 10.

In 2025, Microsoft released a COPILOT function that put AI responses directly into cells. Its own support page warned users not to rely on it for any task requiring accuracy or reproducibility, and to avoid it for financial reporting, legal documents, and other high-stakes work.

On September 14, 2026, Microsoft retired the function. Results already in workbooks stay as cached values, but any cell that recalculates now returns a #NAME? error. Every workbook that came to depend on it lost the ability to recalculate those cells. AI features in Excel are still changing fast, so there is a risk that a workbook built on an AI feature in Excel today might not continue to calculate the same way in the future.

Agent Mode lets Copilot plan and carry out multi-step tasks directly in a workbook. Microsoft tested it on SpreadsheetBench, a public benchmark of 912 real-world spreadsheet tasks, and reported 57.2% accuracy. Human testers scored 71.3% on the same tasks. Agent Mode arrived in desktop Excel in January 2026.

Microsoft notes that the benchmark doesn't measure everything customers need, including results that are refreshable, auditable, and verifiable. In practice, this means that every agent-generated output needs a person to check it, and we all know what it’s like to check a sheet you didn’t create yourself.

Copilot answers from the files a user can access, including spreadsheets shared too widely years ago. CoreView's State of Microsoft 365 Security and Governance 2026 report, based on 279 IT and security decision-makers, found that 66% of organizations had delayed or canceled Copilot deployments over concerns it could expose confidential SharePoint data. Nearly three-quarters (73%) worried AI was already surfacing sensitive information internally. At Gartner's Security and Risk Management Summit in March 2026, Research Vice President Dennis Xu named oversharing the top security risk for Microsoft 365 Copilot.

Spreadsheets make this harder to control. They get copied, emailed, and saved to shared drives, and each copy carries its own access settings. We humans forget about files and where they’re located, but an AI agent won’t. Every forgotten copy of a payroll or pricing file could be just one prompt away for anyone who can open it.

Not every AI tool is sanctioned. In a TELUS Digital survey of 1,000 employees at large US companies, 57% said they had entered confidential information into public AI tools. According to IBM's 2025 Cost of a Data Breach Report, one in five organizations had a breach linked to shadow AI, which added an average of $670,000 to breach costs, and 63% had no AI governance policy.

Spreadsheets are the easiest thing to paste. An analyst asking a chatbot to tidy a forecast can hand over budgets, payroll, or customer data in a single step, and nothing in the file records that it happened.

Microsoft has closed many of Excel's older gaps. Power Query handles repeatable imports and joins. Office Scripts and Power Automate handle scheduling. Python in Excel handles advanced analysis, and Copilot handles requests in plain language. Each one solves a single problem with its own interface, logic, and license terms: running Office Scripts through Power Automate requires a Microsoft 365 business license, and premium compute for Python in Excel is a paid add-on.

One analysis can now span formulas, the Data Model, Power Query, scripts, Python, and AI. To follow how a single number was produced, someone has to trace it across all of these tools.

Weaponized Office files are still a favored way in. Microsoft has blocked VBA macros by default in files downloaded from the internet since 2022, so attackers moved to other Excel formats. In September 2025, Ukraine's CERT-UA detected a targeted espionage campaign that used malicious Excel add-in (XLL) files to install a backdoor called CABINETRAT. The files arrived as compressed archives over Signal.

Organizations that depend on macros and add-ins must take additional precautions to prevent sensitive data from being exposed.

The common thread across all ten issues is visibility. In a spreadsheet, logic hides in cells, data hides in tabs, and AI can now change a sheet faster than anyone can review it. When the person who built the file moves on, the knowledge leaves with them.

High-stakes numbers need an environment where every step is visible, every result can be traced and reproduced, and access is governed in one place. That applies to the work people do and to the work AI does for them.

Knime is a data and unification platform that’s free to start and built to scale. It includes 4,000+ building blocks for accessing, transforming, analyzing, and exporting data. Each step is visible and documented, so a colleague or an auditor can see exactly how a result was produced and run it again with the same outcome. You can add scheduling, sharing, and governance, so data teams set the guardrails and a process one person builds can run in production for the whole team. [Add: how Knime's AI capabilities keep AI-assisted work traceable.]

Get started:

• Try Knime (it’s free to start).
• Use the eguide From Excel to Knime to move your existing spreadsheets into repeatable, documented processes.
• Ask questions and get support from experienced Knime users from the Knime Community.