--- title: "Protecting Your Unstructured Data: A CISO’s Perspective" description: We discuss common pitfalls and obstacles to securing unstructured data and explore key considerations for your organization’s data security strategy. image: https://shardsecure.com/hubfs/Double%20exposure%20of%20businessman%20shows%20modern%20technology%20as%20concept-1.jpeg --- - [Home](https://shardsecure.com/) - [Blog](https://shardsecure.com/blog) # Protecting Your Unstructured Data: A CISO’s Perspective ![Picture of Zack Link](https://shardsecure.com/hs-fs/hubfs/Staff%20headshots/Zack-Link.jpg?width=60&name=Zack-Link.jpg "Picture of Zack Link") [Zack Link](https://shardsecure.com/team/zack-link) November 23 2023 ![Double exposure of a data protection expert with digital symbols floating in front of him to illustrate our CISO's perspective on protecting your unstructured data](https://shardsecure.com/hubfs/Double%20exposure%20of%20businessman%20shows%20modern%20technology%20as%20concept-1.jpeg "Double exposure of a data protection expert with digital symbols floating in front of him to illustrate our CISO's perspective on protecting your unstructured data") Emails, documents, smartphone sensors, machine learning: Everything relies on unstructured data. Why is it so difficult to protect? The challenges of securing unstructured data are considerable. From the increasing sophistication of cyberattacks to the growing number of data privacy regulations, CISOs today are faced with a highly complex landscape. Unstructured data — data that is not or cannot be organized into a typical relational database — is particularly difficult to safeguard. It doesn’t adhere to conventional data models, and many companies have unstructured datasets on the scale of tens or hundreds of billions of items to protect. The challenges are manifold. First, the average enterprise stores massive amounts of unstructured data. Approximately [97 zettabytes of data](https://www.g2.com/articles/big-data-statistics) were created worldwide in 2022, and 80-90% of all data is unstructured data. By 2025, there are expected to be [175 zettabytes of unstructured data](https://venturebeat.com/ai/why-unstructured-data-is-the-future-of-data-management/) in the world. Second, unstructured data is by its very nature difficult to categorize and organize. I’ve personally spoken with many companies that don’t know exactly what their unstructured datasets contain. Similarly, a report by the Institute of Directors (IoD) and Barclays reveals that over [40% of companies](https://www.lepide.com/blog/more-than-forty-of-companies-dont-know-where-their-data-is-stored) don’t even know where all their critical data is stored. Third, unstructured data is the linchpin to application security and availability. The functionality of all applications, from email tools to databases and VMs, depends on the health of the underlying file systems. When the unstructured data in those file systems is lost, corrupted, or deleted in a cyberattack, the result can include crashed applications, broken databases, SLA violations, and interruptions to business continuity. ## Going beyond RBAC and single points of failure The current standard for securing unstructured data is to rely on role-based access controls, RBAC. While RBAC is absolutely necessary and does offer protection against unauthorized users without the proper credentials, it’s also a limited approach. RBAC doesn’t stop many common attacks, so you’re always one credential abuse away from being in trouble. Unstructured data is typically left under-protected beyond RBAC. The systems that host it have a single point of failure: privileged credentials. This is true for all data repositories, and it’s true for any third parties like cloud storage providers that retain privileged access. The result is that it’s nearly impossible to prevent data exfiltration when every system has a root password. Likewise, it’s nearly impossible to prevent data tampering, a risk to [valuable AI/ML models and training data](https://shardsecure.com/resources/other/is-my-ai-data-attractive-to-espionage-and-ransomware-groups) in particular, when a single credential incident is all that it takes for an attacker to gain access. At-rest encryption offers a layer of security for data stored in the cloud, but it is not a realistic mitigation strategy to protect against risks to availability, data exfiltration, or breaches caused by human error, ransomware, and other cyberthreats. ## Top risks to unstructured data security As CISOs, our job is to assess and mitigate risk to our data assets. For [unstructured data](https://shardsecure.com/blog/all-about-unstructured-data), those risks come in many forms, and our response needs to be balanced against all the different kinds of risk. **Risks to availability.** Poor data quality and incompatibility can both cause problems with availability, but far more common threats are server crashes, network failures, and cloud provider outages. Cloud storage SLAs may specify a small refund in the case of downtime, but that refund won’t defray the significant, multimillion dollar costs of downtime — nor will it bring your service back online. Data availability is further complicated by the complexity of [hybrid- and multi-cloud environments](https://shardsecure.com/resources/white-papers/technical-white-paper-multi-cloud-data-resilience). **Operational risks. **A recent study by a Stanford University professor found that [88% of breach incidents are caused by employee mistakes](https://securitytoday.com/articles/2022/07/30/just-why-are-so-many-cyber-breaches-due-to-human-error.aspx), while a similar study by IBM Security estimated it to be a shocking 95%. That’s because complex operational environments with multiple tools over multiple disparate cloud providers have become commonplace, and increased complexity makes mistakes more likely. As a result, we’ve seen a significant number of large breaches involving human error — most commonly when an employee accidentally leaves a storage bucket open to public access while migrating or sharing data. From there, it’s only a short step to a costly data breach. **Ransomware and data exfiltration risks.** Another significant risk to unstructured data is ransomware. 2023 is on track to be a record-breaking year for ransomware, with a [49% YoY increase](https://www.blackfog.com/most-impactful-ransomware-attacks-of-2023) in the first six months. The rise of ransomware threatens availability in on-prem and cloud environments, and it also affects data privacy. A significant number of ransomware attacks today are double extortion attacks, where any unsecured data that is accessed in a ransomware incident is easy prey for attackers who threaten to publish or leak exfiltrated data. **Compliance risks. **We’ve written extensively about data privacy and compliance over the last year. The most important takeaway is that [data protection laws are on the rise](https://shardsecure.com/blog/tag/compliance) — and the [penalties for noncompliance](https://shardsecure.com/blog/meta-fine-gdpr) are staggering. Many regulations now require certain technical safeguards to consumer personal data, from the European Data Protection Board’s recommendations for cross-border data transfers to the German Federal Financial Supervisory Authority’s requirements for data backups. Minimizing legal liability and financial risk in the face of these many requirements is an ongoing challenge. ## Mitigating risk and strengthening security for unstructured data Unstructured data is the backbone of your organization. It’s also a vulnerable point. The vast majority of cyberattacks are carried out on unstructured data, so this kind of data must be the primary focus of protection. Cybersecurity experts offer a wide array of individual recommendations to protect unstructured data. Your company might consider encryption by default, [privacy by design](https://shardsecure.com/blog/tag/privacy-by-design), principle of least privilege, and data minimization. While all these approaches are essential, it’s also useful to take a holistic view of the risks to unstructured data. The ideal technologies will address not just one category of risk but many. Specifically, I recommend choosing a security solution with following features to safeguard unstructured data: - **Robust data resilience,** to mitigate external risks to availability. - **Advanced data privacy,** to mitigate issues with data exfiltration, legal liability, and regulatory compliance. - **Self-healing,** to mitigate data loss from human error and from ransomware and malware attacks. - **Infrastructure-agnostic platform,** to accommodate the complexity of hybrid- and multi- cloud architectures. The ShardSecure platform offers an award-winning approach to mitigate risks and protect unstructured data, wherever it resides. To learn more about how ShardSecure can support a robust cybersecurity strategy with advanced data security, privacy, and resilience, take a look at our [white paper](https://shardsecure.com/resources/white-papers/our-technology-explained) or check out our [resources page](https://shardsecure.com/resources). [Data security](https://shardsecure.com/blog/tag/data-security) ## Read on ![](https://shardsecure.com/hubfs/Picture2.jpg) June 15 2026 ### [ShardSecure MCP Secure Gateway](https://shardsecure.com/blog/shardsecure-mcp-secure-gateway-identity-aware-data-redaction-and-least-privilege-context-enrichment-for-ai-inference) [Read more](https://shardsecure.com/blog/shardsecure-mcp-secure-gateway-identity-aware-data-redaction-and-least-privilege-context-enrichment-for-ai-inference) ![](https://shardsecure.com/hubfs/Keyboard%20with%20high%20tech%20user%20map%20icons%20and%20symbols-1.jpeg) February 18 2026 | [Cloud](https://shardsecure.com/blog/tag/cloud) ### [Unstructured Data Left Exposed: A Cloud Breach That Should Worry Every Enterprise](https://shardsecure.com/blog/unstructured-data-left-exposed-a-cloud-breach-that-should-worry-every-enterprise) [Read more](https://shardsecure.com/blog/unstructured-data-left-exposed-a-cloud-breach-that-should-worry-every-enterprise) ![](https://shardsecure.com/hubfs/Keyboard%20with%20high%20tech%20user%20map%20icons%20and%20symbols-1.jpeg) November 12 2025 | [Cloud](https://shardsecure.com/blog/tag/cloud) ### [Can You Really Trust Hyperscalers with Your Data at Rest?](https://shardsecure.com/blog/can-you-really-trust-hyperscalers-with-your-data-at-rest) [Read more](https://shardsecure.com/blog/can-you-really-trust-hyperscalers-with-your-data-at-rest) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/Acronis%20and%20ShardSecure%20unveil%20a%20groundbreaking%20technology%20partnership%20set%20against%20a%20backdrop%20of%20a%20sleek%20modern%20office%20filled%20with%20digital%20screens%20displaying%20dynamic%20data%20flows%20The%20atmosphere%20buzzes%20with%20excitement%20and%20anticipation%20illuminated%20by%20sof-1.png) October 16 2025 | [Cloud](https://shardsecure.com/blog/tag/cloud) ### [Acronis + ShardSecure: Stronger data protection for modern threats](https://shardsecure.com/blog/acronis-shardsecure-stronger-data-protection-for-modern-threats) [Read more](https://shardsecure.com/blog/acronis-shardsecure-stronger-data-protection-for-modern-threats) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/The%20image%20portrays%20a%20hightech%20digital%20landscape%20filled%20with%20abstract%20representations%20of%20data%20security%20concepts%20At%20the%20forefront%20a%20glowing%20vault%20symbolizing%20advanced%20filelevel%20encryption%20stands%20tall%20surrounded%20by%20intricate%20patterns%20of%20fragmented%20data.png) October 1 2025 | [Data Sensitivity](https://shardsecure.com/blog/tag/data-sensitivity) ### [Revolutionizing Data Security: How Agentless File Level Encryption Makes Stolen Data Useless](https://shardsecure.com/blog/sensitive_data) [Read more](https://shardsecure.com/blog/sensitive_data) ![unstructured data](https://shardsecure.com/hubfs/Digital%20image%20of%20globe%20with%20conceptual%20icons.%20Globalization%20concept.jpeg) September 15 2025 | [Cybersecurity News](https://shardsecure.com/blog/tag/cybersecurity-news) ### [Elevating unstructured data security: ShardSecure® and Entrust® Join Forces!](https://shardsecure.com/blog/entrust_partnership) [Read more](https://shardsecure.com/blog/entrust_partnership) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/scales%20%20ransomware%20attack%20to%20pay%20the%20money%20or%20risk%20the%20attack.jpeg) July 29 2025 | [Ransomware](https://shardsecure.com/blog/tag/ransomware) ### [CISOs on Strategic Considerations in Ransomware Response](https://shardsecure.com/blog/ransomware-fine) [Read more](https://shardsecure.com/blog/ransomware-fine) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/Image%20for%20AI%20data%20types-1.jpeg) July 29 2025 | [Data security](https://shardsecure.com/blog/tag/data-security) ### [The Growth of AI is driving the Imperative of Securing Unstructured Data](https://shardsecure.com/blog/ai-unstructured-data) [Read more](https://shardsecure.com/blog/ai-unstructured-data) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20hightech%20digital%20landscape%20showcasing%20a%20sleek%20modern%20office%20environment%20illuminated%20by%20soft%20blue%20and%20white%20lighting%20In%20the%20foreground%20a%20large%20computer%20screen%20displays%20intricate%20graphs%20and%20charts%20related%20to%20data%20security%20while%20a%20gr.jpeg) July 22 2025 | [Data security](https://shardsecure.com/blog/tag/data-security) ### [How to make your SharePoint data of zero value in a zero day attack!](https://shardsecure.com/blog/sharepoint_breach) [Read more](https://shardsecure.com/blog/sharepoint_breach) [![ShardSecure®](https://shardsecure.com/hubfs/ShardSecure%20brand%20assets/Logo%20(2022)/ShardSecure-Logo__Horizontal--White.svg "ShardSecure®")](https://shardsecure.com/) 101 Avenue of the Americas, 9th Floor, New York, NY 10013, United States of America [![linkedin](https://shardsecure.com/hubfs/_2023/li.svg) ](https://www.linkedin.com/company/shardsecure) [![tweeter](https://shardsecure.com/hubfs/_2023/tweeter.svg) ](https://www.twitter.com/ShardSecure) [![facebook](https://shardsecure.com/hubfs/_2023/facebook.svg) ](https://www.facebook.com/ShardSecure/) [![facebook](https://shardsecure.com/hubfs/_2023/youtube.svg) ](https://www.youtube.com/@shardsecure877) © 2026 ShardSecure®. All rights reserved. [Privacy Policy](https://shardsecure.com/privacy-policy) ![websights](https://ws.zoominfo.com/pixel/62e7bb6d62a6b2008e071c83) ![](https://px.ads.linkedin.com/collect/?pid=5456580&fmt=gif) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Zack Link", "url" : "https://shardsecure.com/blog/author/zack-link" }, "dateModified" : "2023-11-23T12:31:00.778Z", "datePublished" : "2023-11-23T12:31:00.000Z", "headline" : "Protecting Your Unstructured Data: A CISO’s Perspective", "image" : [ "https://shardsecure.com/hubfs/Double%20exposure%20of%20businessman%20shows%20modern%20technology%20as%20concept-1.jpeg" ], "mainEntityOfPage" : { "@id" : "https://shardsecure.com/blog/protecting-unstructured-data-ciso", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://shardsecure.com/hubfs/ShardSecure-Logo__Horizontal--Purple-Inverted.svg" }, "name" : "ShardSecure" } } ```