Back in May 2026, security researchers found nearly 20 billion files in more than 500,000 publicly accessible cloud storage buckets across Amazon S3, Google Cloud, Azure, DigitalOcean, and Alibaba. Reaching them didn’t require a complicated login process or a malicious exploit. These files included more than 600,000 credential files and keys and more than a million database dumps.
Open buckets like these exist and continue to exist because an organization rarely has a complete view of what’s inside their data infrastructure or who and what can reach them. Moreover, these blind spots are getting increasingly more expensive, with IBM’s 2026 Cost of a Data Breach report putting the global average cost of a data breach at $4.99 million, a 12% increase from the previous year.
Shadow AI represented almost 43% of such incidents. And as AI permissions and capabilities continue to increase, this number will likely increase as well.
All of these represent a critical lesson for organizations. Every overshared folder, forgotten contract draft, and stale project site is something AI agents can easily find and use. This kind of exposure will keep on escalating, both in terms of cost and frequency. Most of the data these AI tools go through remains unstructured, i.e., documents, emails, chats, and images that never became part of the database schema. AS a result, with no visibility into these assets, organizations cannot protect the files they do not know exist.
The following guide covers how unstructured data discovery works, where it breaks down, and how to build a program resilient to AI adoption.
What Is Unstructured Data Discovery
Unstructured data discovery is the process of finding, inventorying, and mapping out all the data that doesn’t fall into an organization’s database schema. This includes all documents, emails, chat messages, images, and recordings. Details in such data discovery can help the security and privacy teams in organizations see where files exist, where they’re stored, who owns them, and who has access to them.
Discovery is the very first step, with classification and labeling to follow. The exact metrics and titles can be decided by an organization based on its unique needs.
Some teams also consider emails and logs as semi-structured, as they do carry some metadata such as senders and timestamps, but in terms of discovery, these are still considered unstructured, as sensitive data may sit in the message body or the attachment, and not the metadata itself.
Unstructured data may be found in on-prem file shares and network-attached storage, cloud object storage such as Amazon S3, Azure Blob Storage, or Google Cloud Storage, SaaS and collaboration apps such as Microsoft 365, Slack, or Google Workspace, and data lakes and AI pipelines, including vector databases and RAG indexes.
Why Unstructured Data Discovery Matters Now
By its very nature, unstructured data is harder to govern. However, its complications have risen manifold in the context of how fast it can be exposed and how much this exposure can cost businesses in the AI age.
Longer Undetected Breaches Cost A Lot More
The average time to identify and contain a breach has risen to almost 247 days per IBM’s 2026 report. This delay has high costs, with breaches of over 200 days’ lifecycle costing organizations more than $5 million, compared to almost $4 million contained within 200 days. Since organizations cannot spot unusual access to a file it doesn’t even know exists, discovery grants them a baseline of what’s sensitive and where it exists.
Regulators Expect Inventory
The GDPR, HIPAA, as well as various other data and security regulations globally have different mandates requiring records of processing activities. This includes knowing where the data is being stored. None of these obligations can be met if the data in question is sitting in email attachments and shared drives that the organization has never scanned. Considering the EU regulators have issued over €1.2 billion in GDPR fines in 2025 alone, it makes both regulatory and financial sense to gain this visibility into data.
Unlike humans, copilots, enterprise search capabilities, and RAG pipelines index file shares, SaaS applications, and Cloud storage at exponential speeds. Hence, they do not need to create new access permissions, as they can leverage existing permissions with ease. An overshared folder that remained invisible for years will show in an AI answer within hours of it going live. It is for this reason that Gartner predicts almost 75% of organizations running GenAI initiatives will shift their data security spending from structured to unstructured data.
How Unstructured Data Discovery Works
Here is how unstructured data discovery processes usually go.
Connecting Data Sources & Building Inventory
At the very start, it is important to connect how and where every file is stored. This is done primarily through native APIs for cloud storage and SaaS applications and connectors for on-prem file shares. The first phase collects metadata such as file name, type, size, location, owner, creation date, and last access.
The inventory developed as a result precedes the deep inspection to follow, as it shows how much data an organization has, where it’s located, and which resources and stores need to be scanned first.
Inspecting File Content
Once an organization knows what files it has, the discovery can move towards scanning the contents of each file. Through pattern matching, well-defined data such as credit card info and checksum validation like the Luhn algorithm filter out random strings. At the same time, NLP adds context for any other data, such as a name appearing near a diagnosis or a salary figure.
Machine learning enables document type identification such as contracts, resumes, and invoices. At the same time, optical character recognition (OCR) extracts text from images and scanned PDFs, with transcription doing the same for audio and video.
Classifying Unstructured Data
Once an organization has comprehensive information on what data it has, classification allows for all this data to be properly defined per internal and regulatory taxonomy requirements such as PHI, PII, payment card data, intellectual property, or other confidential information. Effective classification operates on two levels: one that analyzes the data elements inside the file, and the second that evaluates the sensitivity of the file as a whole.
Each label usually carries a confidence score, giving teams both context and insights before taking appropriate actions. These labels are mostly mapped against regulatory requirements such as those under the GDPR, CPRA, or other relevant applicable data regulations to act as future compliance evidence.
Access & Usage Context
A sensitive file represents a risk only if the wrong people can access it. Hence, discovery helps in mapping who can open each file, with distinct permissions for internal and external entities. Through this, a comprehensive record can be kept of who owns the file, where copies of it exist, and when it was last accessed.
This is particularly helpful to the organization in its prioritization, as it can then devote the necessary resources to issues that require immediate action.
Running Discovery Continuously
Unstructured data evolves daily, making one-time scans obsolete within hours. Hence, mature data discovery programs are always incremental, inspecting new and modified files as change events occur, rather than scanning everything all over again.
New data sources, SaaS apps, and AI pipelines are brought into the overall discovery scope and made part of the enterprise data infrastructure as soon as possible, and not after the next quarterly review.
Common Challenges In Unstructured Data Discovery
The most common challenges in implementing and carrying out unstructured data discovery are as follows:
Scale & Scanning Cost
Full content inspection of every file in an enterprise’s infrastructure takes significant resources in terms of both money and compute power. Moreover, SaaS platforms limit how quickly third-party tools can call their APIs, slowing down large scans even further.
Unstructured data means hundreds of different formats, including scanned images, handwritten notes, compressed archives, password-protected files, and documents inside other documents. And each format requires a different extraction method before the initial inspection can even begin.
False Positives & False Negatives
Pattern-only detection may flag every nine-digit number as a Social Security number, burying the team in alerts. Simultaneously, it can miss sensitive content with no fixed format, such as medical notes or confidential strategy docs. Moreover, the overall accuracy can dip across languages, regional ID formats, and industry-specific terms.
Duplicates & Data Sprawl
Users consistently copy, forward, download, and re-upload files constantly. Hence, one sensitive document can lead to dozens of copies being forwarded to emails, collaborative tools, and personal drives. Each of these can carry different access permissions. In such situations, securing the original means nothing as discovery must find and connect each of them separately.
Access Sprawl
File permissions are always inherited from folders. These are then broken by one-off shares and extended to extended entities that are rarely removed. Over time, it becomes difficult to assess who exactly has access to which document. Discovery that classifies content without mapping the associated access permissions will only give the organization half the picture, where it is known the file is sensitive, but whether it’s exposed remains unknown.
Best Practices To Maximize Benefits From Unstructured Data Discovery
Some practices organizations can leverage to maximize the benefits of unstructured data discovery are as follows.
Start With The Highest Risk Data Stores
The most logical way to approach the mountainous task is to prioritize. This means treating stores with external and public sharing with the most immediate care, with departments that handle regulated data and any other sources connected to an AI tool to follow. The findings from these early exercises can be leveraged to build a case for expanding the program and reducing the overall exposure as the company scales.
Build Classification Taxonomy Per Obligations
Any internally developed taxonomy module must be small enough for people to use, while being mapped and labeled per the specific obligations the organization and, more critically, the data in question may be subject to. This can also include unique contract clauses or internal policy requirements.
Validate Accuracy Before Scaling
A representative sample of the data being analyzed must be put through a test to measure how accurate the findings are. These can then be combined with pattern matching, contextual analysis, and ML-based detection to cut false positives. This can then be returned as needed in the wake of new regions, languages, or business units being tested.
Every finding needs an owner who can make the necessary decisions when it comes to deletion, restriction, relabeling, or retention of files. All findings must be routed to data owners, and not just the security team, as owners understand the business context better. All repeatable fixes can be automated, with the necessary sensitivity labels accompanying them. The same workflow can be repeated to clear out any ROT data.
How Securiti Helps
For all its benefits, discovery can only reduce the risk profile for an organization when it leads to actionable access controls and meaningful remediation. This is precisely what Securiti, a Veeam company, can offer.
Thanks to its DSPM solution, all the steps mentioned earlier when it comes to effective unstructured data discovery can be brought together across public cloud, private cloud, SaaS applications, and on-prem environments.
It helps organizations classify sensitive, regulated, and custom data with AI and contextual intelligence across structured, semi-structured, and unstructured systems, while giving them detailed visibility into users, roles, AI systems, and their entitlements to files, tables, and sensitive data, and then enforcing policy-based access controls automatically.
Request a demo today and learn more about how this DSPM solution discovers, classifies, and secures unstructured data across your data environment.
FAQs About Unstructured Data Discovery
Here are some of the most commonly asked questions related to unstructured data discovery:
