Unstructured Data Repositories as Insider Risk Blind Spots

Unstructured data repositories have become the largest blind spot in insider risk programs, and the reason is structural rather than a matter of effort or budget. Documents, emails, chat exports, and code repositories defeat the controls built for structured data because they share three traits at once: no inherent schema to trigger an alert, access that is routinely broader than any one person needs, and volume that makes manual review impossible past a certain scale.

Why unstructured repositories are structurally different from other data security problems

Security tooling built over the last two decades assumes data that behaves like rows in a database: fields that can be tagged, scanned, and matched against a rule. Unstructured content breaks that assumption at the root. A document, a chat export, a slide deck, or a block of source code carries no schema that a scanner can key off of, and its sensitivity depends on what the content means in context rather than on any pattern it matches. A business plan and a lunch order are the same file type; only a reader, human or otherwise, can tell them apart.

This is not a fringe problem affecting a handful of file shares. The CSA/Thales study found unstructured data makes up roughly a third of enterprise data, and nearly a third of organizations say it accounts for more than half of their annual data growth. Gartner's estimate, cited in the same CSA report, puts unstructured data at the vast majority of everything an enterprise generates. The space between that share and the portion organizations can actually classify or monitor is where the blind spot lives.

What makes the problem compound rather than plateau is the growth rate itself. Structured databases grow in predictable, governed ways, usually through a defined schema change or a new table. Unstructured repositories grow by accretion: every email thread, every meeting recording, every saved draft adds another ungoverned object to a pile that was already too large to review by hand. The gap between what a repository contains and what a security team can account for widens every quarter, and nothing about current tooling closes it on its own.

What security teams actually cannot see inside these repositories

Most organizations cannot answer a basic question about their own data: where it is. The CSA/Thales study found more than half of organizations have only partial visibility into where their data sits, and only a small fraction run real-time scanning. About a quarter cannot scan their unstructured repositories. Fortinet's 2025 Insider Risk Report found a similar pattern from a different angle: nearly three-quarters of organizations cannot see how users interact with sensitive data across endpoints, cloud apps, and GenAI platforms, and fewer than a third have effective data discovery and classification in place.

What "not seeing" means in practice is narrower and more concrete than a missing dashboard. It means a security team, faced with a specific incident, cannot say precisely what data was accessed, how it was altered or moved, who touched it, or why that person's access to it should raise concern. That gap is an investigation gap as much as a monitoring gap, and it becomes visible during an active incident, when an organization needs an answer fastest, not during a quarterly review.

The sharpest finding in the CSA/Thales research is a contradiction that produces this gap: confidence in securing unstructured data does not match actual coverage of it. Three-quarters of organizations said they were confident in their ability to secure unstructured data, while more than two-thirds, in the same survey, acknowledged that a significant portion of that data remains unprotected. Confidence and coverage are not tracking each other. Fortinet's 2025 report adds a second layer to that same contradiction: only a small minority of organizations feel fully confident in their insider threat detection capabilities, and insider risk budgets keep growing anyway. Programs are being funded to do a job that the people running them do not yet believe they can do. Money is being spent ahead of the visibility that would justify spending it.

Why classification-dependent controls fail against unlabeled, high-value content

Data loss prevention tools built around classification work by matching content against a label, whether that label comes from a regex pattern, a keyword list, or a manual tag applied by an analyst. The failure of that model against unstructured repositories has nothing to do with misconfiguration. The data these tools are supposed to protect usually carries no label for the tool to act on.

Intellectual property in unstructured form, a business plan, a competitive analysis deck, source code, a financial model, a deal memo, becomes sensitive because of what it means to the business that produced it, a meaning no pattern a rule-writer anticipated in advance could capture. A pricing strategy buried in paragraph four of a slide deck has no such shape, and no rule written in advance can anticipate every form sensitive meaning will take.

The burden this creates compounds rather than simply sitting there unaddressed. The overwhelming majority of DLP alerts turn out to be false positives or get ignored outright, and nearly all organizations report pressure to cut down on the noise coming from classification-driven rules. Analysts spend their limited hours chasing alerts that classification rules generated incorrectly, while the exfiltration that matters most, the kind involving unlabeled, high-value content, moves through channels those same rules were never built to watch. Fortinet's report found only about 28% of organizations have effective data discovery and classification in place. For the remaining majority of organizations, the label a DLP rule needs in order to fire simply does not exist for most of what that rule is meant to cover.

Mature security programs can and do classify their highest-priority content categories, and that effort is not wasted. But classification handles the sensitive data types an organization already knows to look for, and leaves the long tail of contextually sensitive, untagged intellectual property untouched. Insider actors go after that long tail because it carries real value and sits outside the monitoring net. If the tool cannot read the data for what it means, it cannot protect it, no matter how well-tuned the rule set is.

Overprivilege, Toolchain Fragmentation, and Persistent Access

Unlabeled data is only half of the blind spot. Employees routinely have more access to it than their role requires. It is common for organizations to grant employees more access to unstructured data than their role requires, whether through open-access defaults or the simple absence of governance that would scope permissions down. As a repository grows, the work of right-sizing access grows with it, and most organizations fall further behind rather than catching up.

Tool fragmentation turns that overprivilege into something closer to permanent cover. The CSA/Thales study found nearly a third of organizations use eleven or more tools to manage unstructured data, and a meaningful share of those run more than twenty. Tool count does not translate into coverage: more than half of the organizations surveyed reported only partial visibility despite running that many tools at once. SIEM platforms, log monitoring, endpoint detection, legacy DLP, and UEBA each watch their own slice of activity, but they rarely assemble into one timeline of what a user did and what data they touched while doing it. A SOC analyst might notice an unusual query. Identity and access management might flag a permission elevation. HR might know an employee is two weeks from their last day. None of those three groups routinely compares notes with the others in real time, and the organization stays blind to the pattern connecting all three until the damage has already happened.

Fortinet's 2025 report traces this back to a structural question of ownership. Insider risk functions are split across security and the SOC, data protection teams, dedicated insider risk groups, and IT, with insider risk management rarely sitting inside a single function anywhere in the organization. Governance intent and runtime behavior are decided by different teams working from different data, and nobody is positioned to connect the two.

The Intel case involving Jinfeng Luo shows how this plays out when it matters most. On July 23, Luo's first attempt to exfiltrate data, using an external hard drive, was blocked by Intel's DLP system. Five days later, on July 28, he successfully removed roughly 18,000 sensitive files using a personal NAS device, a path that endpoint DLP controls never covered. He departed the company on July 31. The DLP system worked exactly as designed against the vector it was built to catch, and the insider simply moved to a second device the control never reached. A single-vector defense stopped a single vector. It did not stop the exfiltration.

Shadow AI as a new class of unmonitored egress path from unstructured repositories

Generative AI tools have opened an egress channel for unstructured content that sits entirely outside the access controls and monitoring built around the repositories that content came from. A file can leave an approved, logged, access-controlled environment the moment an employee pastes its contents into a prompt box, and nothing in the repository's own controls will register that the file ever left.

BRG's analysis describes several versions of this pattern playing out inside organizations already: employees uploading internal documents to generative AI tools for help drafting or summarizing; AI meeting assistants producing summaries that end up publicly accessible and still contain confidential material from the meeting; AI browsers and agents granted standing access to corporate systems, which creates a persistent extraction channel that formal governance never reviewed. None of these require malicious intent. Each one moves sensitive content outside the boundary the organization thought it had secured.

Source code is, by a large margin, the content type employees most often submit to external generative AI tools, according to Verizon DLP data cited in National Insider Threat Awareness Month expert insights, with images and structured data following behind it. The most commercially sensitive category of intellectual property an organization holds is already the leading payload moving through this channel. IBM's Cost of a Data Breach Report found shadow AI contributed to a measurable share of the breaches it studied and added hundreds of thousands of dollars to the average cost of a breach where it was present, and a large majority of organizations that experienced an AI-related security incident had no proper AI access controls in place at the time.

Concern about this gap outpaces the ability to act on it. Fortinet's Insider Risk Report found 56% of organizations are very concerned about sensitive data being shared with GenAI tools, but only a small fraction feel fully prepared to respond when it happens. Blocking the most popular AI tools does not close the gap either: employees who lose access to a sanctioned tool tend to move to an alternative platform that nobody at the company is watching.

Insider Behavior Inside Unstructured Repositories

Across real incidents, the pattern repeats: the activity was visible in hindsight, spread across multiple systems that each logged a piece of it, and none of those pieces were ever assembled into one picture while it mattered.

The Rippling and Deel case, filed in March 2025, involved an alleged insider planted by a competitor who accessed Slack, Google Drive, and Salesforce over four months, pulling customer data and pricing information out through each one. Collaboration platforms produced no converged alert for the entire period the access was happening. The data was there. The access was logged. Nobody assembled the logs into a single behavioral picture while there was still time to act on it.

The Intel case, already described above as a toolchain failure, is also a detection pattern in its own right: a pre-termination exfiltration of a large volume of sensitive files, partially blocked on one device, completed on another. Stopping one leg of a multi-path exfiltration does not amount to stopping the exfiltration itself.

A recurring archetype involves a new employee who systematically accesses every SharePoint site available and replicates data across them. Nothing about that behavior trips an identity-provider flag on its own, because each individual access request looks like ordinary onboarding activity. The pattern only becomes visible when authentication events are read alongside HR context, how recently the person was hired, their role, their department, and matched against the shape of their access across the whole repository, not any single request in isolation.

The SharePoint ToolShell campaign, analyzed by the Canadian Centre for Cyber Security and dated to July 2025, was primarily an external exploitation rather than an insider case, but it confirms the same target logic from the outside. The threat actor's primary objective was documents sitting on accessible network file shares, reached over SMB, and the exploitation had been running for nearly two weeks before the CVE was publicly disclosed. Unstructured file shares were the prize worth two weeks of quiet access.

What connects the Rippling and Deel case, the Intel case, the new-hire pattern, and the ToolShell campaign is not a shortage of logging. In each one, the data existed, the access took place, and some system somewhere recorded it. The failure was the absence of any mechanism built to connect content, identity, and behavioral pattern into one picture before the damage was already done.