Dark Data: What It Is, Why It's a Risk, and How to Manage It

What Is Dark Data?

Dark data is information that organizations collect and store during regular business activities but generally never use for analytics, decision-making, or any other purpose. Gartner coined the term to describe data retained mostly for compliance reasons that creates more cost and risk than value. Research from Splunk found that 55% of an organization's data is dark on average, with some surveys putting the figure at 60% or higher.

Dark data is dormant. It sits in server log archives, legacy customer relationship management (CRM) databases, email repositories, cloud storage buckets, and any other location where data lands but no one returns to examine it. Cloud adoption, SaaS proliferation, and the growth of machine-generated data have made dark data easier to accumulate than ever, while data protection regulations have grown stricter and attackers have grown more deliberate about seeking out unmonitored corners of the enterprise.

How Dark Data Accumulates

Dark data builds through a set of recurring organizational patterns. Cheap cloud storage removed the cost pressure that once forced teams to delete data, so organizations default to keeping everything on the chance it might prove useful later. Departments build isolated repositories with no shared catalog, so data one team could use stays trapped behind another team's walls.

Data without metadata, meaning no ownership record, sensitivity label, or creation date, is effectively undiscoverable: governance tools have nothing to surface and enforcement has nothing to act on. When infrastructure is modernized, older databases are frequently retired without migrating or deleting the records they hold, leaving that data outside active monitoring entirely.

Types of Dark Data: Structured, Unstructured, and Semi-Structured

Dark data spans all three structural formats, and each presents a different discovery and management challenge.

1. Structured dark data has a defined schema and lives in organized systems that no one queries anymore. Examples include transaction records in legacy enterprise resource planning (ERP) systems, archived customer records from discontinued products, historical CRM entries, and financial records kept solely for compliance. Structured dark data is comparatively easy to discover once its existence is known, but it often sits behind permission barriers or in systems no longer integrated with modern tooling.
   
2. Unstructured dark data is the largest and fastest-growing category. It includes email correspondence, customer service call recordings, surveillance video, scanned documents, slide decks, and PDFs. Unstructured data does not fit into database columns, which makes automated discovery harder and requires content inspection or natural language processing to identify what it contains.
   
3. Semi-structured dark data falls between the two. It carries some organizational markers but no rigid schema. Examples include JSON and XML files from application programming interface (API) interactions, web server logs with mixed field types, Internet of Things (IoT) sensor streams, and email metadata paired with unstructured message content.

Structured dark data benefits from database scanning, unstructured data requires content inspection or computer vision, and semi-structured data typically needs custom parsing before it can be classified.

The Business and Security Costs of Dark Data

Dark data is not only a security question; it carries direct financial and operational cost. Every terabyte of dark data still occupies paid storage infrastructure, whether on premises or in the cloud, and that cost compounds as volume grows. Compliance liability is a second cost: privacy laws apply to personal data whether or not an organization is actively using it, so an unmanaged archive can trigger the same breach notification and subject-access obligations as actively managed data.

Dark data also represents an opportunity cost. Dark data analytics, applying analysis to data that was previously ignored, can surface patterns in customer behavior, operational bottlenecks, or product usage that a business never knew it had access to. Machine learning and large language models depend on the volume and quality of data available to them, and organizations that never discover their dark data are training and reporting on an incomplete picture. The security response to dark data and the analytics opportunity it represents are not separate projects: the same discovery and classification work that reduces risk is what makes previously dark data usable in the first place.

Why Dark Data Is a Security and Compliance Risk

Dark data is a security liability because organizations cannot enforce access controls on data they have not inventoried, cannot encrypt files they do not know exist, and cannot respond to a data breach involving data that was never cataloged. Attackers operate with no such constraint. They probe wherever access controls are weakest, and dark data sitting in abandoned cloud buckets, forgotten file shares, and unmonitored legacy systems is a low-resistance target.

Compliance obligations apply to dark data regardless of whether an organization knows it exists. Regulations including the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA), and the California Consumer Privacy Act (CCPA) govern all stored personal data, not only data an organization actively manages. An undiscovered archive containing personally identifiable information (PII) from a decade ago still triggers subject access rights, breach notification obligations, and retention limits.

The attack surface also expands with volume. Redundant, obsolete, and trivial (ROT) data can conceal malware or backdoors placed by threat actors who gained earlier access, and insider threats benefit disproportionately from dark data because departing or malicious employees can exfiltrate records that security teams have no baseline to detect as missing.

Common Dark Data Misconceptions

"We Would Know If We Had a Problem"

Many organizations assume that because their active systems are monitored, their overall security posture is sound. Dark data breaks this assumption. An organization can have mature controls over its known data environment while carrying years of unmonitored sensitive records in decommissioned systems or unindexed cloud storage.

Treating Dark Data as a Storage Problem Only

Dark data is commonly discussed in terms of storage cost, which is real but secondary. The security and compliance exposure of unmanaged sensitive data is the more pressing concern. Deleting dark data purely to cut cost, without first assessing sensitivity, risks destroying records that carry compliance value.

Assuming Encryption Solves It

Encrypting data at rest addresses one attack vector, but it does not make dark data visible or manageable. Security teams still cannot classify it, apply access controls to it, or respond to a breach if they do not know it exists. Encryption without discovery is incomplete.

Underestimating Unstructured Volume

Structured databases draw attention because they are visible and queryable. The unstructured data accumulating in shared drives, collaboration tools, email archives, and endpoint file systems is far larger by volume and far harder to govern. Teams that limit discovery efforts to databases routinely miss most of their dark data.

How to Discover, Classify, and Manage Dark Data

Effective dark data management follows a sequence: find it, classify it, act on it, and prevent future accumulation.

1. Run dark data discovery across the full data estate: Cover every repository, including cloud storage, SaaS applications, on-premises databases, file servers, email systems, and endpoint devices. Do not limit discovery to known or approved locations; orphaned cloud buckets, personal devices used for work, and legacy systems IT no longer actively manages are common dark data sources.
   
2. Classify what discovery finds: Apply sensitivity labels using content-based inspection, contextual signals (who created the file, what application generated it, where it is stored), and manual review for high-stakes edge cases. Classification determines which dark data carries the highest risk: records containing PII, protected health information (PHI), financial data, or intellectual property need immediate governance.
   
3. Prioritize by value and risk: A simple four-quadrant framework works well: activate high-value, high-risk data under strict governance controls; activate and open access to high-value, low-risk data; secure and then delete or archive low-value, high-risk data; and archive or delete low-value, low-risk data to shrink storage footprint and attack surface.
   
4. Enforce retention and deletion policies: Set automated retention schedules so data does not persist past its compliance-required or business-useful life. Without enforced deletion, any discovery program simply restarts from a growing baseline.
   
5. Prevent future dark data: Implement continuous monitoring so new data is classified as it arrives rather than after it has sat unexamined for years. Connect classification labels to data loss prevention (DLP) policies and access controls so sensitive data is protected from the moment it is created.

How Cyberhaven Addresses Dark Data

Cyberhaven's approach to dark data starts with Data Lineage, a proprietary technology that tracks data from creation through every copy, transformation, and movement across cloud, SaaS, on-premises, and endpoint environments. Most dark data did not start invisible; it became invisible through movement, as a document created in a sanctioned system gets copied to a personal folder, forwarded externally, or archived somewhere no one revisits. Data Lineage traces that movement, surfacing data that static discovery scans miss.

Cyberhaven DSPM uses this lineage foundation to continuously discover and classify sensitive data across the enterprise. When dark data surfaces, DSPM adds lineage context so security teams understand not just that unmonitored sensitive records exist, but which systems they passed through and which users touched them, shortening investigation time and improving remediation accuracy. For compliance, Cyberhaven DSPM generates audit-ready reporting tied to specific data assets and access histories, supporting GDPR, HIPAA, PCI DSS, and CCPA requirements.

Cyberhaven DLP extends protection to data in motion, applying real-time policies that stop classified data, including data freshly surfaced from previously dark locations, from moving to unapproved destinations. Together, lineage, DSPM, and DLP turn dark data from a standing blind spot into a monitored, governed part of the data estate.