ROT data minimization: what it means for data, AI and risk teams

TL;DR: Redundant, obsolete and trivial data now raises storage, breach and AI risk across hybrid multicloud, SaaS and on-prem estates, according to Securiti, with IBM reporting 35% of breaches involved unmanaged sources at USD 5.27 million on average. The control problem is no longer finding data, but governing discovery, classification and remediation at scale.

Editorial analysis by NHI Mgmt Group, based on content published by Securiti: “Stop Storing Risk: An Executive's Guide to ROT Data Minimization”.

By the numbers:

• 35% of breaches involved data in unmanaged sources, according to IBM's 2024 Cost of a Data Breach Report cited by Securiti.
• USD 5.27 million was the average cost of those breaches, according to IBM's 2024 Cost of a Data Breach Report cited by Securiti.
• IBM's 2026 edition puts the global average breach cost at USD 4.99 million, according to Securiti.

Key questions

Q: How should teams prioritise ROT data minimisation across hybrid estates?

A: Start with the repositories that are both widely accessible and poorly governed, because that is where stale content most quickly turns into exposure.

Q: Why does stale data create security and AI risk even when it is not obviously sensitive?

A: Because systems and users often treat stored content as authoritative once it is accessible.

Q: What breaks when ROT cleanup is managed manually?

A: Manual ROT programmes usually fail at scale because they depend on humans reviewing far too many objects across too many systems.

Practitioner guidance

• Implement continuous ROT discovery Scan cloud storage, SaaS platforms and on-prem file shares on a recurring basis so stale content is identified before it becomes embedded in business workflows.
• Classify content by business relevance Use context-aware data classification to separate current records from obsolete, trivial and redundant content, then attach handling rules that reflect actual business value.
• Prioritise remediation by exposure and use Triage ROT by whether it is accessible, regulated, shared broadly or available to AI retrieval paths, then remediate the highest-risk content first.

Bottom line: ROT data is a governance problem because stale content expands breach exposure, distorts AI outputs and hides across estates that no one has fully mapped.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →