Topic starter
12/06/2026 9:48 pm
TL;DR: Unmanaged dark data creates a governance gap because security controls only protect what organisations have inventoried, classified, and placed under review, according to Netwrix. Splunk's State of Dark Data survey cited in the article says 55% of enterprise data is dark on average, so discovery and lifecycle control become the real security boundary.
Editorial analysis by NHI Mgmt Group, based on content published by Netwrix: “Dark data explained: Why invisible data is a security problem”.
By the numbers:
- 55% of enterprise data is dark on average, according to Splunk's State of Dark Data survey cited by Netwrix.
Key questions
Q: What breaks when dark data is not inventoried?
A: When dark data is not inventoried, classification, retention, encryption, and access review all lose their operational target.
Q: Why does dark data create compliance risk even in sanctioned systems?
A: Because sanctioned systems can still accumulate unmanaged copies, exports, logs, and backups that fall outside documented retention and classification rules.
Q: How do security teams find dark data without scanning everything at once?
A: Start with the highest-risk repositories first, especially production-linked cloud storage, legacy shares, collaboration platforms, backups, and SaaS export locations.
Practitioner guidance
- Define a tiered discovery scope Start with the stores most likely to contain regulated data and the weakest controls, including production-linked cloud storage, legacy file shares, Microsoft 365, and SaaS exporters.
- Run automated classification against in-scope stores Scan file systems, object storage, databases, and collaboration platforms in read-only mode first, then export discovered stores, sensitivity labels, and effective permissions as a single inventory set.
- Assign ownership before deletion decisions Require a named business owner for every discovered store and escalate unowned repositories to data governance for assignment within a fixed window.
Bottom line: Dark data is a governance failure because unknown stores sit outside the controls that normally protect regulated information.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 12:09 am
Dark data is a governance failure before it is a storage problem: once data is outside inventory, every downstream control becomes partial. DLP, access governance, and encryption cannot cover unknown stores, so the security programme ends up protecting what it already knows rather than what is actually present. The practical conclusion is that visibility, not policy volume, is the limiting factor in data security.
A few things that frame the scale:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: What should teams do immediately after discovering an unowned data store?
A: Assign an accountable owner, verify whether the data is still needed, and determine whether current access matches least privilege. If the store has no legitimate business purpose, move it into the deletion path after legal hold and retention checks. Ownership is the decision point.
👉 Read our full editorial: Dark data is exposing the blind spots in data governance
This post was modified 6 days ago by NHI Mgmt Group