What is unstructured data and why is it hard to secure?

Unstructured data is data without a predefined data model or fixed organization, such as documents, email, images, video and chat logs. It is hard to secure because you cannot ask a column what it holds. Sensitive content must be found by scanning the content itself, and copies spread quietly.

What does the standard definition say?

NIST's Big Data Interoperability Framework gives a short definition: structured data has a predefined data model or is organized in a predefined way, and unstructured data does not. It describes records in a business system as rows in a table where each cell has a known meaning, and it lists text, image and video as examples of unstructured sets.

It also names a middle category. Semi-structured data, in formats like XML or JSON, has an overall structure but individual elements that are themselves unstructured. A JSON support ticket with fields for id, date and a free-text "message" is the classic case. The fields can be queried. The message cannot, not reliably.

Why does that make security harder?

With a database, a schema tells you where the sensitive values live. A column named national_id can be encrypted, masked or access-controlled. With a folder of files, nothing marks which ones contain an ID number. The same card number can appear in a spreadsheet, a pasted email thread, a screenshot and a scanned PDF.

NIST also notes that relational databases tend to handle these data types as text or binary objects, with limited ability to analyze or index them directly. In practice that means the controls built around tables (field-level rules, column permissions) often do not see inside the blob.

Three further problems follow:

• Copying is cheap. People attach, download, forward and paste. Each copy has its own permissions, or none.
• Context decides sensitivity. A contract draft is harmless until it names a customer and a price.
• Retention is invisible. Nobody schedules deletion for a file nobody remembers.

A constructed example

Imagine a 40-person engineering firm. The customer database is well governed: encrypted at rest, access reviewed quarterly. Meanwhile a shared drive holds years of project folders. A support engineer once exported 300 customer records to a spreadsheet to debug an import, then uploaded it to a project folder that the whole company can read. The database controls are fine, and the data is sitting in the open anyway. This is an invented scenario, but the pattern is common.

Now add an AI assistant that indexes the shared drive for search. Anyone can ask it a question, and it may surface the spreadsheet's contents to a person who could technically already open the file but would never have found it. Unstructured data that was safe through obscurity stops being obscure.

How to check or apply this

1. List where unstructured data accumulates: file shares, cloud drives, email, chat exports, ticket attachments, backups, code repositories and notebooks.
2. Scan content for the patterns that matter to you (ID formats, card numbers, secrets, health terms) and sample the results by hand, because pattern matching produces false positives.
3. Label what you find using a small scheme people will actually use, three or four levels at most.
4. Fix sharing first. Public links, "anyone in the company" folders and old guest access are the cheapest wins.
5. Set retention by location and label so old exports expire.
6. Decide what search and AI tools may index. Make indexing respect the permissions of the person asking.
7. Repeat on a schedule. New files appear every day.

Source code repositories are unstructured data too, and credentials are the most damaging thing that ends up in them. Safeguard's scanning covers secrets and dependencies in code, and Gold offers a free in-browser scan at gold.safeguard.sh/scan for up to 100 dependencies. It does not classify general business documents.

Quick check

Sources

• NIST Special Publication 1500-1 Revision 2, NIST Big Data Interoperability Framework: Definitions

Last reviewed: 18 October 2026.