The data reckoning: How exponential growth is rewriting the rules of cost, risk and AI

Something structural is happening to enterprise data and most organizations are only beginning to fully understand. Data volumes are growing faster than any original assumptions about how to store, govern and extract value from information. At the same time, the cost of getting it wrong is rising sharply: inflated infrastructure spend, expanding cyber exposure and AI initiatives that stall because the data feeding them cannot be trusted. These are not separate problems. They are three symptoms of the same underlying condition.

Unstructured data, the billions of documents, emails, images, videos, collaboration files and machine-generated logs that now account for up to 90% of all stored enterprise data, has been accumulating for decades. What has changed is the convergence of three forces that make the current moment categorically different from what came before. AI has made data quality a board-level concern. Cyber threats have made data visibility vital. And infrastructure economics have made uncontrolled data growth a direct problem for the bottom line. CIOs are now being asked to address all three simultaneously, with environments that were never designed for any of them.

When it comes to cost, the default response to data growth was to buy more storage. That approach is no longer financially sustainable, and AI has made it counterproductive. Unprecedented demand for AI infrastructure is compressing storage component supplyhttps://cyberscoop.com/ibm-cost-data-breach-2025/ and driving prices up at precisely the moment when organizations need more capacity than ever. But raw capacity is not the problem. The problem is that most of what organizations are paying to store is data they cannot see, cannot evaluate and cannot be confident is worth keeping. Duplicated, outdated and poorly governed datasets do not just waste money; they feed the AI models with garbage that enterprises are now basing their competitive futures on.

Invisible data is unmanaged risk 

The risk dimension is equally urgent. As data volumes grow, so does the attack surface. Organizations facing a breach today are not just dealing with the incident itself, they are dealing with the consequences of years of ungoverned data accumulation: sensitive information in unexpected locations, excessive permissions that were never reviewed and exposures that only become visible at the worst possible moment. Yet despite continued investment in AI and security initiatives, a striking number of enterprises still lack basic enterprise-wide visibility into what their unstructured data environments actually contain.

The questions that should have straightforward answers often do not. What data does the organization actually hold? Where does it reside? Who owns it? Who can access it? Does it carry regulatory obligations? Does it have any remaining business value at all? The inability to answer these questions is not just an operational inconvenience; it is a direct source of financial waste, governance exposure and strategic constraint. Organizations cannot optimize what they cannot measure, and they cannot protect what they cannot find.

Part of what makes this so difficult is the structural fragmentation of modern data environments. Files are distributed across hybrid cloud architectures, multiple vendors, legacy on-premises systems and purpose-built applications, each with its own access model, metadata schema and governance history. There is no single view. The result is an environment where data accumulates faster than anyone can track it, and where the cost and risk implications compound quietly in the background.

This has driven significant investment in data discovery and classification technologies, which have matured rapidly as organizations have recognized the urgency of understanding what they hold and where the exposure lies. The ability to identify sensitive data across enterprise environments, flag orphaned assets and surface excessive permissions has become an essential capability.  

Yet insight alone is not enough, and this is where many organizations find themselves getting stuck. The gap between knowing there is a problem and being able to fix it at scale is often huge. Understanding that sensitive data exists in the wrong location is not the same as being able to move, govern or remediate it across an environment containing hundreds of millions of files. Identification and action are two entirely different capabilities, and most organizations have invested heavily in the former without building the latter.

From reactive to intentional: the governance imperative

Most enterprises are already paying the price of ungoverned data growth — in wasted infrastructure spend, governance failures and AI initiatives that underdeliver. The challenge for CIOs is not building the case for action; it is building the capability to act at the scale the problem demands.

Three principles define the organizations that are getting this right. The first is that governance must be an operational discipline, not a periodic audit. Permissions drift. Data relevance decays. Compliance requirements evolve. An environment that was well-governed six months ago may present material risk today, and the only way to stay ahead of that is through continuous visibility and the ability to act on what it reveals at scale, automatically, and consistently across the entire estate.

The second principle is that not all data has equal value and treating it as though it does is a significant source of unnecessary cost and risk. A substantial proportion of the data consuming expensive primary storage in most enterprises has not been accessed in years and has no clear owner. It generates infrastructure spend, expands the attack surface and adds noise to AI environments, all without contributing any business value. Understanding this in granular detail across the full environment is the precondition for doing anything about it.

In many environments, the lifespan of data is shorter than organizations assume. Information that was critical six months ago may be commercially irrelevant today, but it continues to consume storage, appear in security scans and potentially influence AI outputs. The cost is real and recurring. The risk compounds silently. And the AI-readiness implications are direct: models trained or augmented with stale, duplicated or irrelevant data produce outputs that cannot be trusted, undermining confidence in the entire AI program.

The third principle is that lifecycle management and governance are the same discipline, not separate workstreams. Aligning data with its appropriate storage tier, based on value, access patterns, risk profile and compliance requirements, simultaneously reduces cost, narrows the attack surface and improves the quality of the datasets available for AI. These outcomes are not in tension. They are achieved through the same underlying capability: knowing what data exists and being able to act on that knowledge consistently across a fragmented, multi-platform environment.

This is not a one-time remediation project. The data growth that created the current situation is not slowing down — it is accelerating, driven by AI workloads, collaboration platforms and the instrumentation of almost every business process. The organizations that will manage this effectively are not those that periodically clean up their data estates; they are those that have built ongoing operational capability to align data with business value, continuously enforce governance and ensure that the information powering their AI and analytics initiatives is trusted, current and accessible. For CIOs, building that capability is not just a technology decision, it’s a business one.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?