Data Security Report Reveals 99% of Orgs Have Sensitive Information Exposed to AI
Varonis' 2025 State of Data Security Report shares findings from 1,000 real-world IT environments to uncover the dark side of the AI boom and what proactive steps orgs can take to secure critical information.
Key Takeaways
AI is everywhere. Copilots help employees boost productivity and agents provide front-line customer support. LLMs enable businesses to extract deep insights from their data.
Once unleashed, however, AI acts like a hungry Pac-Man, scanning and analyzing all the data it can grab. If AI surfaces critical data where it doesn’t belong, it’s game over. Data can’t be unbreached.
And AI isn’t alone — sprawling cloud complexities, unsanctioned apps, missing MFA, and more risks are creating a ticking time bomb for enterprise data. Organizations that lack proper data security measures risk a catastrophic breach of their sensitive information.
To quantify AI’s impact on data risk, Varonis produced the 2025 State of Data Security Report: Quantifying AI’s Impact on Data Risk. Download the full report and continue reading to learn about the latest risks to data in 2025.
About the report
Our team analyzed data from 1,000 real-world IT environments and found that no organization was breach proof. In fact, 99% of organizations have exposed sensitive data that can easily be surfaced by AI.
The 2025 State of Data Security Report examines nearly 10 billion — yes, billion — files and deep dives into the data risks associated with AI, cloud environments, and some of the most popular SaaS apps and services, such as Microsoft 365, AWS, Box, Salesforce, and many others.
Below are just a few key findings from our research:
- We found that 98% of organizations have unverified apps, including unsanctioned AI, also known as shadow AI, which increases the risk of exposure and data breaches.
- The largest breach of 2024 was attributed to missing MFA. We discovered that 1 in 7 orgs do not use or enforce MFA across their SaaS and multi-cloud environments.
- Stale accounts remain dangerous after a user’s last login, and 88% of the orgs have stale but enabled ghost users in their environments.
- Despite the importance of labeling, only 1 out of 10 companies had labeled files.
- 66% of companies have cloud data exposed to anonymous users.
Alongside these alarming stats, our experts share proactive steps to help secure your critical data throughout the report.
Ready to learn more?
Download the Varonis 2025 State of Data Security Report today.
