--- title: "How to Protect Unstructured Data in Cloud Computing │ Commvault" type: "BlogPosting" language: "en-US" url: "https://www.commvault.com/blogs/protect-unstructured-data-cloud-computing" date: "2026-10-16T10:23:19-04:00" modified: "2026-10-21T15:58:07-04:00" description: "Help improve data security in cloud computing with Commvault Cloud classification, encryption, immutable backup, and recovery for unstructured cloud data across hybrid environments. " image: "https://www.commvault.com/wp-content/uploads/2026/10/clouds-888x500-1.png" authors: - name: "Sam Curcuruto" jobTitle: "Director, Product Marketing, Commvault" breadcrumbs: - name: "Commvault Home" url: "https://www.commvault.com/" - name: "Blogs" url: "https://www.commvault.com/blogs" - name: "Protect unstructured data cloud computing" --- # How to Protect Unstructured Data in Cloud Computing ## How Enterprises Can Help Protect Unstructured Data in Cloud Computing As unstructured data spreads across cloud environments, enterprises need to know what data matters, where exposure exists, and how recovery should work. Stronger cloud data security starts with classification, access control, protected recovery copies, and restoration plans tied to business impact. **Sam Curcuruto**, Director, Product Marketing, Commvault Published October 16, 2026 ![](/wp-content/uploads/2025/08/1_Hero_RSA_650x650_1-4.jpg) --- - [Key Takeaways: Governing Unstructured Data](#key-takeaways) - [Why Is Unstructured Cloud Data Hard to Protect?](#protect) - [How Does Classification Help Improve Cloud Data Security?](#improve) - [Why Does Immutable Backup Matter for Cloud Data?](#why) - [How Should Enterprises Recover Unstructured Cloud Data?](#how) - [FAQs](#faq) - [Resources](#resources) --- ### Key Takeaways: Governing Unstructured Data Unstructured cloud data is typically easier to govern when teams connect classification, access control, backup integrity, and recovery planning across production and backup environments. - Sensitive data classification helps cloud teams separate regulated, high-value, and overexposed information from lower-risk content – giving Commvault® Cloud [Data & AI Security](https://www.commvault.com/solutions/data-and-ai-security) the context to connect discovery to policy decisions. - Access decisions should follow data sensitivity, not storage location – Commvault Cloud [Risk Analysis is designed to](https://www.commvault.com/platform/risk-analysis) identify sensitive content across production and backup environments to help prioritize remediation where exposure creates compliance or recovery risk. - For unstructured data, backup strategy should reflect business importance and recovery needs. Commvault Cloud [File & Object Backup](https://www.commvault.com/platform/file-object-backup) helps support protection across cloud and hybrid systems, giving teams a consistent way to recover files and objects without treating every dataset as equal. - Immutable and indelible backup copies help add resilience when ransomware, deletion, or account compromise affects production data. [Commvault AirGap](https://www.commvault.com/platform/commvault-air-gap) helps support that recovery layer by storing isolated copies separately from production, giving teams another path when primary cloud data is no longer trustworthy. - Recovery plans are typically stronger when teams can evaluate data before returning it to production. In Commvault [Cleanroom](https://www.commvault.com/platform/commvault-cleanroom)™, unstructured cloud data can be staged in an isolated environment, helping give teams a safer way to test workflows, validate files, and refine restoration priorities. ## Related Capabilities - [File & Object Backup](https://www.commvault.com/platform/file-object-backup) - [Data & AI Security](https://www.commvault.com/solutions/data-and-ai-security) - [Commvault AirGap](https://www.commvault.com/platform/commvault-air-gap) - [Commvault Cleanroom](https://www.commvault.com/platform/commvault-cleanroom) ## Ready to get started? [Get a demo](/request-demo) [Contact sales](/contact-us) --- Enterprises can protect unstructured data in cloud computing by first regaining visibility into where sensitive and business-critical information resides. From there, they can apply classification-based controls, protect recoverable copies, and test restoration workflows. The goal is to help limit exposure, support compliance needs, and recover cloud data with greater confidence after disruption. Unstructured data grows across teams, platforms, and business processes without the same structure that governs databases or core applications. That can make it harder to know which information is sensitive, which data is overexposed, and which content the business would need first after a disruption. When organizations cannot see and classify their unstructured data, they may struggle to apply the right access controls, prove compliance, or understand what should be recovered after ransomware, accidental deletion, or cloud service disruption. IBM reported that the [global average cost of a data breach reached USD $4.99 million](https://www.ibm.com/reports/data-breach) in 2026, while the United States average reached USD $11.5 million. Those figures give cloud data security a practical business context: Unclear data ownership and weak recovery planning can turn scattered files into operational risk. Effective data security in cloud computing starts with better context: - **Classification** helps teams understand what data matters. - **Encryption and access controls** help limit exposure. - **Immutable backup and cloud-native recovery** help organizations recover with more confidence when production data is no longer trustworthy or available. Together, these practices help move unstructured cloud data from unmanaged sprawl toward a more resilient operating model. --- ## Why Is Unstructured Cloud Data Hard to Protect? Unstructured data becomes risky when it grows faster than an organization’s ability to understand it. The challenge is not only do enterprises have more files, objects, and cloud repositories than before, but the business meaning of that data is often unclear. A document may contain regulated information, operational detail, intellectual property, or AI training value, but cloud storage alone does not reveal that context. That lack of context can weaken data-security decisions. Teams may know where data is stored without knowing who should access it, whether it should be retained, or how urgently it would need to be recovered after disruption. The result is a gap between infrastructure visibility and data-level understanding. That gap matters because cloud environments make it easy for data to move, multiply, and become part of downstream workflows before governance teams have a complete view. A [2026 Cloud Security Alliance study](https://cloudsecurityalliance.org/press-releases/2026/03/31/unstructured-data-surges-as-enterprises-struggle-to-maintain-visibility-and-security-cloud-security-alliance-study-finds?utm_source=chatgpt.com) found that 68% of organizations reported a significant portion of their unstructured data remains unprotected, while another 10% were unsure of their coverage. That gap shows why classification is a practical cloud data security requirement, not just a governance exercise. Commvault® Cloud [Data & AI Security](https://www.commvault.com/solutions/data-and-ai-security)capabilities are designed to help teams discover and classify sensitive data across cloud and hybrid environments. That classification gives data owners, data security teams, and recovery teams a shared foundation for decisions. Instead of treating unstructured data as a storage management issue, teams can assess exposure, sensitivity, business value, and recovery importance before applying controls. The outcome is clearer ownership and a more defensible data security posture for cloud computing. --- > 92% > > of organizations reporting an AI-related breach lacked proper AI access controls. > > Source: IBM Cost of a Data Breach Report 2026 --- ## How Does Classification Help Improve Cloud Data Security? Classification helps improve cloud data security by turning unknown content into actionable context. Without classification, access policies often depend on where data lives or which team owns the system. That may work for a narrow repository, but it breaks down when the same type of sensitive data appears across departments, cloud services, analytics workflows, and backup copies. The organization may have a policy, but it may not know where that policy should apply. A [classification-based approach](https://www.commvault.com/solutions/classification) starts with the sensitivity and business value of the data. Once teams know whether content includes regulated information, proprietary material, or business-critical records, they can make better choices about access, encryption, retention, masking, and recovery priority. The goal is not to restrict everything by default. It is to apply controls that match the risk and use case, so data remains available for legitimate business activity without creating unnecessary exposure. This is especially important as organizations prepare unstructured data for AI and analytics. Governance leaders should evolve strategies for managing, protecting, and using unstructured data while meeting compliance and data security requirements. That makes classification a practical step toward responsible data use, not just a compliance exercise. [Commvault Cloud Risk Analysis](https://www.commvault.com/resources/datasheet/proactively-defend-data-with-commvault-risk-analysis)can help teams find, categorize, and take action on sensitive data in production and backup environments. That matters because risk does not stop at the primary cloud repository. Backup copies, retained versions, and secondary datasets can also contain sensitive information. When classification extends across those environments, teams gain a clearer view of what should be remediated, what should be retained, and what may need added controls before recovery or reuse. The outcome is better decision-making. Classification helps give teams a way to align data security controls with actual data risk, rather than relying on assumptions about folders, storage tiers, or application ownership. --- ## Why Does Immutable Backup Matter for Cloud Data? Immutable backup matters because cloud data security cannot depend only on the production environment. If data is encrypted by ransomware, deleted by mistake, altered by a compromised account, or made unavailable through a service disruption, teams should have a recovery path that does not rely on the same systems under stress. For unstructured data, that recovery path can be difficult to manage because the data estate is broad, fast-moving, and unevenly governed. This is where backup strategy becomes part of data security in cloud computing. The question is not simply whether a backup exists. Teams should know whether protected copies are separated from production risk, whether retention settings match business and compliance needs, and whether recovery teams can identify the right data to restore. Immutable and indelible copies help support that strategy by limiting changes to protected backup data during the retention period. --- > >40% > > of ransomware attacks had a hybrid component, raising the stakes for recovery plans that span cloud, on-premises, and connected environments. > > Source: Microsoft Digital Defense Report 2025 --- Commvault Cloud File & Object Backup helps organizations protect unstructured data across cloud and hybrid systems, while Commvault AirGap helps support isolated, immutable, and indelible backup copies stored separately from production. Together, these capabilities help give teams more flexibility when primary data can no longer be trusted. Classification can further improve the process by helping teams decide which data requires longer retention, which copies carry sensitive information, and which datasets should be restored first. --- ## How Should Enterprises Recover Unstructured Cloud Data? Recovering unstructured cloud data should start with business priority, not storage volume. During disruption, the fastest path to useful recovery is rarely to restore everything at once. Some data supports revenue operations, customer service, regulatory obligations, or AI workflows. Other data may be outdated, redundant, or low value. Recovery plans should distinguish between those categories before an incident forces rushed decisions. The challenge is that [unstructured data](https://www.commvault.com/explore/unstructured-data) often lacks clear recovery logic. A database may have defined application dependencies, but a large file or object environment can contain mixed content with different owners, sensitivity levels, and business uses. If teams have not classified that data before disruption, they may struggle to decide what is clean, what is critical, and what can wait. That uncertainty can slow restoration and increase the chance of returning risky or unnecessary data to production. IBM’s [2026 Cost of a Data Breach Report](https://www.ibm.com/reports/data-breach) found that breaches involving data across multiple environments took 256 days to identify and contain, the longest of any storage location category. That extended timeline reinforces why recovery planning cannot wait until an incident: teams need classification, ownership, and restoration priorities in place before fragmented cloud data becomes part of a broader disruption. The reality organizations often face is that threats and signals move faster than manual recovery planning can comfortably handle. Commvault [Cleanroom](https://www.commvault.com/platform/commvault-cleanroom) helps give teams an isolated environment for recovery testing, cyber forensics, and staging. For unstructured data, that isolation creates room to validate recovery decisions before production systems are involved. Commvault [Threat Scan](https://www.commvault.com/platform/threat-scan) is designed to also analyze backup content to help identify suspicious, encrypted, or corrupted files that may affect recovery quality. The organizations that recover fastest after cloud disruption won’t be those with the most backup storage – they’ll be the ones that understood their data before the incident. Classification, protection, and tested recovery are not separate workstreams. They are the same resilience program, practiced before it matters most. --- ## Frequently Asked Questions Why is unstructured cloud data hard to govern? Unstructured cloud data becomes risky when teams cannot easily tell what is sensitive, who can access it, or how it supports the business. Commvault Cloud [Data & AI Security allows](https://www.commvault.com/solutions/data-and-ai-security) organizations to classify sensitive data so controls reflect actual exposure and business value. How should cloud files be backed up? Cloud files should be backed up according to their business importance, sensitivity, and recovery requirements. Commvault Cloud [File & Object Backup](https://www.commvault.com/platform/file-object-backup) helps support that approach by protecting unstructured data across cloud and hybrid environments without treating every dataset as the same priority. Why use immutable cloud backup? Immutable cloud backup gives recovery teams a protected copy that is harder to alter during ransomware, deletion, or account compromise scenarios. Commvault [AirGap helps](https://www.commvault.com/platform/commvault-air-gap)add separation from production environments, which can help preserve another recovery path when primary cloud data is no longer trustworthy. How does clean recovery help improve restoration? Before data returns to production, teams need confidence that recovered files are usable and not carrying forward signs of compromise. With [Commvault® Cleanroom](https://www.commvault.com/platform/commvault-cleanroom), they can stage unstructured cloud data in an isolated environment and evaluate whether files appear clean, suspicious, or affected by an incident. Can backups help reveal ransomware activity? Backups can help reveal ransomware activity when protected data is analyzed for suspicious changes, encryption patterns, or corrupted files. Commvault [Threat Scan](https://www.commvault.com/resources/demos/commvault-cloud-threat-scan) supports that process by examining backup content so teams can better understand which files may affect recovery quality. How can teams help locate sensitive data across the organization? Teams can help find sensitive data by scanning production and backup environments for content that may require stricter controls. Commvault Cloud [Risk Analysis](https://www.commvault.com/platform/risk-analysis) helps categorize that data, giving security and governance teams a clearer path to prioritize remediation across cloud repositories and protected copies. --- Explore Related Resources ## Keep Building Your Cloud Data Security Strategy [View all](/resources) ![](/wp-content/uploads/2025/08/Resource_Datasheet_VM-Backup_888x500-6.jpg) Video ## Data & AI Security Explained Classification and access controls can help support sensitive data governance across cloud, on-premises, and AI environments. [Watch video about Data & AI Security Explained](https://www.commvault.com/resources/video/protect-sensitive-data-in-the-age-of-ai) ![](/wp-content/uploads/2025/10/cyber-resilience-888x500-1.png) Datasheet ## Cyber Resilience for File and Object Data File and object backup can help protect unstructured data across cloud and hybrid systems. [Read more about Cyber Resilience for File and Object Data](https://www.commvault.com/resources/datasheet/file-and-object-backup) ![](/wp-content/uploads/2025/10/dd-cloud-data-protection-888x500-1.png) Report ## Architecting Cloud Data Resilience MIT Technology Review defines how a recoverable architecture helps support cloud data resilience. [Read the report about Architecting Cloud Data Resilience](https://www.commvault.com/resources/analyst-report/architecting-cloud-data-resilience)