More than six in 10 organisations have suffered file-related data breaches from negligent or malicious insiders in the past two years, with each incident costing an average of $2.7million, according to new research from the Ponemon Institute, sponsored by infrastructure protection firm OPSWAT.
The State of File Security study surveyed organisations to understand the primary threats to file security and the measures being taken to address them. The research identified insiders as the single greatest threat, with 45 per cent of respondents citing negligent or malicious insiders leaking data as the most serious risk.
This far surpassed concerns about external actors. Other top risks included a lack of visibility and control over file access (39 per cent) and vendors providing malicious files or applications (33 per cent).
Vulnerabilities in file sharing and AI complexity
The report also highlighted significant vulnerabilities at critical points of data exchange. Only 39 per cent of respondents expressed confidence that files remain secure when being transferred to and from third parties, and just 42 per cent felt confident during the file upload stage. The environments identified as posing the greatest risk were on-premise file storage systems like SharePoint (42 per cent) and web file uploads via public portals (40 per cent).
The growing complexity of artificial intelligence was also identified as a contributing factor to increased risk. The report notes that adversaries are now exploiting generative AI models, for example by embedding malicious prompts in macros or exposing hidden data through AI parsers.
In response, many organisations are turning to AI for faster threat detection and cost reduction. Currently, 33 per cent of organisations have integrated AI into their file security strategies, with an additional 29 per cent planning to do so by 2026.
However, governance around AI use remains inconsistent. Only 25 per cent of organisations have a formal generative AI policy in place, while 29 per cent have banned its use altogether.
“As threats continue to accelerate and increase in cost, cyber resilience has shifted from being a technical priority to being a strategic, fiscal imperative,” said Dr. Larry Ponemon, founder of the Ponemon Institute. “Executives must take ownership by investing in technology that reduces risk and cost while enabling organisations to keep pace with an ever-evolving AI landscape.”
Shift towards unified platforms
The study also revealed a clear trend away from legacy point solutions towards more unified, multi-layered platforms for file security. These platforms often incorporate technologies such as multiscanning, Content Disarm & Reconstruction (CDR), and adaptive sandboxing. By 2026, two-thirds of the enterprises surveyed expect to be using these advanced technologies.
George Prichici, vice president of products at OPSWAT, added: “A multi-layered defence that combines zero-trust file handling with advanced prevention tools is no longer optional but is the standard for organisations looking to build resilient, scalable security in the AI era. Leveraging a unified platform approach allows file security architectures to adapt to new threats and defend modern workflows and complex file ecosystems inside and outside the perimeter.”
