New CTERA Research Reveals Just 4.4% of Enterprise Storage Is Actively Used

Analysis of 16 petabytes of enterprise file-share discovery scans found that large volumes of inactive data are increasing storage costs, expanding security exposure, and reducing organizations' readiness for AI deployment. The findings highlight operational and cybersecurity risks from unmanaged data estates, though no company-specific financial impact was disclosed.

Analysis

The investable implication is not broad AI spending but a shift in enterprise storage budgets from capacity expansion toward data classification, retention enforcement, backup immutability and access controls. RBRK is the clearest public beneficiary because dormant data becomes valuable only after it is cataloged and governed; its subscription model can monetize compliance-driven workflows better than hardware-centric vendors. NTAP and PSTG face a mixed effect: remediation projects can support higher-value flash, tiering and data-management software, but aggressive deletion and archive policies reduce raw capacity demand at customers with constrained IT budgets.

The claimed AI-readiness benefit should be discounted until it appears in procurement data. Most enterprises will first fund mandatory risk reduction after a breach, audit finding or insurance renewal rather than undertake a discretionary cleanup for future AI use; this favors cyber-resilience vendors over AI infrastructure names in the next 1-3 months. Over 6-18 months, stricter retention rules and rising breach liability could create a durable data-governance spend category, but hyperscaler storage price cuts and native Microsoft/AWS/GCP governance tooling are the principal multiple risk for standalone vendors.

Consensus may overestimate the amount of data that can be economically deleted. Legal hold, sector-specific retention requirements and uncertainty over future model-training value make deletion decisions slow, creating a larger opportunity in discovery, classification and policy automation than in storage-volume contraction. The thesis is falsified if RBRK fails to show improving net-new subscription growth or rising large-deal activity while enterprise storage consumption remains resilient, indicating that customers are tolerating sprawl rather than funding remediation.

Key Decisions for Investors

• Maintain a 3-6 month watch-to-long bias on RBRK, but wait for evidence of large-enterprise subscription acceleration or raised FY guidance before initiating; target a 15-20% upside on evidence that governance and cyber-recovery attach rates are improving, with a stop if next reported net-new ARR materially decelerates.
• Avoid treating this as a broad long catalyst for AI infrastructure or generic storage. For NTAP and PSTG, monitor bookings mix and capacity-growth commentary over the next two earnings cycles; consider a tactical short only if management identifies cleanup/optimization as a material drag on consumption, not merely an isolated customer behavior.
• Use a relative-value screen rather than a directional cybersecurity basket: favor RBRK versus legacy capacity-exposed storage vendors if enterprise security budgets are being reallocated. Exit the pair if hyperscaler-native data-governance offerings begin driving pricing pressure or if RBRK's gross-margin trajectory weakens.
• Set an event alert around major breach disclosures, new retention/privacy enforcement actions, and cyber-insurance renewal surveys over the next 6-12 months; these are more credible spend catalysts than generalized AI-readiness messaging.