A company uses AES-256 to encrypt sensitive data at rest. They store the encryption keys on the same server as the encrypted data. What is the primary risk associated with this practice?