andrew.gertz@t…
Thu, 10/29/2026 – 14:33
Thales | Security for What Matters Most
More About This Author >
Every haunted house has a basement nobody wants to visit. In most enterprises, that basement is a cloud storage bucket someone created years ago and forgot about. The customer records are still there, along with permissions nobody has checked in what seems like eons.
Meanwhile, copies of the same data have made their way upstairs: into a data lake, buried in unstructured documents, or sitting in SaaS applications. And now, generative and agentic AI gives automated systems a new way to reach all of it.
Fortunately, organizations can put a disguise on all this sensitive data.
Give Sensitive Data a Convincing Disguise
Data masking replaces sensitive information with realistic but unusable values. Developers, analysts, and applications can work with data that looks and behaves as expected without seeing the information underneath.
Masking is the cybersecurity equivalent of a good Halloween costume. The data can show up to the party, but it doesn't have to give its real name at the door.
That distinction is useful anywhere teams need production-like data without needing the sensitive information inside it. A developer testing an application may need records with the same format and characteristics as customer data, for example, but does not need real customer names or account numbers.
Masking keeps the dataset useful for the task without unnecessarily carrying those values into another environment.
The same principle applies when applications or AI systems use sensitive data. Access is only half the question. The other half is whether they need every sensitive value inside it in its original form. Having access to a dataset doesn't mean they need every sensitive value inside it in its original form.
Of course, the mask only works if organizations know where to put it.
Know What Needs a Mask
Sensitive data has a habit of spreading. It gets copied into new environments. Teams create new applications and repositories. Information collected for one purpose can later become available to systems that did not exist when it was created.
Data security posture management (DSPM) helps organizations find and classify that information. It can also show where sensitive data is stored, who or what has access to it, and how it is used. That context helps security teams spot data that has been duplicated somewhere unexpected or made available more widely than intended.
Finding the data is only half the job. The other half is applying appropriate protection. Depending on what DSPM turns up, the right disguise could be masking, encryption, or tokenization, while access that should never have been granted needs to disappear altogether.
DSPM gives security teams the context to choose the right protection for the data rather than handing every dataset the same costume.
AI Reaches into the Trick-or-Treat Bag
Copilots and agents are getting access to enterprise data faster than governance teams can keep up. By the time someone asks exactly what an AI system can see, sensitive information may already be within reach.
AI often has a legitimate reason to access enterprise data. A copilot may need information from internal documents to answer an employee's question. An agent may need access to business systems to complete a task. But neither use case automatically means the system needs every sensitive field it encounters along the way.
That makes it important to know what is inside a dataset before giving an AI system access to it. If an AI application needs information from a customer dataset, security teams need to know what else is sitting inside that dataset and whether the raw values are necessary for the task.
Where raw values are not needed, masking can reduce what the AI system sees without removing the useful data altogether, and encryption, tokenization, or tighter access controls can cover the rest. By limiting exposure to sensitive values, organizations can reduce the potential impact of compromised accounts and unauthorized access.
Halloween may only come once a year, but sensitive data can stay in its costume year-round. By masking the data, you can unmask the attackers.
studio
THALES BLOG How Data Masking and DSPM Protect Sensitive Data from AI
October 29, 2026
Read the original article: