Data masking is becoming increasingly relevant as artificial intelligence systems gain broader access to enterprise information. The technique does not erase sensitive data; instead, it hides its original identity while preserving enough of the data’s usefulness for legitimate business tasks.

Developers may need representative customer data to test applications, while analysts need to preserve relationships and patterns to identify trends. In both cases, access to genuine identities, account numbers or other sensitive values may not be necessary. Masking replaces those values with realistic but unusable alternatives, allowing organizations to work with the data without exposing its original contents.

Organizations can also use tokenization and encryption, depending on how the information must be used. The underlying principle is to apply protection based on the task rather than automatically making raw sensitive data available.

However, businesses must first know where their sensitive information is stored. The 2026 Thales Data Threat Report found that 34% of surveyed organizations had complete knowledge of their data’s location, while 39% said they could classify all of it. Respondents also reported using an average of seven tools for data protection and monitoring.

cloud environments add to the challenge because information may be duplicated across data lakes, software-as-a-service platforms, development environments and backups. Sensitive details can also remain hidden in unstructured documents or become accessible to applications created long after the data was collected.

Data security posture management addresses this problem by focusing on the data itself. It involves discovering and classifying sensitive information, identifying where it resides, understanding who or what can access it, and assessing whether current safeguards are appropriate. Once unnecessary exposure is identified, organizations can remove or restrict access or apply measures such as masking, tokenization and encryption.

The issue is becoming more significant as companies move from experimenting with Generative AI to using it in daily operations. AI applications need information to produce results, while agents may require broader access to retrieve data, make decisions and act across multiple systems.

According to the same research, 61% of organizations said their AI applications were being targeted by attackers, with sensitive data identified as the leading target. Rapid change in the AI ecosystem was the most frequently cited AI security risk.

Applying least-privilege principles to AI can limit these risks. Access to a database should not automatically provide an AI system with every raw sensitive value it contains. Depending on the circumstances, organizations may mask personal information before it reaches development or testing environments, tokenize particularly sensitive values, encrypt data and tightly control decryption, or block an AI system from accessing a dataset altogether.

The approach relies largely on established data-security practices: identifying where sensitive information resides, understanding its context, minimizing unnecessary access and protecting data according to how it is used. As applications and AI systems evolve, those decisions also need to be reassessed.

Sources: TechRadar.