Data masking can limit sensitive data exposure as AI use grows

As artificial intelligence tools and agents gain access to more enterprise data, organizations face a question: does each user or system need to see the original sensitive values to do its job?

Data masking replaces sensitive information with realistic but unusable values. The resulting data can retain characteristics needed for software development, testing and analytics without exposing the original information. Depending on the task, organizations can also use tokenization or encryption, or prevent an AI system from accessing a dataset.

Finding sensitive data is a challenge. The 2026 Thales Data Threat Report found that 34% of surveyed organizations had complete knowledge of where their data was stored, while 39% said they could classify all of it. Organizations reported using an average of seven tools for data protection and monitoring. Data may be copied across cloud services, development environments and backups, while sensitive details can also be hidden in unstructured documents.

Data security posture management (DSPM) focuses on discovering and classifying sensitive information, where it resides, and who or what can access it. Organizations can then decide whether to remove or restrict access, or apply protections such as masking, tokenization and encryption.

The report also found that 61% of organizations said attackers were targeting their AI applications, with sensitive data the leading target. The article argues that access to a database should not automatically grant an AI system access to every raw value in it. Applying least privilege to data means exposing what a task requires while protecting the rest.