TL;DR: Tokenization and encryption address different points of exposure for sensitive data, but Strac argues both still need DLP, DSPM, and key management controls when SaaS, cloud, GenAI, and MCP workflows move data into usable form. The governance gap is not which method is stronger, but where sensitive data remains accessible to humans, systems, and AI agents.
At a glance
What this is: This is an analysis of tokenization versus encryption for sensitive data protection, with the key finding that neither control closes the exposure gap once data is usable inside GenAI and MCP workflows.
Why it matters: IAM, NHI, and data-security teams need to treat usable-data exposure as a governance problem, because controls that protect ciphertext do not automatically govern what AI systems, service accounts, and users can access next.
Context
Tokenization and encryption are both data protection controls, but they solve different exposure points. Encryption protects data by making it unreadable without keys, while tokenization substitutes the sensitive value with a surrogate token; neither control, by itself, governs where data becomes usable again in SaaS, GenAI, or MCP workflows.
For identity and access teams, the practical problem is not the cryptographic format alone. Once sensitive data is decrypted or detokenized for legitimate use, it becomes reachable by humans, applications, service accounts, and AI-connected tooling, which means DLP and DSPM have to sit around the workflow, not just the storage layer.
The article’s central claim is that modern data protection depends on layered governance across discovery, masking, redaction, and access control. That is especially true where AI prompts, agent tool calls, and MCP connections move regulated or confidential data between systems faster than traditional encryption policy can account for.
Key questions
Q: What breaks when encryption or tokenization is the only protection for GenAI workflows?
A: The break point is usable-data exposure. Once sensitive information is decrypted or detokenized for legitimate processing, encryption no longer governs who can see or reuse it. GenAI prompts, connector outputs, and downstream tool calls can still leak that data unless DLP, redaction, and access controls are placed around the workflow itself.
Q: When should organisations prioritise DLP over stronger tokenization or encryption schemes?
A: They should prioritise DLP when the main risk is not storage compromise but disclosure during processing, prompting, or retrieval. If business users, SaaS tools, service accounts, or AI agents must see the original value, then the decisive control is what happens around the data flow, not just how strongly the data is protected at rest.
Q: What are the signs that GenAI is exposing data after encryption or tokenization?
A: Common signs include sensitive values appearing in prompts, model outputs, logs, connector traces, export files, or agent handoffs. Another signal is when teams can prove data was protected in storage but cannot explain how it stayed contained once workflows needed the readable form. That gap usually means runtime inspection is missing.
Q: How should teams govern AI agents that use MCP?
A: Treat each connected agent as a non-human identity with an owner, a scope, and a review cycle. The practical control set is familiar: least privilege, secret rotation, access expiration, and auditability across the systems the agent can reach.
Technical breakdown
How encryption and tokenization fail at the usable-data boundary
Encryption converts plaintext into ciphertext using a key, while tokenization swaps the original value for a non-sensitive surrogate stored separately. Both are effective at reducing direct exposure, but neither changes what happens when a business process needs the original value back. At that point, the data must be decrypted or detokenized, and the control boundary moves from storage protection to runtime governance. In GenAI and MCP environments, that is the critical difference: protection at rest does not automatically protect data once a model, workflow, or service account can access the usable form.
Practical implication: govern the point where data becomes usable, not only the point where it is stored.
Why DLP matters more once GenAI can see sensitive data
GenAI workflows create a new exposure surface because prompts, responses, connectors, and retrieval pipelines can carry secrets, PII, PHI, PCI, and business data into model contexts. Tokenization and encryption can reduce what is stored, but they do not stop an AI system from learning, reproducing, or forwarding sensitive patterns once the data is presented in usable form. DLP becomes the runtime control that can detect, redact, block, or alert before sensitive content reaches prompts or downstream tools. That makes the issue one of data movement governance, not just data format choice.
Practical implication: place DLP controls in front of prompts, connectors, and exports, not only in storage systems.
What MCP changes for machine identity and data access
MCP creates a structured path between AI agents and enterprise tools, which means the security question shifts to what data an agent can request and pass along. If an agent is authorized to retrieve business data from SaaS systems, it may encounter values that were previously protected by encryption at rest or tokenization in storage. That does not make the cryptography useless, but it does mean the access pathway is now part of the exposure model. In NHI terms, the relevant control plane is credentialed access plus inspection of what is allowed to traverse the workflow.
Practical implication: treat MCP-connected agents as governed data movers and inspect their retrieval and forwarding rights.
Threat narrative
Attacker objective: The objective is to obtain or propagate sensitive business data from a workflow that was assumed to be protected by encryption or tokenization alone.
- Entry occurs when sensitive data is pulled into a usable form through GenAI prompts, SaaS connectors, or MCP-linked workflows.
- Credentialed access then allows systems, users, or AI agents to retrieve information that encryption or tokenization had previously hidden at rest.
- Impact follows when that usable data is redacted poorly, reproduced in model outputs, or forwarded to destinations that were never meant to receive it.
Breaches seen in the wild
- DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Usable-data governance is the real control boundary: Encryption and tokenization both reduce exposure, but neither answers the harder question of who or what can see sensitive data after it is restored for use. That makes the decisive governance layer the one around retrieval, redaction, and forwarding, not the one around storage format. Practitioners should treat data usability as the boundary that matters most.
GenAI turns data format controls into incomplete controls: A protected value is still vulnerable once it enters prompts, context windows, or tool outputs where the model can process and repeat it. The issue is not whether the data was encrypted earlier, but whether the surrounding workflow prevents unintended disclosure once the data becomes consumable. That shifts security from static protection to runtime inspection.
MCP DLP is a control plane problem, not a feature add-on: MCP workflows connect AI agents to business systems through authorized retrieval, which means sensitive data can flow along legitimate paths at machine speed. If those paths are not governed, encryption and tokenization simply move the trust problem downstream. The implication is that teams must model agent retrieval as a first-class access channel.
Token vaults and key management are necessary but not sufficient: Strong cryptography still matters, yet key control only addresses one segment of the lifecycle. When applications must decrypt data to operate, the residual risk is what happens next: who can see it, store it, forward it, or prompt it into an AI model. Practitioners need policy and inspection around the post-decryption state.
Data protection in AI environments now spans human, NHI, and autonomous actors: The same sensitive record may be safe in storage, visible to a service account during processing, and exposed again through an AI response. That cross-actor movement is where governance breaks down if teams treat cryptography as the end of the problem. The field needs workflows that limit re-exposure across all three identity types.
From our research library:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- Read next: MCP Security Guide
What this signals
Usable-data governance is the missing layer: Encryption and tokenization reduce exposure, but they do not govern what happens after a value is restored for use. Security teams now need to think in terms of retrieval points, prompt boundaries, and forwarding controls, because that is where GenAI and MCP workflows can leak data.
Runtime inspection has to follow the workflow, not the file: Sensitive data can be protected in storage and still leak through prompts, connector outputs, or agent responses. According to the State of Secrets in AppSec, 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases.
For practitioners
- Map where data becomes usable Identify every point where encrypted or tokenized data is restored for processing, then classify who or what can read, copy, or forward it at that moment.
- Place DLP at workflow boundaries Enforce redaction, blocking, or alerting before prompts, connector calls, exports, and agent handoffs so sensitive values do not move unchecked into AI contexts.
- Separate cryptographic protection from access governance Review whether key management, token vaults, and access permissions are being treated as one control when they actually govern different parts of the exposure path.
- Inventory MCP-connected retrieval paths Document which SaaS sources AI agents can query, what sensitive fields they can retrieve, and where those values can be sent after retrieval.
Key takeaways
- Tokenization and encryption both reduce direct exposure, but neither one solves the governance problem created when sensitive data must be restored for legitimate use.
- The risk increases in GenAI and MCP workflows because readable data can move across prompts, connectors, logs, and agent handoffs faster than storage controls can govern it.
- Practitioners should place DLP, redaction, and access inspection around the usable-data boundary, where the real disclosure risk begins.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Sensitive values can reappear in prompts, logs, and agent outputs after de-tokenization. |
| NHI-05 — Overprivileged NHI | MCP-connected agents may retrieve more sensitive data than their task requires. | |
| Recommendation — Control secret leakage paths by inspecting prompt, log, and connector traffic for readable sensitive data. Reduce retrieval scope so agents only access the fields required for each workflow. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about who can reach usable data after protection controls are bypassed by workflow. |
| Recommendation — Review permissions on data retrieval paths and limit access to usable sensitive records. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The risk pattern is sensitive data being obtained and then forwarded through legitimate or abused workflows. |
| Recommendation — Map prompt and connector leakage to credential access and exfiltration detection coverage. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Cloud and SaaS data flows depend on governance of who can retrieve and move sensitive values. |
| Recommendation — Apply IAM controls to retrieval and forwarding paths that expose readable sensitive data. | ||
Key terms
- Usable Data Boundary: The point at which protected information becomes readable, actionable, or transferable by a workflow, system, or identity. In modern environments, this boundary matters more than storage location because encryption or tokenization may protect the record while still allowing the data to be exposed at runtime.
- Token Vaulting: Token vaulting stores sensitive credentials in a controlled system and releases them only when a workflow is authorised to use them. It reduces exposure in developer and automation environments by removing static secrets from endpoints, logs, and configuration files where malicious code often looks first.
- GenAI DLP: GenAI DLP applies data-loss prevention controls to prompts, uploads, and outputs in AI tools. It treats interactions with LLM-based systems as data transfer events, which allows teams to detect, block, or warn when regulated content or secrets are being shared.
- MCP Workflow: An MCP workflow is the sequence of steps an AI agent follows when using the Model Context Protocol to request tools, data, or actions. It defines how the agent discovers capabilities, sends structured requests, receives responses, and continues execution. In security terms, it creates a governed path for agent-to-system interaction.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org