Topic starter
19/08/2026 3:42 pm
TL;DR: Data masking now has to protect sensitive information as it moves through SaaS, cloud storage, GenAI prompts, browsers, endpoints, APIs, and MCP-connected tools, according to Strac’s analysis. Traditional database-centric masking is too narrow because modern data exposure is increasingly real-time, contextual, and workflow-driven, not just storage-based.
Editorial analysis by NHI Mgmt Group, based on content published by Strac: “Embracing Security with Data Masking”.
Key questions
Q: How should security teams protect sensitive data across SaaS and GenAI workflows?
A: Use continuous discovery, classification and real-time remediation together.
Q: When does data masking fail to reduce exposure in practice?
A: Masking fails when it is limited to storage systems while data is actually being moved through prompts, tickets, browser sessions, or agent workflows.
Q: What signals show that masking controls are too narrow for modern environments?
A: The strongest signal is repeated sensitive-data movement through channels that bypass the systems where masking is configured, such as SaaS apps, browser uploads, GenAI prompts, and MCP tool calls.
Practitioner guidance
- Map sensitive-data movement paths Inventory where PII, PHI, PCI data, credentials, and other sensitive information travel across SaaS, cloud storage, browsers, endpoints, APIs, and MCP-connected tools.
- Pair discovery with inline remediation Connect sensitive-data discovery to a response engine that can mask, redact, block, delete, quarantine, encrypt, or coach based on the destination and workflow.
- Extend policies to GenAI prompts and uploads Inspect prompts, files, and attachments before they reach AI applications so redaction or blocking happens at the point of entry.
Bottom line: Data masking has outgrown its database roots because sensitive information now moves through SaaS, GenAI, endpoints, APIs, and MCP-connected tools.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:21 pm
Database-era masking no longer matches the data plane. The article shows that the control assumption was built for a world where sensitive values stayed inside structured stores long enough to be masked before use. That assumption fails when the same data appears in SaaS, prompts, browser sessions, and endpoint workflows. The implication is that data masking is now a governance function for live business paths, not a storage hygiene measure.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How do organisations decide between masking, redaction, and blocking?
A: Use masking when limited visibility is enough for the workflow, redaction when the sensitive value is unnecessary, and blocking when any exposure would create unacceptable risk. The decision should follow the destination, the user, and the sensitivity of the data, not a single global rule.
👉 Read our full editorial: Data masking now needs to govern SaaS, GenAI, and MCP flows