Topic starter
20/08/2026 5:28 pm
TL;DR: Sensitive data stays exposed once it must be restored for use, and Strac argues that is where tokenization and encryption lose their advantage. Runtime controls around prompts, connectors, and logs decide who can see readable data.
Editorial analysis by NHI Mgmt Group, based on content published by Strac: “Tokenization vs Encryption: Which is Better?”.
Key questions
Q: When should organisations prioritise DLP over stronger tokenization or encryption schemes?
A: They should prioritise DLP when the main risk is not storage compromise but disclosure during processing, prompting, or retrieval.
Q: What are the signs that GenAI is exposing data after encryption or tokenization?
A: Common signs include sensitive values appearing in prompts, model outputs, logs, connector traces, export files, or agent handoffs.
Q: What breaks when encryption or tokenization is the only protection for GenAI workflows?
A: The break point is usable-data exposure.
Practitioner guidance
- Map where data becomes usable Identify every point where encrypted or tokenized data is restored for processing, then classify who or what can read, copy, or forward it at that moment.
- Place DLP at workflow boundaries Enforce redaction, blocking, or alerting before prompts, connector calls, exports, and agent handoffs so sensitive values do not move unchecked into AI contexts.
- Separate cryptographic protection from access governance Review whether key management, token vaults, and access permissions are being treated as one control when they actually govern different parts of the exposure path.
Bottom line: Tokenization and encryption both reduce direct exposure, but neither one solves the governance problem created when sensitive data must be restored for legitimate use.
Glossary terms: Usable Data Boundary, Token Vaulting, GenAI DLP, MCP Workflow
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
20/08/2026 6:16 pm
Usable-data governance is the real control boundary: Encryption and tokenization both reduce exposure, but neither answers the harder question of who or what can see sensitive data after it is restored for use. That makes the decisive governance layer the one around retrieval, redaction, and forwarding, not the one around storage format. Practitioners should treat data usability as the boundary that matters most.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should teams govern AI agents that use MCP?
A: Treat each connected agent as a non-human identity with an owner, a scope, and a review cycle. The practical control set is familiar: least privilege, secret rotation, access expiration, and auditability across the systems the agent can reach.
👉 Read our full editorial: Why GenAI workflows leave sensitive data exposed after protection
This post was modified 2 days ago by NHI Mgmt Group