When protecting sensitive data makes it useless – and how to stop that happening
The dilemma is one that many organisations will recognise: the need for realistic data in non-production environments such as software development, testing, AI, and analytics, versus the need to protect real sensitive…
The dilemma is one that many organisations will recognise: the need for realistic data in non-production environments such as software development, testing, AI, and analytics, versus the need to protect real sensitive data. With AI-assisted and agentic workflows become more pervasive, the need to address this dilemma has become far more pressing.
Take for example, developers and QA engineers in DevOps teams, who want realistic test data to verify the performance of software and check for flaws before it goes into production. AI-assisted development accelerates processes and drives up demand for more realistic data that can be safely used by both humans and their AI colleagues. The further data moves away from realism, the less valuable those test results become. For instance, flaws may go undetected, or data behave inconsistently across different systems, such as CRMs, order records, and payment portals.
The challenge is that using unprotected real production data such as customer records and financial information is not viable because of the security, privacy and non-compliance risks involved. That said, there is evidence that some teams are tempted to do so: other 2026 Perforce research, the State of Data Compliance and Security Report
<https://www.perforce.com/resources/pdx/state-of-data-compliance-and-security-report>, found that while data masking policies are near-universal at 99%, 84% allow compliance exceptions. Subsequent risks can include:
Audit issues or failures
Data breaches or theft
Regulatory non-compliance fines
Ransomware.
Add in the rising use of AI, and the growth of sensitive data in non-production environments (57% of those surveyed said that the volume had grown in the previous year), and the stakes getting even higher. So, on one hand we have the need for realistic data in a variety of business scenarios, versus the need to protect sensitive data and prevent the risks becoming a reality. Fortunately, the situation does not have to be a trade-off between realism and protection, with techniques and tools that, when applied effectively, mean that a balance can be struck without compromise.
How to Achieve Both Realism and Protection
The starting point is discovery, by identifying data across databases, files, cloud platforms, on-premise systems, and interconnected applications. That process should be established as a continuous and repeatable process, since data constantly changes. Create policies that can be centrally managed and applied consistently across all those locations, while still permitting rules that can be adapted for specific use cases.
The type of data best suited to the use case depends on multiple factors, such as:
Just how realistic does the data have to be?
How quickly is data needed and in what volume?
Does relevant data exist – or are there new use cases where it does not?
The Benefits of Protecting Real Data
Finding ways to better protect real sensitive data through masking techniques is one approach, helping to ensure that realism is achieved. Where reversibility is acceptable, tokenisation replaces sensitive values with tokens, typically retaining the originals in a secure vault so that authorised users can still access them. Dynamic masking is another approach which hides sensitive values when data is viewed, leaving the originals intact.
A third approach is static masking, which is designed to irreversibly replace sensitive values with fictitious equivalents, while preserving the characteristics for use cases like software testing, including established patterns, relationships, outliers and anomalies. Static data masking has become the de facto approach for many organisations, with 86% reporting that they use this method. However, there are use cases where static data masking does not make sense, especially for AI/ML use cases that have not previously existed, nor does any supporting real data to protect. This is where synthetic data becomes the logical alternative. Typical synthetic data use cases include:
New applications - create test data before any production data exists. -
New features - generate data for scenarios existing production records do not cover.
Edge cases - test rare or unusual situations that are missing from available data.
Negative testing - create invalid inputs and error scenarios to check how software handles them.
How Synthetic Data has Evolved
While synthetic data is not new, there appears to be a disconnect between confidence in the technique versus actual adoption. Other recent research from Perforce, The State of Synthetic Data Report
<https://www.perforce.com/resources/pdx/state-of-synthetic-data-report>, found that while 56% of 518 enterprise technology leaders surveyed believe that synthetic data is the best method in AI/ML workflows, including AI-assisted or agentic development and testing, only 28% reported using it extensively, and just 36% said it provided sufficient realism. 51% were not currently using it in their AI/ML workflows at all.
So what’s the problem here? Traditionally, synthetic data has had some perceived limitations. Synthetic data can look plausible record by record yet fail to reflect real business behaviour, relationships between records or the variety found in production, including unusual patterns, outliers and anomalies. The ability to handle complex business scenarios has been another factor, not to mention substantial manual configuration and scaling.
Yet synthetic data has evolved, with the current generation of technology able to automatically discover schemas, relationships and data characteristics, and is then able to generate realistic data in as little as seconds, depending on the scenario. Not only does this keep pace with the demand for fast, large volumes of data, it reduces the need for intensive manual effort. Furthermore, it can support referential integrity across the board.
Why Referential Integrity Matters
Data rarely lives in just one siloed place. Typically, data characteristics and values need to be maintained the same across multiple systems. Consider all the points within an enterprise that customer-related information might be found. Using test data as the use case again, related records must remain connected for software tests to reflect business processes, otherwise, the tests become misleading. Data masking was already able to transform matching sensitive but fictitious values consistently across different environments. Now, synthetic data achieves the equivalent by automatically discovering schemas and relationships, then generating data that preserves those relationships.
Clearly, both data masking and synthetic data have their different attributes, which is why many organisations are adopting a portfolio approach, using both depending on the use case. Once more, Delphix research backs this up, with respondents reporting use of multiple approaches.
As these organisations have recognised, the best strategy for ensuring data that is both realistic and protected is to fit the approach according to the use case, supported by best practices including continuous data discovery and prioritisation of referential integrity. Demand for high-quality, safe and at-scale data is not going away any time soon, quite the opposite thanks to the march of AI, so now is the time to put the right foundations in place for data that is useful, realistic and protected.
Mayank Ahluwalia, Senior Product Manager for Perforce Delphix, has experience across data management, data compliance, systems architecture, machine learning, and AI. He has spent much of his career as a hands-on engineer building and operating real systems, which gives him a practical view of the challenges teams face implementing data and AI platforms.